joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100014c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
mov eax, dword [0x1003e008]
xor eax, ebp
mov dword [ebp - 0x18], eax
cmp dword [ebp + 8], 0
je 0x100014e4
mov eax, dword [ebp + 8]
mov ecx, dword [0x10040b38]
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10040b30], eax
je 0x100014fc
mov eax, 0x10dd
jmp 0x10001879
cmp dword [0x10040b34], 0
je 0x10001514
call fcn.10001300
mov eax, dword [0x10040b34]
jmp 0x10001879
mov dword [ebp - 4], 0
mov edx, dword [0x10040b40]
mov dword [ebp - 0x10], edx
jmp 0x1000152e
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x100015bd
mov edx, dword [ebp - 0x10]
cmp dword [edx + 4], 0
je 0x10001575
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
movzx edx, byte [ecx + 0x36]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
add ecx, 0x20
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
call fcn.10019c20
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
jmp 0x100015b8
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax + 0x44]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
push eax
call fcn.10001890
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x40]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100018d0
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x10]
mov dword [eax], edx
jmp 0x10001526
mov eax, dword [0x10040b3c]
mov dword [ebp - 0xc], eax
jmp 0x100015cf
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x10001723
mov dword [ebp - 0x2e8], 0x10001
lea eax, [ebp - 0x2e8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
push eax
call 0x101a19d6
test eax, eax
je 0x1000171e
mov eax, dword [0x10040b40]
mov dword [ebp - 0x2ec], eax
jmp 0x1000161a
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx]
mov dword [ebp - 0x2ec], edx
cmp dword [ebp - 0x2ec], 0
je 0x1000171e
mov eax, dword [ebp - 0x2ec]
cmp dword [eax + 4], 0
je 0x100016a2
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ebp - 0x230]
cmp edx, dword [ecx + 0x10]
jb 0x100016a0
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [eax + 0x10]
add ecx, 4
cmp dword [ebp - 0x230], ecx
jae 0x100016a0
mov edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x230]
sub eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x2ec]
mov edx, dword [ecx + 0x10]
push edx
call fcn.10001a00
add esp, 8
movzx eax, al
mov ecx, dword [ebp - 0x2ec]
add eax, dword [ecx + 0xc]
mov dword [ebp - 0x230], eax
lea edx, [ebp - 0x2e8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
invalid
invalid
dec esp
movsd dword es:[edi], dword [esi]
xchg ebx, eax
Function at 0x10001970
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10001985
xor eax, eax
jmp 0x100019fa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100019b2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x100019f5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x100019f3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x100019ef
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100019f3
xor eax, eax
jmp 0x100019fa
jmp 0x100019a9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10001aa0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10040b34], 0
je 0x10001ab9
mov eax, dword [0x10040b34]
jmp 0x10001b59
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x10001acb
xor eax, eax
jmp 0x10001b59
push 8
call fcn.100176ce
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10001b21
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x10001b0a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100176c9
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x10040b34], eax
mov dword [0x10040b38], 0
mov eax, dword [ebp - 4]
jmp 0x10001b59
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10001b3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x10001aeb
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x10040b3c]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x10040b3c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10002380
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000243c
cmp dword [ebp - 4], 0x50000000
jb 0x100023bc
cmp dword [ebp - 4], 0x80000000
ja 0x100023bc
mov dword [ebp - 4], 0x80010000
jmp 0x10002395
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100199f0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100023e2
jmp 0x1000243c
cmp dword [ebp - 0x10], 0x10000
jne 0x10002425
cmp dword [ebp - 0x14], 0x10000
jb 0x10002425
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10002418
mov eax, dword [ebp - 0x24]
jmp 0x1000243e
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10002437
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.10002450
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10002395
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10002480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10002544
cmp dword [ebp - 4], 0x50000000
jb 0x100024c1
cmp dword [ebp - 4], 0x80000000
ja 0x100024c1
mov dword [ebp - 4], 0x4fff0000
jmp 0x1000249a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.100199f0
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100024e7
jmp 0x10002544
cmp dword [ebp - 0x10], 0x10000
jne 0x1000252a
cmp dword [ebp - 0x14], 0x10000
jb 0x1000252a
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x1000251d
mov eax, dword [ebp - 0x24]
jmp 0x10002546
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000253f
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.10002550
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000249a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100034b0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x100034cb
bts eax, 7
shr ecx, 1
test cl, 1
je 0x100034d6
bts eax, 6
shr ecx, 1
test cl, 1
je 0x100034e1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x100034ec
bts eax, 4
shr ecx, 1
test cl, 1
je 0x100034f7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10003502
bts eax, 2
shr ecx, 1
test cl, 1
je 0x1000350d
bts eax, 1
test cl, 2
je 0x10003516
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [edi + eax*4], ebx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x100035b5
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x100035a6
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x100034c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100035e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push 0x10038d08
push dword [ebp + 8]
mov dword [ebp - 4], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp + 0xc], 0
call fcn.1001aef8
add esp, 0xc
test eax, eax
je 0x10003619
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call fcn.1001af3f
add esp, 4
mov ebx, eax
mov dword [ebp + 8], ebx
push dword [ebp + 0xc]
test ebx, ebx
jne 0x10003645
call fcn.1001afc0
add esp, 4
xor al, al
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call fcn.1001b20c
add esp, 0x10
test eax, eax
je 0x1000369f
push esi
nop word [eax + eax]
mov esi, ebx
test eax, eax
je 0x10003687
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 4]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10003666
mov ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push 0x400
push 1
push ebx
call fcn.1001b20c
add esp, 0x10
test eax, eax
jne 0x10003660
pop esi
push ebx
call fcn.1001b33d
push dword [ebp + 0xc]
call fcn.1001afc0
not dword [edi]
add esp, 8
mov al, 1
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10006660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100439dc]
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x1000678f
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100066dd
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 1
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.LangSelection
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100066d4
push 0x10038d88
lea eax, [ebp - 4]
push 4
push eax
call fcn.1001c92a
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10038d88
lea eax, [ebp - 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006705
test dl, dl
je 0x10006701
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006705
add eax, 2
add ecx, 2
test dl, dl
jne 0x100066e5
xor eax, eax
jmp 0x1000670a
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
push esi
mov esi, dword [0x100439dc]
lea eax, [ebp - 4]
cmove esi, ecx
mov ecx, 0x10038d8c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006740
test dl, dl
je 0x1000673c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006740
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006720
xor eax, eax
jmp 0x10006745
sbb eax, eax
or eax, 1
test eax, eax
mov ecx, 1
lea eax, [ebp - 4]
cmove esi, ecx
mov ecx, 0x10038d90
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006777
test dl, dl
je 0x10006773
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006777
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006757
xor eax, eax
jmp 0x1000677c
sbb eax, eax
or eax, 1
test eax, eax
mov ecx, 2
cmove esi, ecx
mov dword [0x100439dc], esi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10009000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, edx
xor eax, eax
mov ebx, ecx
test edi, edi
jle 0x10009052
mov edx, dword [0x10041678]
mov ecx, 0x10037ffb
push esi
mov esi, edx
shr esi, 5
and esi, 0x1f
sub ecx, esi
pop esi
mov cl, byte [ecx]
mov byte [ebp - 1], cl
movzx ecx, dl
mov dl, byte [ebp - 1]
and ecx, 0x1f
mov ch, byte [ecx + 0x10037fdc]
nop dword [eax + eax]
mov cl, byte [eax + ebx]
rol cl, 4
xor cl, dl
sub cl, ch
mov byte [eax + ebx], cl
inc eax
cmp eax, edi
jl 0x10009040
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, edx
xor eax, eax
mov ebx, ecx
test edi, edi
jle 0x100090a2
mov ecx, dword [0x10041678]
mov edx, 0x10037ffb
push esi
movzx esi, cl
and esi, 0x1f
shr ecx, 5
sub edx, esi
and ecx, 0x1f
pop esi
mov dl, byte [edx]
mov ch, byte [ecx + 0x10037fdc]
nop
mov cl, byte [eax + ebx]
add cl, dl
xor cl, ch
rol cl, 4
mov byte [eax + ebx], cl
inc eax
cmp eax, edi
jl 0x10009090
pop edi
pop ebx
ret

Function at 0x1000aba0
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [0x1003eacc]
cmp esi, dword [0x1003ead0]
je 0x1000abd1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
invalid
Function at 0x1000ac20
Capabilities:
Copy file

Disassembly:
push esi
mov esi, dword [0x1003eae4]
cmp esi, dword [0x1003eae8]
je 0x1000ac51
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
invalid

Function at 0x1000d1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x1003ebd8]
add eax, 0xffffff3f
cmp eax, 3
ja case.default.0x1000d1c4
jmp dword [eax*4 + 0x1000d23c]
movzx edx, byte [0x1003ebd9]
mov ecx, 2
jmp 0x1000d1f1
movzx edx, byte [0x1003ebd9]
mov ecx, 3
movzx eax, byte [0x1003ebda]
shl edx, 8
or edx, eax
cmp dword [0x1003f3d8], edx
jb case.default.0x1000d1c4
inc ecx
cmp ecx, edx
jae 0x1000d21c
nop
mov eax, ecx
and eax, 0x1f
mov al, byte [eax + 0x1003f3dc]
xor al, byte [ecx + 0x1003ebd7]
xor byte [ecx + 0x1003ebd8], al
inc ecx
cmp ecx, edx
jl 0x1000d200
push edx
push 0x1003ebd8
push dword [ebp + 8]
call fcn.10019c20
add esp, 0xc
mov al, 1
pop ebp
ret 4
xor al, al
pop ebp
ret 4

Function at 0x1000f310
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
test byte [ecx + 0x10], 1
je 0x1000f37a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._XTMSTART
push eax
call fcn.10019570
add esp, 8
test eax, eax
jne 0x1000f37a
push 0x44
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.100199f0
add esp, 0xc
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x10]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10], xmm0
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
push str.Launcher.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
adc byte [edx], ch
mov esp, ebp
pop ebp
ret

Function at 0x1000f380
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1003e008]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ecx + 0x10], 2
je 0x1000f3d5
push esi
lea eax, [ecx + 0x11]
push eax
lea eax, [ebp - 0x24]
push str.XTMCHECK__s
push eax
call fcn.1000f650
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x1000f3e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7

Function at 0x1000f3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x620
mov eax, dword [0x1003e008]
xor eax, esp
mov dword [esp + 0x61c], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x15c], 0
je 0x1000f4da
push 0x104
lea eax, [esp + 0x414]
push 0
push eax
call fcn.100199f0
push 0x104
lea eax, [esp + 0x528]
push 0
push eax
call fcn.100199f0
add esp, 0x18
lea eax, [esp + 0x410]
push 0x104
push eax
push dword [0x10041684]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000f46b
push ecx
lea edx, [esp + 0x51c]
lea ecx, [esp + 0x414]
call fcn.10013320
add esp, 4
test al, al
je 0x1000f463
lea edi, [esi + 0xba]
lea eax, [esp + 0x518]
push edi
push eax
Function at 0x1000f5a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1003e008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x164], 0
je 0x1000f63d
push edi
lea ecx, [ebp - 0x404]
call fcn.100034b0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x11a]
push edi
lea ecx, [ebp - 0x404]
call fcn.100035e0
test al, al
jne 0x1000f5f1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x164]
cmp eax, dword [ebp - 0x408]
je 0x1000f607
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, eax
pop edi
test ecx, ecx
jne 0x1000f61c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [esi + 0x13a]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000f63d
push 0x1000aed0
push 0x1000aeb0
call eax
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001737a
mov esp, ebp
pop ebp
ret
Function at 0x10010500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [0x1b40bb4]
push esi
mov esi, ecx
movzx eax, word [esi + 4]
mov word [edx], ax
mov edx, dword [0x1b40bb4]
movzx eax, word [esi + 6]
mov word [edx + 0x1e2], ax
mov edx, dword [0x1b40bb4]
movzx eax, word [esi + 0x10]
mov word [edx + 0x18a], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x12]
mov word [ecx + 0x18c], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x14]
mov word [ecx + 0x18e], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x16]
mov word [ecx + 0x190], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x18]
mov word [ecx + 0x192], ax
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x1a]
mov dword [eax + 0x68], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x1c]
mov dword [eax + 0x70], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x1e]
mov dword [eax + 0x6c], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x20]
mov dword [eax + 0x74], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x22]
mov dword [eax + 0x80], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x24]
mov dword [eax + 0x84], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x26]
mov dword [eax + 0x78], ecx
mov eax, dword [0x1b40bb4]
movzx ecx, word [esi + 0x28]
mov dword [eax + 0x7c], ecx
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x2a]
mov word [ecx + 0x1ae], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x2c]
mov word [ecx + 0x1b0], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x2e]
mov word [ecx + 0x1b2], ax
mov ecx, dword [0x1b40bb4]
movzx eax, word [esi + 0x30]
mov word [ecx + 0x1b4], ax
mov eax, dword [esi + 0x34]
mov dword [0x100416f8], eax
mov eax, dword [esi + 0x3c]
mov dword [0x100416f4], eax
mov eax, dword [esi + 0x40]
mov dword [0x100416f0], eax
mov eax, dword [esi + 0x44]
mov dword [0x100416ec], eax
mov eax, dword [esi + 0x48]
mov dword [0x100416e8], eax
mov eax, dword [esi + 0x4c]
mov dword [0x100416e4], eax
mov eax, dword [esi + 0x50]
mov dword [0x100416e0], eax
mov eax, dword [esi + 0x54]
mov dword [0x100416dc], eax
mov eax, dword [esi + 0x58]
mov dword [0x100416d8], eax
mov eax, dword [esi + 0x5c]
mov dword [0x10041694], eax
pop esi
ret
Function at 0x10011470
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b4f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1003e008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10041720], 2
jne 0x1001157c
push 0xb
mov dword [ebp - 0x14], vtable.SCOPE_STRING_11_.0
call fcn.10017729
mov edi, eax
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x10], edi
movq qword [edi], xmm0
mov word [edi + 8], 0
mov byte [edi + 0xa], 0
mov dword [ebp - 4], 0
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [0x1003f700]
mov edx, esi
mov eax, dword [0x1003f704]
sub edx, ecx
mov al, byte [eax + ecx]
sub al, byte [edx + 0xa]
xor al, byte [esi + ecx]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0xb
jl 0x100114e0
movq xmm0, qword [edi]
lea ecx, [ebp - 0x24]
mov ax, word [edi + 8]
mov edx, 0xe
mov dword [ebp - 0x24], 0x3a00ec1
movq qword [ebp - 0x20], xmm0
mov word [ebp - 0x18], ax
call fcn.10010a50
invalid
invalid
xchg esp, eax
movsb byte es:[edi], byte [esi]
xchg ebx, eax

Function at 0x10011590
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x10041720], 3
jne 0x100115c0
cmp dword [0x10041704], 0
je 0x100115c0
mov edx, 5
mov dword [ebp - 8], 0x51bf05c1
lea ecx, [ebp - 8]
mov byte [ebp - 4], 0
call fcn.10010a50
mov dword [0x10041724], 0
mov dword [0x10041720], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1004171c], eax
invalid
invalid
xchg esp, eax
movsb byte es:[edi], byte [esi]
xchg ebx, eax

Function at 0x10011860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
xor esi, esi
nop dword [eax]
call fcn.1001cb2d
and eax, 0x800000ff
jns 0x10011883
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [edi + 4]
mov byte [esi + ecx], al
inc esi
cmp esi, 0xb
jl 0x10011870
xor eax, eax
mov esi, dword [edi + 4]
mov ecx, esi
sub ecx, eax
mov dl, byte [ecx + 0xa]
mov ecx, dword [edi + 8]
add dl, byte [esi + eax]
mov byte [eax + ecx], dl
inc eax
cmp eax, 0xb
jl 0x10011891
mov esi, dword [ebp + 0xc]
xor edx, edx
test esi, esi
jle 0x100118d1
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 4]
mov cl, byte [eax + edx]
sub eax, edx
xor cl, byte [edx + ebx]
add cl, byte [eax + 0xa]
mov eax, dword [edi + 8]
mov byte [edx + eax], cl
inc edx
cmp edx, esi
jl 0x100118b7
pop ebx
pop edi
pop esi
pop ebp
ret 8