joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100121d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
sub esp, 0x24
cmp ecx, eax
jne 0x100121ee
push 0x10094b14
call fcn.1001b690
add esp, 4
add esp, 0x24
ret
cmp ecx, 4
jne 0x10012204
push 0x10094b08
call fcn.1001b690
add esp, 4
add esp, 0x24
ret
mov dl, 0x65
mov byte [esp + 0x1e], cl
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0xf], dl
mov byte [esp + 0x13], dl
mov dx, word [0x100ad640]
mov byte [esp + 3], al
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 9], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], al
mov word [esp], dx
mov edx, dword [ecx + 0x10]
mov ecx, dword [0x100ab2e0]
push eax
lea eax, [esp + 4]
push 0x22
push eax
push ecx
mov byte [esp + 0x12], 0x1c
mov byte [esp + 0x16], pe_nt_image_headers32
mov byte [esp + 0x17], 0x38
mov byte [esp + 0x18], 0xc
mov byte [esp + 0x1a], 0xe
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x1c], 0x6e
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x77
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], 0x51
mov byte [esp + 0x22], 0x75
mov byte [esp + 0x24], 0x73
mov byte [esp + 0x25], 0x74
mov byte [esp + 0x26], 0x69
mov byte [esp + 0x27], 0x6f
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 2
mov dword [esp + 0x2a], edx
call fcn.10011db0
add esp, 0x24
ret
Function at 0x1001f850
Capabilities:
Terminate thread

Disassembly:
push esi
push edi
push 0x100ad6f8
call fcn.1002a7b0
push 0x100ad6fc
call fcn.1002a7b0
push 0x100ad700
call fcn.1002a7b0
push 0x100ad710
call fcn.1002a7b0
push 0x100ad71c
call fcn.1002a7b0
push 0x100ad714
call fcn.1002a7b0
push 0x100ad718
call fcn.1002a7b0
push 0x100ad720
call fcn.1002a7b0
push 0x100ad728
call fcn.1002a7b0
push 0x100ad724
call fcn.1002a7b0
push 0x100ad704
call fcn.1002a7b0
push 0x100ad72c
call fcn.1002a7b0
push 0x100ad730
call fcn.1002a7b0
push 0x100ad734
call fcn.1002a7b0
mov eax, dword [0x100ad7f0]
xor edi, edi
add esp, 0x38
mov dword [eax + 0x5c], edi
mov ecx, dword [0x100ad7dc]
call fcn.1000b4e0
mov eax, dword [0x100ad4f8]
mov dword [0x100ad860], edi
mov dword [0x100ad868], edi
mov dword [0x100ad86c], edi
mov dword [0x100ad864], edi
mov esi, dword [eax]
cmp esi, eax
je 0x1001f933
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push edi
push ecx
call ebx
mov esi, dword [esi]
mov eax, dword [0x100ad4f8]
cmp esi, eax
jne 0x1001f920
pop ebx
pop edi
pop esi
ret

Function at 0x100203b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov ecx, 0x100ad4f0
jmp fcn.10006010

Function at 0x10025740
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081838
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x10099998
lea ecx, [ebp - 0x14]
call fcn.10079ba9
xor esi, esi
mov dword [ebp - 4], esi
mov byte [ebp - 4], 1
mov eax, dword [0x100ad5e8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x70]
mov eax, dword [edx + 0x1ec]
mov eax, dword [eax + 4]
add eax, 0x34
mov dword [ebp - 0x18], eax
push eax
lea ecx, [ebp - 0x14]
call fcn.10079df1
push 0x100946e0
lea ecx, [ebp - 0x14]
call fcn.10079df1
mov dword [ebp - 4], esi
push esi
lea ecx, [ebp - 0x14]
call fcn.10079e45
push eax
push esi
mov ecx, dword [ebp + 8]
push ecx
push 0x1009517c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10079b3b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100259d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10081878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [esp + 0x20]
push esi
xor esi, esi
mov byte [esp + 4], al
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 0x24]
lea ecx, [esp + 4]
push ecx
push edx
call fcn.10028490
add esp, 4
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.10028490
add esp, 4
push eax
call fcn.100285a0
add esp, 0xc
test eax, eax
jne 0x10025a55
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esp + 8]
push ecx
call fcn.10075d4d
add esp, 4
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebp, ebp
mov ecx, dword [esp + 0x14]
cmp ecx, esi
jne 0x10025a6c
xor eax, eax
jmp 0x10025a75
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
dec eax
cmp ebp, eax
jae 0x10025bae
mov edx, dword [ecx + ebp*4 + 4]
push edx
call fcn.10028530
mov ebx, eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + ebp*4]
push ecx
call fcn.10028500
push ebx
mov esi, eax
call fcn.1001ac30
add esp, 0xc
push 0x3e8
call edi
call fcn.10020b10
test eax, eax
je 0x10025aa2
call fcn.100259c0
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx + ebp*4]
jne 0x10025b95
push 0x1f4
call edi
push esi
call fcn.10020b00
add esp, 4
test eax, eax
je 0x10025aa2
mov edx, dword [0x100ad830]
push edx
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x10025b8b
mov eax, dword [0x100ad834]
push eax
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x10025b8b
push ebx
call fcn.1001ac30
add esp, 4
push 0x3e8
call edi
push esi
call fcn.10020b00
add esp, 4
test eax, eax
je 0x10025aa2
call fcn.10047855
cdq
mov ecx, 0xa
idiv ecx
mov ecx, 0x100ad4f0
sub edx, 5
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
fstp dword [esp + 0x30]
call fcn.10005a90
fadd dword [esp + 0x30]
push ecx
fstp dword [esp]
call fcn.10047855
cdq
mov ecx, 0xa
idiv ecx
mov ecx, 0x100ad4f0
sub edx, 5
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
fstp dword [esp + 0x34]
call fcn.10005a00
fadd dword [esp + 0x34]
push ecx
fstp dword [esp]
call fcn.1001abc0
add esp, 8
jmp 0x10025aa2
call fcn.1001ad70
jmp 0x10025aa2
cmp eax, dword [ecx + ebp*4 + 4]
jne 0x10025aa2
push 0x3e8
call edi
inc ebp
xor esi, esi
jmp 0x10025a60
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [esp + 0x14]
push edx
call fcn.10075d4d
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x1c
ret
Function at 0x10027220
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1002723f
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10027289
xor eax, eax
add esp, 0x14
ret
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x10028cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0xb8
cmp ecx, 0xf6
mov eax, edx
push esi
mov esi, ecx
jne 0x10028cd0
mov esi, 3
cmp edx, 0xf6
jne 0x10028cdd
mov eax, 3
cmp ecx, 0x244
jne 0x10028cea
mov esi, 4
cmp edx, 0x244
jne 0x10028cf7
mov eax, 4
mov ecx, 0x3ea
mov edx, 0x3f7
push ebx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x80], edx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xa8], edx
push ebp
lea ecx, [esi + eax*4]
mov edx, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
xor ebx, ebx
mov ebp, 0x3f3
mov edi, 0x3ee
add edx, ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], 0x3e9
mov dword [esp + 0x70], ebp
mov dword [esp + 0x78], edi
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x84], 0x3ef
mov dword [esp + 0x8c], edi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebp
mov dword [esp + 0x9c], 0x3f6
mov dword [esp + 0xa4], 0x3eb
mov dword [esp + 0xa8], 0x3ed
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb4], 3
mov dword [esp + 0xb8], 4
mov dword [esp + 0xbc], 6
mov dword [esp + 0xc0], 7
mov dword [esp + 0xc4], ebx
mov ecx, dword [esp + edx*4 + 0x64]
mov dword [esp + 0x18], 0x10099c84
mov dword [esp + 0x1c], 0x10099c7c
mov dword [esp + 0x20], 0x10099c74
mov dword [esp + 0x24], 0x10099c68
mov dword [esp + 0x28], 0x10099c60
mov edx, dword [esp + eax*4 + 0x18]
mov dword [esp + 0x3c], 0xb8
mov dword [esp + 0x40], 0x19
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 5
mov edi, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x50], 0x80
mov dword [esp + 0x54], 0x404
mov dword [esp + 0x58], 0x7ea
mov dword [esp + 0x5c], 0x44c
mov dword [esp + 0x60], 0x7b4f1
mov ebp, dword [esp + eax*4 + 0x50]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
push eax
call fcn.10020480
add esp, 4
push 0x3e8
call esi
mov dx, word [0x100ad63c]
mov cx, word [0x100ad638]
or eax, 0xffffffff
mov word [esp + 0x26], dx
mov dword [esp + 0x22], eax
mov dword [esp + 0x38], eax
mov eax, dword [0x100ab2e0]
push ebx
lea edx, [esp + 0x1c]
mov word [esp + 0x1c], cx
mov ecx, dword [esp + 0x14]
push 0x24
push edx
push eax
mov dword [esp + 0x2a], 8
mov dword [esp + 0x2e], edi
mov dword [esp + 0x38], 0x10
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edi
call fcn.10011db0
push 0x5dc
call esi
mov ecx, dword [0x100ad830]
push ecx
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x10028efb
mov edx, dword [0x100ad834]
push edx
call fcn.100274e0
add esp, 4
test eax, eax
je 0x10028f00
call fcn.1001ad70
push 0x7d0
call esi
mov eax, dword [esp + 0xcc]
push eax
call fcn.10020af0
add esp, 4
test eax, eax
jne 0x10028e60
pop edi
pop ebp
pop ebx
push 0x3e8
call esi
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.10028500
push eax
call fcn.10020b00
add esp, 8
test eax, eax
je 0x10028f22
push 0x3e8
call esi
pop esi
add esp, 0xb8
ret
Function at 0x100296c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push 0xffffffffffffffff
push 0x100819af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], 1
mov eax, dword [0x1009b834]
mov dword [esp + 0xc], eax
mov byte [esp + 0x20], 2
mov ecx, dword [0x1009b834]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x20], 3
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x10]
call fcn.10079c28
mov eax, dword [esp + 0x2c]
cmp dword [eax - 8], esi
jle 0x10029765
mov ebx, dword [esp + 0x30]
mov al, byte [esi + eax]
xor ecx, ecx
mov cl, bh
xor cl, al
push ecx
push esi
lea ecx, [esp + 0x14]
call fcn.10079f17
mov edx, dword [esp + 0xc]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea edx, [eax + ecx*2]
mov eax, dword [esp + 0x2c]
sub ebx, edx
inc esi
cmp esi, dword [eax - 8]
jl 0x10029721
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
call fcn.10079c28
lea ecx, [esp + 0xc]
call fcn.10079ac6
mov eax, dword [esp + 0x2c]
xor edi, edi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x100297e9
mov cl, byte [edi + eax]
push 0x10099c8c
mov byte [esp + 0x34], cl
lea ecx, [esp + 0x14]
mov esi, dword [esp + 0x34]
and esi, 0xff
call fcn.10079c78
mov eax, esi
mov ecx, 0x1a
cdq
idiv ecx
lea ecx, [esp + 0x10]
add al, 0x41
mov ebx, edx
push eax
push 0
call fcn.10079f17
add bl, 0x41
lea ecx, [esp + 0x10]
push ebx
push 1
call fcn.10079f17
lea edx, [esp + 0x10]
lea ecx, [esp + 0xc]
push edx
call fcn.10079e2d
mov eax, dword [esp + 0x2c]
inc edi
cmp edi, dword [eax - 8]
jl 0x10029789
mov esi, dword [esp + 0x28]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.100798b0
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 0x10]
call fcn.10079b3b
mov byte [esp + 0x20], 1
lea ecx, [esp + 0xc]
call fcn.10079b3b
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call fcn.10079b3b
mov ecx, dword [esp + 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x10029840
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x100819ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], 1
mov eax, dword [0x1009b834]
mov dword [esp + 4], eax
mov byte [esp + 0x20], 2
mov ecx, dword [0x1009b834]
mov dword [esp + 8], ecx
mov byte [esp + 0x20], 3
lea ecx, [esp + 4]
call fcn.10079ac6
mov ecx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x1002990a
push edi
mov dl, byte [ecx + esi*2]
mov al, byte [ecx + esi*2 + 1]
mov byte [esp + 0x10], dl
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x10]
push 0x10099c90
and eax, 0xff
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*4]
mov eax, dword [esp + 0x18]
and eax, 0xff
lea ecx, [esp + 0x10]
lea edi, [eax + edx*2 - 0x6db]
call fcn.10079c78
push edi
push 0
lea ecx, [esp + 0x14]
call fcn.10079f17
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
call fcn.10079e2d
mov ecx, dword [esp + 0x30]
inc esi
mov eax, dword [ecx - 8]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jl 0x100298a2
pop edi
lea edx, [esp + 4]
lea ecx, [esp + 0x2c]
push edx
call fcn.10079c28
mov edx, dword [esp + 0x2c]
xor esi, esi
mov eax, dword [edx - 8]
test eax, eax
jle 0x1002996d
push ebx
mov ebx, dword [esp + 0x34]
mov dl, byte [esi + edx]
xor eax, eax
mov al, bh
lea ecx, [esp + 8]
xor al, dl
push eax
push esi
call fcn.10079f17
mov edx, dword [esp + 0x30]
movzx ax, byte [esi + edx]
add eax, ebx
mov ebx, 0x58bf
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
sub ebx, eax
mov eax, dword [edx - 8]
inc esi
cmp esi, eax
jl 0x1002992a
pop ebx
mov esi, dword [esp + 0x28]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.100798b0
mov dword [esp + 0x14], 1
mov byte [esp + 0x20], 2
lea ecx, [esp + 8]
call fcn.10079b3b
mov byte [esp + 0x20], 1
lea ecx, [esp + 4]
call fcn.10079b3b
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x2c]
call fcn.10079b3b
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x1002a7b0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10085f30
push 0x10047688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x1002a80c
push 0
mov eax, dword [eax + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], 0
jmp 0x1002a80c
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081a2f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], 0
push 0x104
mov ecx, 0x100ad5e4
call fcn.10079e45
push 0x10095ec4
mov ecx, 0x100ad5e4
call fcn.10079c78
push 0xffffffffffffffff
mov ecx, 0x100ad5e4
call fcn.10079e94
mov eax, dword [0x1009b834]
mov dword [ebp - 0x18], eax
mov edi, 1
mov dword [ebp - 4], edi
mov byte [ebp - 4], 2
mov ecx, dword [0x100ad5e8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x70]
mov ecx, dword [eax + 0x1ec]
mov eax, dword [ecx + 4]
add eax, 0x34
mov dword [ebp - 0x1c], eax
push eax
push 0x100ad5e4
lea edx, [ebp - 0x20]
push edx
call fcn.10079d1e
mov bl, 3
mov byte [ebp - 4], bl
push 0x10095ebc
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10079d1e
mov byte [ebp - 4], 4
push eax
mov ecx, 0x100ad5e4
call fcn.10079c28
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x24]
call fcn.10079b3b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.10079b3b
mov dword [ebp - 4], edi
push 0x104
lea ecx, [ebp - 0x18]
call fcn.10079e45
mov ecx, dword [0x100ad5e4]
push ecx
push 0x104
push 0
lea ecx, [ebp - 0x18]
call fcn.10079e45
push eax
push 0x100a1990
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.10079e94
lea ecx, [ebp - 0x18]
push ecx
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.100798b0
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.10079b3b
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fd70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x10081c10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.100755f6
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.10079ba9
mov byte [esp + 0x34], 0
lea ecx, [esp + 0x18]
push ecx
call fcn.10023310
mov ebx, dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 8
mov eax, dword [0x100ad814]
test eax, eax
jne 0x1002fdeb
push str.Exchange_Frame
call fcn.100272a0
add esp, 4
mov dword [0x100ad814], eax
mov eax, dword [0x100ad81c]
test eax, eax
jne 0x1002fe06
push str.Exchange_Checkbox_Locked
call fcn.100272a0
add esp, 4
mov dword [0x100ad81c], eax
mov eax, dword [0x100ad824]
test eax, eax
jne 0x1002fe21
push str.Trade_Accept_Button
call fcn.100272a0
add esp, 4
mov dword [0x100ad824], eax
mov edx, dword [0x100ad814]
push edx
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x1002fee4
lea eax, [esp + 0x14]
push 1
push eax
call fcn.1002fcd0
add esp, 8
test eax, eax
je 0x1002ff9a
push ebx
call fcn.10022840
add esp, 4
cmp eax, 0xffffffff
jne 0x1002fe76
push 0x1009a148
call fcn.1001b690
add esp, 4
push 0x2710
call esi
jmp 0x1002fdd0
push eax
call fcn.1002d3e0
add esp, 4
push 0x320
call esi
call fcn.1001b7d0
push 0xbb8
call esi
call ebp
mov ecx, dword [0x100ad814]
mov edi, eax
push ecx
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x1002fece
call ebp
sub eax, edi
cmp eax, 0x2710
ja 0x1002fece
push 0x3e8
call esi
mov edx, dword [0x100ad814]
push edx
call fcn.100274e0
add esp, 4
test eax, eax
je 0x1002fea9
mov eax, dword [0x100ad814]
push eax
call fcn.100274e0
add esp, 4
test eax, eax
je 0x1002fdd0
call fcn.10027780
test eax, eax
je 0x1002ff1a
mov ecx, dword [0x100ad814]
push ecx
call fcn.100274e0
add esp, 4
test eax, eax
je 0x1002ff1a
lea edx, [esp + 0x14]
push edx
call fcn.1002d850
add esp, 4
test eax, eax
je 0x1002ff1a
call fcn.10027780
test eax, eax
jne 0x1002feed
mov eax, dword [0x100ad814]
push eax
call fcn.100274e0
add esp, 4
test eax, eax
je 0x1002fdd0
mov ecx, dword [0x100ad81c]
push ecx
call fcn.10027540
add esp, 4
test eax, eax
jne 0x1002ff54
call fcn.1001b120
push 0x3e8
call esi
jmp 0x1002fdd0
mov edx, dword [0x100ad81c]
push edx
call fcn.10027540
add esp, 4
test eax, eax
je 0x1002fdd0
mov eax, dword [0x100ad824]
push eax
call fcn.100275a0
add esp, 4
test eax, eax
je 0x1002ff8e
call fcn.1001b170
push 0x3e8
call esi
jmp 0x1002fdd0
push 0x7d0
call esi
jmp 0x1002fdd0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.10075629
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret
Function at 0x10030380
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov ecx, 0x100ad4f0
call fcn.100067a0
cmp eax, 0x222
jne 0x1003041f
mov eax, dword [0x100ad7e4]
mov ecx, dword [eax + 0x404]
test ecx, ecx
je 0x100303b1
push 3
jmp 0x100303b3
push 0
call fcn.10030750
add esp, 4
mov ecx, 0x100ad4f0
call fcn.100067a0
cmp eax, 0x222
jne 0x1003041f
push 1
push 1
push 0x3f800000
push 0x42080000
push 0x41600000
mov ecx, 0x100ad4f0
call fcn.10005ba0
push 0x1f4
call ebx
push 0x10098b88
mov ecx, 0x100ad4f0
call fcn.10006620
push 0x1f4
call ebx
push 0x1009a114
call fcn.1001adb0
add esp, 4
push 0x1770
call ebx
jmp 0x10030389
push 0x47a
call fcn.10025560
add esp, 4
cmp eax, 0xffffffff
jne 0x1003049c
push 0
push 0x50
push 0x83
push 0x100947c4
push 0x10098b88
mov ecx, 0x100ad4f0
call fcn.10007ad0
push str.SXRW_090119_002
call fcn.1001adb0
add esp, 4
push 0x3e8
call ebx
push 0
mov edi, str.SXRW_090119_175
call fcn.1002b310
add esp, 4
mov esi, eax
mov ecx, 0x13
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x10030483
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100305c2
call fcn.1001b2a0
push 0x3e8
call ebx
jmp 0x10030389
cmp eax, 2
jne 0x100304ba
push 0x47a
call fcn.1002adf0
add esp, 4
push 0x7d0
call ebx
jmp 0x10030389
cmp eax, 1
jne 0x1003050d
push 0
push 0x50
push 0x83
push 0x100947c4
push 0x10098b88
mov ecx, 0x100ad4f0
call fcn.10007ad0
push str.SXRW_090119_002
call fcn.1001adb0
add esp, 4
push 0x3e8
call ebx
call fcn.1002ad80
push 0x3e8
call ebx
call fcn.1002ad80
push 0x3e8
call ebx
jmp 0x10030389
test eax, eax
jne 0x100304ae
call fcn.100203c0
test eax, eax
mov ecx, 0x100ad4f0
jne 0x10030574
push eax
push 0x50
push 0x83
push 0x100947c4
push 0x10098b88
call fcn.10007ad0
mov ecx, 0x100ad4f0
call fcn.10008da0
push 0xbb8
call ebx
push str.SXRW_090119_002
call fcn.1001adb0
add esp, 4
push 0x3e8
call ebx
push str.SXRW_090119_015
call fcn.1001adb0
add esp, 4
push 0x1f40
call ebx
jmp 0x10030389
push 0x400
push 0x400
push 0x100947c4
call fcn.10007b70
push 1
push 1
push 0x3f800000
push 0x42a00000
push 0x43030000
mov ecx, 0x100ad4f0
call fcn.10005ba0
push 0xbb8
call ebx
mov ecx, 0x100ad4f0
call fcn.100067a0
cmp eax, 0x222
jne 0x100305a5
jmp 0x10030389
mov ecx, dword [0x100ad7dc]
pop edi
pop esi
pop ebx
jmp fcn.100110d0

Function at 0x10031d80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100ad6f4]
test esi, esi
jne 0x10031d91
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 6
push esi
call edi
mov ecx, 0x10031d30
mov byte [esi], 0xe9
sub ecx, esi
mov byte [esi + 5], 0x90
sub ecx, 5
lea edx, [esp + 8]
mov dword [esi + 1], ecx
mov eax, dword [esp + 8]
push edx
push eax
push 6
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x10031dd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x100ad6f4]
test esi, esi
jne 0x10031de1
xor eax, eax
pop esi
pop ecx
ret
lea eax, [esp + 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 6
push esi
call edi
mov dword [esi], 0x830104db
mov word [esi + 4], 0x8c4
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push edx
push 6
push esi
call edi
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x10031e20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push 0x42c80000
push esi
push edi
call fcn.10020bf0
add esp, 0xc
test eax, eax
je 0x10031ecb
mov eax, dword [esp + 0xc]
push 0
push esi
push edi
push eax
call fcn.10020490
push 0
call fcn.1001af50
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x14
push 0x5dc
call esi
mov ecx, dword [0x100ad830]
push ecx
call fcn.100274e0
add esp, 4
test eax, eax
jne 0x10031e8c
mov edx, dword [0x100ad834]
push edx
call fcn.100274e0
add esp, 4
test eax, eax
je 0x10031e91
call fcn.1001ad70
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push ebp
call edi
mov ebp, dword [esp + 0x20]
mov ebx, eax
push 0x7d0
call esi
call edi
sub eax, ebx
cmp eax, 0x4e20
ja 0x10031ec2
push ebp
mov ecx, 0x100ad4f0
call fcn.10006730
test eax, eax
je 0x10031ea1
push 0x3e8
call esi
pop ebp
pop ebx
pop edi
pop esi
ret