joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100345c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100345b0
push 5
sub eax, 0x8369b4
push 0x8369af
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10034624
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x8369af
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x8369af
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1003462a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10034630
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10034580
push 5
sub eax, 0x77ebb5
push 0x77ebb0
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10034694
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x77ebb0
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x77ebb0
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1003469a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100346a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10034590
push 5
sub eax, 0x77ec5e
push 0x77ec59
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10034704
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x77ec59
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x77ec59
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1003470a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10034710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100345a0
push 5
sub eax, 0x77ece7
push 0x77ece2
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x10034774
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x77ece2
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x77ece2
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x1003477a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10040e70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103c0dd8]
cmp eax, 0x3e8
jbe 0x10040eea
call esi
mov dword [0x103c0dd8], eax
mov eax, 0x103c09cc
mov ecx, dword [eax - 0x24]
cmp ecx, 0xffffffff
je 0x10040e9e
dec ecx
mov dword [eax - 0x24], ecx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x10040ea8
dec ecx
mov dword [eax], ecx
mov ecx, dword [eax + 0x24]
cmp ecx, 0xffffffff
je 0x10040eb4
dec ecx
mov dword [eax + 0x24], ecx
mov ecx, dword [eax + 0x48]
cmp ecx, 0xffffffff
je 0x10040ec0
dec ecx
mov dword [eax + 0x48], ecx
mov ecx, dword [eax + 0x6c]
cmp ecx, 0xffffffff
je 0x10040ecc
dec ecx
mov dword [eax + 0x6c], ecx
mov ecx, dword [eax + 0x90]
cmp ecx, 0xffffffff
je 0x10040ede
dec ecx
mov dword [eax + 0x90], ecx
add eax, 0xd8
cmp eax, 0x103c0e04
jl 0x10040e92
pop esi
ret

Function at 0x10040f00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push esi
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0x15
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0x21
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
mov ebx, 1
push ebx
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0x49
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0x4f
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 7
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x10041062
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a1f00]
cmp eax, 0x1f4
jb 0x10041062
call esi
mov dword [0x103a1f00], eax
xor eax, eax
cmp byte [0x103a1f05], bl
mov byte [0x103a1f05], al
jne 0x10041037
mov dword [0xe8cb3c], eax
pop esi
pop ebx
pop ecx
ret
mov byte [0x103a23cd], al
mov byte [0x103a221d], al
mov dword [0xe8cb3c], eax
call fcn.10035320
call fcn.100418a0
mov dword [0x103c0dc8], ebx
mov byte [0x103a1f05], bl
mov dword [0xe8cb3c], ebx
pop esi
pop ebx
pop ecx
ret
Function at 0x100412a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push 0x20
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10041300
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 8], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x100412e6
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [esi + 4], 0
mov ecx, dword [esi + 8]
push ecx
call fcn.100c05e0
add esp, 4
mov dword [esi + 4], eax
test eax, eax
jne 0x10041307
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
push 0
lea edx, [ebp - 4]
push edx
push ecx
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
test eax, eax
je 0x100412fa
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10041340
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
call fcn.100412a0
test al, al
jne 0x1004134e
pop esi
ret
push edi
mov edi, dword [esi + 8]
cmp edi, 8
jae 0x1004135c
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi + 4]
mov eax, 0x100c8d30
mov ecx, 8
sub edx, eax
push ebx
lea esp, [esp]
mov ebx, dword [edx + eax]
cmp ebx, dword [eax]
jne 0x100413de
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10041370
add edi, 0xfffffff8
xor eax, eax
test edi, edi
jle 0x100413d3
jmp 0x10041390
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0x1f
movsx edx, byte [edx + str.rYBgUrg6VfxS65YQFfrAPQMAYiuiNdv]
and edx, 0xf
movzx edx, byte [edx + 0x100c8d38]
sub byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 4]
mov edx, eax
and edx, 0xf
movzx edx, byte [edx + 0x100c8d38]
xor byte [ecx + eax + 8], dl
lea ecx, [ecx + eax + 8]
mov ecx, dword [esi + 8]
inc eax
sub ecx, 8
cmp eax, ecx
jl 0x10041390
mov edi, esi
call fcn.100413f0
pop ebx
pop edi
pop esi
ret
pop ebx
pop edi
xor al, al
pop esi
ret

Function at 0x100413f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [edi + 0xc]
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x3e8
idiv ecx
push edx
push str.DataObject57Object_d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0x102
push 2
push 0
push 7
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10041463
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push 0
lea edx, [ebp - 4]
push edx
sub eax, 8
push eax
add ecx, 8
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x1004146a
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10041480
Capabilities:
Delete file

Disassembly:
push edi
lea edi, [esi + 0xc]
mov ecx, 0x100c594e
mov eax, edi
jmp 0x10041490
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100414b0
test dl, dl
je 0x100414ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100414b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10041490
xor eax, eax
jmp 0x100414b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100414ec
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x100414ec
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
push 0x100
push 0
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.MSVCR100.dll_memset
add esp, 0x10
pop edi
ret
Function at 0x10041b80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jc]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10041ba0
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x103abea0], ecx
mov dword [ebp - 4], 0
jbe 0x10041c98
mov edi, dword [0x1027c3b8]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10041c4b
mov eax, dword [0x1027c3b4]
cmp eax, ebx
ja 0x10041c4b
mov ecx, ebx
sub ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1027c3bc]
jne 0x10041c3a
mov ecx, 0x1027c3b4
call fcn.10042760
mov edi, dword [0x1027c3b8]
mov eax, dword [0x1027c3b4]
lea edx, [esi + esi*8]
lea esi, [eax + edx*8]
test edi, edi
je 0x10041c76
jmp 0x10041c69
cmp edi, dword [0x1027c3bc]
jne 0x10041c63
mov ecx, 0x1027c3b4
call fcn.10042760
mov edi, dword [0x1027c3b8]
test edi, edi
je 0x10041c79
mov esi, ebx
mov ecx, 0x12
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1027c3b8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x48
mov dword [0x1027c3b8], edi
movzx ecx, byte [esi + 8]
inc eax
add ebx, 0x48
mov dword [ebp - 4], eax
cmp eax, ecx
jl 0x10041c00
pop edi
pop esi
mov dword [0x103abe90], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041cb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + 0x100c7730]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10041cd0
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x103abea4], ecx
mov dword [ebp - 4], 0
jbe 0x10041dcf
mov edi, dword [0x1027c3c8]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10041d7c
mov eax, dword [0x1027c3c4]
cmp eax, ebx
ja 0x10041d7c
mov ecx, ebx
sub ecx, eax
mov eax, 0x3e0f83e1
imul ecx
sar edx, 6
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1027c3cc]
jne 0x10041d6a
mov ecx, 0x1027c3c4
call fcn.100427d0
mov edi, dword [0x1027c3c8]
imul esi, esi, 0x108
add esi, dword [0x1027c3c4]
test edi, edi
je 0x10041da7
jmp 0x10041d9a
cmp edi, dword [0x1027c3cc]
jne 0x10041d94
mov ecx, 0x1027c3c4
call fcn.100427d0
mov edi, dword [0x1027c3c8]
test edi, edi
je 0x10041daa
mov esi, ebx
mov ecx, 0x42
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0x1027c3c8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x108
mov dword [0x1027c3c8], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x108
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10041d30
pop edi
pop esi
mov dword [0x103abe94], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041de0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_j_]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10041e00
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x103abea8], ecx
mov dword [ebp - 4], 0
jbe 0x10041f00
mov edi, dword [0x1027c3d8]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10041eac
mov eax, dword [0x1027c3d4]
cmp eax, ebx
ja 0x10041eac
mov ecx, ebx
sub ecx, eax
mov eax, 0x7d8c42b3
imul ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1027c3dc]
jne 0x10041e9a
mov ecx, 0x1027c3d4
call fcn.10042840
mov edi, dword [0x1027c3d8]
imul esi, esi, 0x105
add esi, dword [0x1027c3d4]
test edi, edi
je 0x10041ed8
jmp 0x10041eca
cmp edi, dword [0x1027c3dc]
jne 0x10041ec4
mov ecx, 0x1027c3d4
call fcn.10042840
mov edi, dword [0x1027c3d8]
test edi, edi
je 0x10041edb
mov esi, ebx
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x1027c3d8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x105
mov dword [0x1027c3d8], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x105
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10041e60
pop edi
pop esi
mov dword [0x103abe98], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041f20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
nop
mov cl, byte [eax + str.r_jv]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10041f40
mov esi, dword [ebp + 8]
movzx edx, word [esi + 6]
movzx eax, byte [esi + 8]
push edx
push eax
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
movzx ecx, word [esi + 6]
add esp, 0x10
cmp byte [esi + 8], 0
mov dword [0x103abeac], ecx
mov dword [ebp - 4], 0
jbe 0x1004203d
mov edi, dword [0x1027c3e8]
lea ebx, [esi + 0xa]
nop
cmp ebx, edi
jae 0x10041fef
mov eax, dword [0x1027c3e4]
cmp eax, ebx
ja 0x10041fef
mov ecx, ebx
sub ecx, eax
mov eax, 0x7e07e07f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp edi, dword [0x1027c3ec]
jne 0x10041fda
mov ecx, 0x1027c3e4
call fcn.100428b0
mov edi, dword [0x1027c3e8]
mov eax, esi
shl eax, 6
add eax, dword [0x1027c3e4]
add eax, esi
test edi, edi
je 0x1004201b
mov esi, eax
jmp 0x1004200d
cmp edi, dword [0x1027c3ec]
jne 0x10042007
mov ecx, 0x1027c3e4
call fcn.100428b0
mov edi, dword [0x1027c3e8]
test edi, edi
je 0x1004201e
mov esi, ebx
mov ecx, 0x10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [0x1027c3e8]
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
add edi, 0x41
mov dword [0x1027c3e8], edi
movzx edx, byte [esi + 8]
inc eax
add ebx, 0x41
mov dword [ebp - 4], eax
cmp eax, edx
jl 0x10041fa0
pop edi
pop esi
mov dword [0x103abe9c], 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10042050
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x103e4c78
mov esi, eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + str.r_jj]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10042070
movzx edx, byte [esi + 4]
push edx
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
movzx eax, byte [esi + 4]
add esp, 0xc
cmp eax, 0xa
ja case.default.0x100420ac
jmp dword [eax*4 + 0x1004211c]
mov ecx, 0xe
jmp 0x100420fe
mov ecx, 0xf
jmp 0x100420fe
mov ecx, 0x10
jmp 0x100420fe
mov ecx, 0x11
jmp 0x100420fe
mov ecx, 0x12
jmp 0x100420fe
mov ecx, 0x13
jmp 0x100420fe
mov ecx, 0x14
jmp 0x100420fe
mov ecx, 0x16
jmp 0x100420fe
mov ecx, 0x18
jmp 0x100420fe
mov ecx, 0x19
jmp 0x100420fe
mov ecx, 0x15
push 0x1388
call fcn.10090f50
push eax
push 2
mov esi, 0x10367948
call fcn.100b6b50
add esp, 0xc
pop esi
ret
Function at 0x10042150
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
cmp dword [0x103abec4], 1
push edi
je 0x100421ea
mov ecx, dword [0x1027c3b4]
mov dword [0x103abe8c], ebx
mov dword [0x103abe90], ebx
mov dword [0x103abe94], ebx
mov dword [0x103abe98], ebx
mov dword [0x103abe9c], ebx
mov dword [0x103abea0], ebx
mov dword [0x103abea4], ebx
mov dword [0x103abea8], ebx
mov dword [0x103abeac], ebx
cmp ecx, dword [0x1027c3b8]
je 0x100421b8
mov dword [0x1027c3b8], ecx
mov ecx, dword [0x1027c3c4]
cmp ecx, dword [0x1027c3c8]
je 0x100421cc
mov dword [0x1027c3c8], ecx
push 0x1027c3d4
call fcn.10042710
mov ecx, dword [0x1027c3e4]
cmp ecx, dword [0x1027c3e8]
je 0x100421ea
mov dword [0x1027c3e8], ecx
mov dword [0x103676ac], ebx
mov dword [0x103676b4], ebx
mov word [ebp - 0x40], 0x3cc1
call dword [sym.imp.MSVCR100.dll_rand]
and eax, 0x800000ff
jns 0x10042210
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x103676a0]
mov edx, dword [str.PREMIUM]
mov byte [ebp - 0x3e], al
mov eax, dword [0x103abec4]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100ca7a4]
mov byte [ebp - 0x3d], bl
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
call fcn.100b6d00
push 0x100
mov esi, eax
push ebx
mov ecx, 9
lea edi, [ebp - 0x2c]
push 0x103e4c78
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x100c7a30]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x10042260
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x34]
push eax
push ecx
push edx
push 0x103e4c78
push ebx
mov ecx, 0x1027c400
call fcn.10090540
add esp, 0x18
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x100ca7a8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
movzx ecx, byte [ebp - 0x3f]
lea edx, [ebp - 0x40]
call fcn.10012360
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x10068690
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x103a0310], 1
jne 0x1006870e
cmp dword [0xe61e58], 0x550
jl 0x1006870e
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x1006870e
mov eax, dword [0x879340c]
cmp eax, 0x1b8
jle 0x1006870e
cmp eax, 0x1e4
jge 0x1006870e
mov eax, dword [0x8793410]
cmp eax, 0x10c
jle 0x1006870e
cmp eax, 0x11d
jge 0x1006870e
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x100
push 0
test cx, ax
je 0x10068702
push 0
push 0
push 0x1b
call dword [sym.imp.USER32.dll_keybd_event]
ret
push 2
push 0
push 0x1b
call dword [sym.imp.USER32.dll_keybd_event]
ret
Function at 0x10071520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a25c0]
cmp byte [0x103a23cd], 0
mov edx, eax
je 0x1007160d
mov eax, 0x4f
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x1007160d
cmp dword [ebp + 8], 0x201
jne 0x10071579
mov byte [0x103a25c4], 1
mov dword [0xe8cb3c], 1
mov al, 1
pop esi
pop ebp
ret 4
mov byte [0x103a25c4], 0
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x1007160d
call esi
cmp dword [0x103a0314], 0
mov dword [0x103a25c0], eax
push 1
je 0x100715dc
mov esi, 0x59af55
mov dword [0x103a0314], 0
call fcn.100b6670
push 1
mov esi, 0x59b24a
call fcn.100b6670
push 1
push str.Attack_PVP_Desativado
mov eax, 0x597630
call eax
add esp, 0x10
xor al, al
pop esi
pop ebp
ret 4
push str.Attack_PVP_Ativado
mov ecx, 0x597630
mov dword [0x103a0314], 1
call ecx
push 0
mov esi, 0x59af55
call fcn.100b6670
push 0
mov esi, 0x59b24a
call fcn.100b6670
add esp, 0x10
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10071620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2698]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a23cd], bl
je 0x100716f9
lea eax, [ebx + 0x52]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100716f9
cmp dword [ebp + 8], 0x201
jne 0x10071676
mov eax, 1
pop esi
mov byte [0x103a269c], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a269c], bl
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x100716f9
call esi
mov dword [0x103a2698], eax
cmp dword [0x103a0f4c], ebx
je 0x100716db
mov dword [0x103a0f4c], ebx
push 0x100bafc0
push 0x60b36a
mov bl, 0xe9
call fcn.100b6700
mov esi, 0xa
mov ebx, 0x60b36a
call fcn.100b6570
push 0x100bafe0
push ebx
mov bl, 0xe9
call fcn.100b6700
add esp, 0x10
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push 0x100bae70
push 0x60b36a
mov bl, 0xe9
call fcn.100b6700
add esp, 8
mov dword [0x103a0f4c], 1
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x10071710
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103a2578]
xor ebx, ebx
mov edx, eax
cmp byte [0x103a23cd], bl
je 0x100717cd
lea eax, [ebx + 0x4e]
mov ecx, 0x103a0f48
call fcn.1006fd20
test al, al
je 0x100717cd
cmp dword [ebp + 8], 0x201
jne 0x10071766
mov eax, 1
pop esi
mov byte [0x103a257c], al
mov dword [0xe8cb3c], eax
pop ebx
pop ebp
ret 4
mov byte [0x103a257c], bl
mov dword [0xe8cb3c], 1
cmp edx, 0x1f4
jb 0x100717cd
call esi
mov dword [0x103a2578], eax
cmp dword [0x103a0f50], ebx
je 0x100717af
mov dword [0x103a0f50], ebx
push 0x1009bea0
push 0x57d278
mov bl, 0xe9
call fcn.100b6700
add esp, 8
pop esi
xor al, al
pop ebx
pop ebp
ret 4
push 0x1009be90
push 0x57d278
mov bl, 0xe9
call fcn.100b6700
mov dword [0x103a0f50], 1
add esp, 8
pop esi
xor al, al
pop ebx
pop ebp
ret 4