joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e740
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10043a9c], 0
push esi
jne 0x1001e929
call fcn.1001d380
call fcn.1001dbe0
call fcn.1001dc80
mov dword [0x10043a9c], 1
call fcn.1001d230
mov dword [0x10043a98], eax
lea eax, [ebp - 0x204]
push eax
push ecx
mov dword [ebp - 0x204], 0
call fcn.1001e540
add esp, 8
cmp eax, 1
je 0x1001e856
push 0x10043878
push 0x100330c0
lea eax, [ebp - 0x200]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
call fcn.1001e480
lea ecx, [ebp - 0x200]
call fcn.1001e640
lea eax, [ebp - 0x204]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e835
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x200]
push eax
push 1
push 0
push 0x100331c0
push dword [ebp - 0x204]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x204]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x200]
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e840
sub ecx, edx
lea eax, [ebp - 0x200]
push ecx
push eax
jmp 0x1001e91b
mov esi, dword [ebp - 0x204]
mov ecx, esi
call fcn.1001e6c0
push 0xa
push esi
push 0x100330c0
call dword [sym.imp.MSVCR120.dll_strncmp]
add esp, 0xc
test eax, eax
je 0x1001e903
push 0x10043878
push 0x100330c0
lea eax, [ebp - 0x200]
push 0x100331e4
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
call fcn.1001e480
lea ecx, [ebp - 0x200]
call fcn.1001e640
lea eax, [ebp - 0x204]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftUsers_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e8e7
lea eax, [ebp - 0x204]
mov ecx, 0x100330d0
push eax
lea edx, [ebp - 0x200]
call fcn.1001e4f0
add esp, 4
lea ecx, [ebp - 0x200]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e8f0
sub ecx, edx
lea eax, [ebp - 0x200]
push ecx
push eax
jmp 0x1001e91b
mov ecx, esi
call fcn.1001e640
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e910
sub ecx, edx
push ecx
push esi
push 0x10043878
call dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x1001f320
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x1001f355
movdqu xmm0, xmmword [0x10033578]
mov eax, dword [0x10033590]
lea edx, [ebp - 0x50]
mov dword [ebp - 0x38], eax
mov ecx, str.Conquer.exe
mov eax, dword [0x10033558]
movdqu xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
movq xmm0, qword [0x10033588]
movq qword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [str.x____x____xxxxxxxxxxxxxxxxx]
push eax
movdqu xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x10033550]
movq qword [ebp - 0x20], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x10043aa8], eax
mov dword [0x10043aa4], eax
call fcn.10025b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026000
push fcn.1001e940
push 0x10043aa8
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x1001f3e8
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x1001f3fa
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1001f6b0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16a4
call fcn.10027c20
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [ebp - 0x1684]
push eax
push 0x1000
lea eax, [ebp - 0x1680]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1001f80f
xor esi, esi
test dword [ebp - 0x1684], 0xfffffffc
jbe 0x1001f80f
mov ebx, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
lea esp, [esp]
push 0x104
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp + esi*4 - 0x1680]
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x1001f7fd
lea eax, [ebp - 0x2f8]
lea edx, [eax + 2]
jmp 0x1001f740
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1001f740
sub eax, edx
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR120.dll_wcstombs]
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.10019fc0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xf0]
push eax
sub esp, 0x18
mov ecx, esp
push 8
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push 0x1003380c
mov byte [ecx], 0
call fcn.100039d0
lea ecx, [ebp - 0x16a0]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x1001f7b9
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x680]
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0x10
cmp dword [ebp - 0x168c], 0x10
jb 0x1001f7de
push dword [ebp - 0x16a0]
call ebx
add esp, 4
lea eax, [ebp - 0x680]
mov edx, 6
push eax
call fcn.10007c80
add esp, 4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x1684]
inc esi
shr eax, 2
cmp esi, eax
jb 0x1001f710
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10021110
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12fc
call fcn.10027c20
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1003d174]
push ebx
mov ebx, dword [0x1005d500]
push esi
push edi
test eax, eax
je 0x10021246
xor edi, edi
test ebx, ebx
jle 0x10021172
mov esi, 0x1005d508
test eax, eax
je 0x10021172
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.10019fc0
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1001f4b0
inc edi
add esi, 0xc8
cmp edi, ebx
jge 0x10021172
mov eax, dword [0x1003d174]
jmp 0x10021148
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp dword [0x1003d174], 0
mov edi, eax
je 0x10021235
lea eax, [ebp - 0x12fc]
push eax
push 0x1000
lea eax, [ebp - 0x12f8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x10021235
xor esi, esi
test dword [ebp - 0x12fc], 0xfffffffc
jbe 0x10021235
mov ebx, dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
lea ecx, [ecx]
push 0x104
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp + esi*4 - 0x12f8]
push edi
call ebx
test eax, eax
je 0x10021227
lea eax, [ebp - 0x2f8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100211e3
sub eax, edx
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.MSVCR120.dll_wcstombs]
add esp, 0xc
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.10019fc0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.1001f4b0
mov eax, dword [ebp - 0x12fc]
inc esi
shr eax, 2
cmp esi, eax
jb 0x100211c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1003d174], 0
cmp dword [0x1003d170], 0
je 0x1002125e
call fcn.1001f830
mov dword [0x1003d170], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret

Function at 0x10021ec0
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10021ef5
movdqu xmm0, xmmword [0x10033984]
lea eax, [ebp - 0x20]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x30], xmm0
lea edx, [ebp - 0x30]
movdqu xmm0, xmmword [str.xxxxxxxxx____xx]
movdqu xmmword [ebp - 0x20], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x10075bb4], eax
mov dword [0x10075bac], eax
call fcn.10025b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026000
push 0x10021c00
push 0x10075bb4
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x10021f5e
push 0
call dword [sym.imp.MSVCR120.dll_exit]
movdqu xmm0, xmmword [0x100339f0]
lea eax, [ebp - 0x30]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x20], xmm0
lea edx, [ebp - 0x20]
movdqu xmm0, xmmword [str.x____xxxxxxxxxx]
movdqu xmmword [ebp - 0x30], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x10075ba8], eax
jmp 0x10021fa3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100220a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x10033cd8]
movzx eax, word [0x10033ce8]
lea edx, [ebp - 0x50]
mov word [ebp - 0x40], ax
mov ecx, str.Conquer.exe
movzx eax, word [0x10033cd4]
movdqu xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
movdqu xmm0, xmmword [str.xx____xx____x____]
push edi
push eax
movdqu xmmword [ebp - 0x30], xmm0
call fcn.1000f670
add esp, 4
mov dword [ebp - 0x58], eax
lea ecx, [ebp - 0x54]
mov dword [0x10075bbc], eax
mov edi, 0x10022170
mov dword [0x10075bc0], eax
sub edi, eax
mov dword [ebp - 0x54], 0
push ecx
push 0x40
push 0xc
push eax
sub edi, 5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x58]
mov ecx, 0x90909090
mov byte [eax], 0xe8
mov dword [eax + 1], edi
mov dword [eax + 5], ecx
mov word [eax + 9], cx
mov byte [eax + 0xb], cl
lea ecx, [ebp - 0x54]
push ecx
push dword [ebp - 0x54]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10022480
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x100224b5
movdqu xmm0, xmmword [0x10033e80]
lea eax, [ebp - 0x20]
mov ecx, str.Conquer.exe
push eax
movdqu xmmword [ebp - 0x30], xmm0
lea edx, [ebp - 0x30]
movdqu xmm0, xmmword [str.xxxx____x____xx]
movdqu xmmword [ebp - 0x20], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x10075bc8], eax
cmp dword [0x10075bc4], 0
mov dword [0x10075bcc], eax
je 0x10022527
call fcn.10025b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026000
push 0x10022440
push 0x10075bc8
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x10022527
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x10022539
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10022750
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str._snprintf
push str.MSVCRT.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [0x10075bd4]
mov edi, eax
mov ecx, edi
call fcn.1000f290
mov dword [0x10075bd4], eax
lea ecx, [eax + 5]
push ecx
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, dword [0x10075bd4]
add esp, 4
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x10075bd4]
push edi
push esi
call sub.MSVCR120.dll_memcpy
mov eax, dword [0x10075bd4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [eax + esi], 0xe9
mov eax, dword [0x10075bd4]
mov dword [eax + esi + 1], ecx
mov eax, 0x10022570
mov ecx, dword [ebp - 4]
sub eax, edi
sub eax, 5
mov byte [ebp - 0xc], 0xe9
mov dword [ebp - 0xb], eax
xor ecx, ebp
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [0x10075bd0], esi
pop esi
call fcn.1002711f
mov esp, ebp
pop ebp
ret

Function at 0x10022810
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov dword [ecx + 0x1384], 0xffffffff
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov esi, 1
lea ecx, [ecx]
mov eax, edx
lea edi, [edi + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi - 4], edx
cmp esi, 0x270
jl 0x10022830
pop edi
mov dword [ecx], 0x270
mov eax, ecx
pop esi
pop ebp
ret 0xc
Function at 0x10022860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
dec ecx
nop
xor eax, eax
xor esi, esi
mov dword [ebp - 4], eax
test ecx, ecx
je 0x1002294c
nop
mov ecx, dword [ebx + 4]
dec ecx
shl esi, cl
add esi, esi
mov dword [ebp - 8], esi
jmp 0x10022890
mov edi, dword [ebx]
mov eax, dword [edi]
cmp eax, 0x270
jne 0x100228dc
lea eax, [edi + 8]
mov esi, 0x270
mov edx, dword [eax - 4]
lea eax, [eax + 4]
xor edx, dword [eax - 4]
and edx, 0x7fffffff
xor edx, dword [eax - 8]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [eax + 0x62c]
xor ecx, edx
mov dword [eax + 0x9b8], ecx
dec esi
jne 0x100228a3
jmp 0x100228ea
cmp eax, 0x4e0
jb 0x100228ea
mov ecx, edi
call fcn.10022980
mov eax, dword [edi]
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, dword [ebx + 8]
ja 0x10022890
mov esi, dword [ebp - 8]
mov ecx, dword [ebx + 4]
or esi, eax
mov eax, dword [ebp - 4]
dec ecx
shl eax, cl
mov ecx, dword [ebp + 8]
add eax, eax
or eax, dword [ebx + 8]
dec ecx
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x10022880
xor edx, edx
div dword [ebp + 8]
mov ecx, eax
mov edi, edx
xor edx, edx
mov eax, esi
div dword [ebp + 8]
cmp eax, ecx
jb 0x1002296c
mov ecx, dword [ebp + 8]
dec ecx
cmp edi, ecx
jne 0x10022870
mov eax, esi
xor edx, edx
div dword [ebp + 8]
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10022980
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, ecx
mov ecx, 0xe3
push esi
push edi
lea edi, [ebx + 0x9c4]
mov edx, dword [edi + 4]
lea edi, [edi + 4]
xor edx, dword [edi - 4]
and edx, 0x7fffffff
xor edx, dword [edi - 4]
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, edx
mov dword [edi - 0x9c4], eax
dec ecx
jne 0x10022990
lea esi, [ebx + 0xd50]
mov edi, 0x18c
mov ecx, dword [esi]
lea esi, [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi - 4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi - 0xd50]
xor eax, ecx
mov dword [esi - 0x9c4], eax
dec edi
jne 0x100229d0
mov ecx, dword [ebx + 0x1380]
xor ecx, dword [ebx + 4]
and ecx, 0x7fffffff
xor ecx, dword [ebx + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx + 0x9c0], eax
mov dword [ebx], edi
pop edi
pop esi
pop ebx
ret
Function at 0x10023760
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.10027c20
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x1214]
push eax
push 0x1000
lea eax, [ebp - 0x1210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1002381f
xor esi, esi
test dword [ebp - 0x1214], 0xfffffffc
jbe 0x1002381f
mov edi, dword [sym.imp.MSVCR120.dll_wcsstr]
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [ebp + esi*4 - 0x1210]
push ebx
call dword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x10023811
lea eax, [ebp - 0x210]
push str.speed
push eax
call edi
add esp, 8
test eax, eax
jne 0x10023837
lea eax, [ebp - 0x210]
push str.seworker
push eax
call edi
add esp, 8
test eax, eax
jne 0x10023837
lea eax, [ebp - 0x210]
push str.i386
push eax
call edi
add esp, 8
test eax, eax
jne 0x10023837
mov eax, dword [ebp - 0x1214]
inc esi
shr eax, 2
cmp esi, eax
jb 0x100237b4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
ret
jmp 0x10023849
cmp dword [0x1003f558], 0
je 0x100238ab
sub esp, 0x18
mov ecx, esp
push 0x1c
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push str.wXEy420S7H47Hx30Wky530f43o8
mov byte [ecx], 0
call fcn.100039d0
lea ecx, [ebp - 0x1230]
call fcn.10019e50
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x1002388a
mov eax, dword [eax]
push eax
call fcn.100230a0
add esp, 4
cmp dword [ebp - 0x121c], 0x10
jb 0x100238ab
push dword [ebp - 0x1230]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
jmp 0x100238bd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002711f
mov esp, ebp
pop ebp
ret
Function at 0x10023fe0
Capabilities:
Create thread
Hide thread from debugger
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push 0x10075f7c
push 0
push 0x1003d178
push 0x10023710
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.NtSetInformationThread
push 0x10034234
mov dword [ebp - 4], eax
mov dword [0x10075f6c], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
test eax, eax
je 0x10024036
push 0
push 0
push 0x11
push dword [ebp - 4]
call eax
push 0x10075f68
push 0
push 0x1003d178
push 0x10023510
push 0
push 0
call esi
push str.NtSetInformationThread
push 0x10034234
mov dword [ebp - 4], eax
mov dword [0x10075f70], eax
call edi
push eax
call ebx
test eax, eax
je 0x10024073
push 0
push 0
push 0x11
push dword [ebp - 4]
call eax
push 0x10075f78
push 0
push 0x1003d178
push 0x100233a0
push 0
push 0
call esi
push str.NtSetInformationThread
push 0x10034234
mov dword [ebp - 4], eax
mov dword [0x10075f88], eax
call edi
push eax
call ebx
test eax, eax
je 0x100240b0
push 0
push 0
push 0x11
push dword [ebp - 4]
call eax
push 0x10075f64
push 0
push 0x1003d178
push 0x10023610
push 0
push 0
call esi
push str.NtSetInformationThread
push 0x10034234
mov dword [ebp - 4], eax
mov dword [0x10075f80], eax
call edi
push eax
call ebx
test eax, eax
je 0x100240ed
push 0
push 0
push 0x11
push dword [ebp - 4]
call eax
push 0x10075bd8
push 0
push 0x1003d178
push 0x10006040
push 0
push 0
call esi
push str.NtSetInformationThread
push 0x10034234
mov dword [ebp - 4], eax
mov dword [0x10075bdc], eax
call edi
push eax
call ebx
test eax, eax
je 0x1002412a
push 0
push 0
push 0x11
push dword [ebp - 4]
call eax
push 0
push 0
push 0
push 0x10022bf0
push 0
push 0
call esi
push str.NtSetInformationThread
push 0x10034234
mov esi, eax
call edi
push eax
call ebx
test eax, eax
je 0x10024159
push 0
push 0
push 0x11
push esi
call eax
call fcn.10005c10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024260
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1003d01c]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10024295
movdqu xmm0, xmmword [0x1003441c]
movzx eax, word [0x10034434]
lea edx, [ebp - 0x50]
mov word [ebp - 0x38], ax
mov ecx, str.Conquer.exe
movzx eax, byte [0x10034436]
movdqu xmmword [ebp - 0x50], xmm0
mov byte [ebp - 0x36], al
movq xmm0, qword [0x1003442c]
movzx eax, word [0x10034418]
movq qword [ebp - 0x40], xmm0
movdqu xmm0, xmmword [str.x____x____xx____xxxxxxxxxx]
mov word [ebp - 0x18], ax
movzx eax, byte [0x1003441a]
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x30]
movdqu xmmword [ebp - 0x30], xmm0
push eax
movq xmm0, qword [0x10034410]
movq qword [ebp - 0x20], xmm0
call fcn.1000f670
add esp, 4
mov dword [0x1007635c], eax
mov dword [0x10076358], eax
call fcn.10025b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10026000
push 0x10024170
push 0x1007635c
call fcn.100255c0
call fcn.10025b90
test eax, eax
je 0x10024342
push 0
call dword [sym.imp.MSVCR120.dll_exit]
jmp 0x10024354
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002711f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x10024470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10024620
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1002453d
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x100244ba
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003d004]
ja 0x100244ba
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1002448a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100244e0
jmp 0x1002453d
cmp dword [ebp - 0x14], 0x10000
jne 0x10024523
cmp dword [ebp - 0x18], 0x10000
jb 0x10024523
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10024516
mov eax, dword [ebp - 8]
jmp 0x1002453f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10024538
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10024620
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1002448a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10024550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10024650
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10024615
mov edx, dword [ebp - 4]
cmp edx, dword [section..data]
jb 0x10024595
mov eax, dword [ebp - 4]
cmp eax, dword [0x1003d004]
ja 0x10024595
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10024565
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.MSVCR120.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100245bb
jmp 0x10024615
cmp dword [ebp - 0x14], 0x10000
jne 0x100245fe
cmp dword [ebp - 0x18], 0x10000
jb 0x100245fe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100245f1
mov eax, dword [ebp - 8]
jmp 0x10024617
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10024610
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10024650
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10024565
xor eax, eax
mov esp, ebp
pop ebp
ret