joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a6e0
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1004a4b0
add esp, 4
cmp dword [esi], 0
je 0x1004a74f
push edi
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1004a74e
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004a746
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push ebp
push dword [esp + 0x1c]
push ebx
call fcn.1004ae80
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1004a715
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x1004afc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
xor ebp, ebp
call fcn.1004a450
cmp dword [0x10ea33e4], ebp
je 0x1004b05e
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x1004b01d
xor esi, esi
cmp dword [0x10ea4d58], esi
jbe 0x1004b063
push ebx
mov bl, byte [esp + 0x14]
push edi
shl bl, 2
xor edi, edi
mov edx, dword [0x10ea4d50]
lea edi, [edi + 0x2c]
inc esi
mov cl, byte [edx + edi - 0x18]
xor cl, bl
and cl, 4
xor byte [edx + edi - 0x18], cl
cmp esi, dword [0x10ea4d58]
jb 0x1004aff2
pop edi
pop ebx
call fcn.1004a770
pop esi
mov eax, ebp
pop ebp
ret
push eax
call fcn.1004a5f0
add esp, 4
cmp eax, 0xffffffff
je 0x1004b04f
mov cl, byte [esp + 0x10]
imul edx, eax, 0x2c
mov eax, dword [0x10ea4d50]
shl cl, 2
xor cl, byte [edx + eax + 0x14]
and cl, 4
xor byte [edx + eax + 0x14], cl
call fcn.1004a770
pop esi
mov eax, ebp
pop ebp
ret
mov ebp, 4
call fcn.1004a770
pop esi
mov eax, ebp
pop ebp
ret
mov ebp, 2
call fcn.1004a770
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x1004b0a0
Capabilities:
Resume thread

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
je 0x1004b0f8
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x1004b0e7
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ResumeThread]
nop word [eax + eax]
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1004b0df
push ebx
call ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x1004b0c0
pop ebp
pop ebx
push dword [edi]
push 0
push dword [0x10ea33e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop edi
ret

Function at 0x1004b1c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10ea4d40]
test eax, eax
je 0x1004b1dc
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x1004b22f
mov eax, dword [eax]
test eax, eax
jne 0x1004b1d0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1004b22d
push esi
push edi
xor edi, edi
mov dword [edx + 8], 0
lea ecx, [edx + 0x20]
lea esi, [edi + 0x20]
mov dword [ecx], edi
mov eax, ecx
mov dword [edx + 4], ecx
add esi, 0x20
add ecx, 0x20
mov edi, eax
cmp esi, 0xfe0
jbe 0x1004b207
mov eax, dword [0x10ea4d40]
pop edi
mov dword [edx], eax
pop esi
mov dword [0x10ea4d40], edx
mov eax, edx
ret
Function at 0x1004b6b0
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 4]
push esi
mov cl, byte [edx]
test cl, cl
je 0x1004b6c5
cmp cl, 0x90
je 0x1004b6c5
cmp cl, 0xcc
jne 0x1004b6e3
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jbe 0x1004b6dc
cmp byte [eax + edx], cl
jne 0x1004b6e3
inc eax
cmp eax, esi
jb 0x1004b6d2
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100923b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100923f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100923f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100923f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100923f7
cmp dword [ecx + 0x74], 0xe
jbe 0x100923f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x100a21fc
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x100e2fc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x100a2247
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.100a26fd
test al, al
jne 0x100a2241
sub edx, 2
cmp edx, edi
jne 0x100a2227
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x100a2269
lea eax, [edi + 2]
cmp edx, eax
je 0x100a2269
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.100a1df5
add esp, 0x10
jmp 0x100a2363
push esi
lea ecx, [ebp - 0x255]
call fcn.100a26fd
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a22ac
push dword [ebp - 0x25c]
jmp 0x100a2259
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x100a22e9
cmp word [ebp - 0x226], 0
je 0x100a230a
cmp word [ebp - 0x226], ax
jne 0x100a22e9
cmp word [ebp - 0x224], 0
je 0x100a230a
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.100a1df5
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x100a2356
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x100a22c3
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x100a233e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x100a2363
push 0x100a16db
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.10005038
add esp, 0x10
jmp 0x100a2333
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10002dc9
leave
ret

Function at 0x100a8795
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10003f76
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100a8804
cmp esi, dword [ebp - 4]
je 0x100a87ff
cmp dword [ebp + 0xc], 0
je 0x100a87ff
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100a87dc
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.100a81bd
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x100a8806
xor eax, eax
inc eax
jmp 0x100a8806
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100b2e64
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10ea41a8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b2ea4
cmp byte [ebx], 0xa
jne 0x100b2ea4
or byte [edi + eax + 0x28], 4
jmp 0x100b2ea9
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x100b2fa8
mov dl, byte [eax]
cmp dl, 0x1a
je 0x100b2f8b
inc eax
cmp dl, 0xd
je 0x100b2ed5
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100b2efb
cmp eax, ecx
jae 0x100b2f09
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x100b2ebd
jmp 0x100b2fa8
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b2f86
cmp dword [ebp - 0x10], 0
je 0x100b2f86
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10ea41a8]
test byte [eax + edi + 0x28], 0x48
je 0x100b2f60
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100b2f4b
mov byte [esi], dl
jmp 0x100b2f5c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10ea41a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100b2fa8
cmp byte [ebp - 1], 0xa
jne 0x100b2f6f
cmp esi, ebx
jne 0x100b2f6f
mov byte [esi], 0xa
jmp 0x100b2fa7
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10001884
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100b2fa8
mov byte [esi], 0xd
jmp 0x100b2fa7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10ea41a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100b2fa5
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100b2fa8
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100b3004
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10ea41a8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100b304a
cmp word [ebx], dx
jne 0x100b304a
or byte [eax + edi + 0x28], 4
jmp 0x100b304f
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x100b31b2
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100b3192
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100b3090
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100b30c6
cmp eax, edx
jae 0x100b30d4
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100b306b
jmp 0x100b31b2
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100b318d
cmp dword [ebp - 0x18], 0
je 0x100b318d
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10ea41a8]
test byte [eax + edi + 0x28], 0x48
je 0x100b3163
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100b3127
mov word [esi], cx
jmp 0x100b315e
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10ea41a8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10ea41a8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10ea41a8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x100b31b2
pop eax
cmp word [ebp - 4], ax
jne 0x100b3173
cmp esi, ebx
jne 0x100b3173
mov word [esi], ax
jmp 0x100b31af
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10001884
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x100b31b2
push 0xd
pop eax
jmp 0x100b316e
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10ea41a8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x100b31ac
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x100b31b2
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x407b70
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x410128
call fcn.00407b7c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x412c08
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x407914
cmp eax, esi
jne 0x407907
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x407917
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4078ee
xor esi, esi
inc esi
mov eax, dword [0x412c04]
cmp eax, esi
jne 0x40792a
push 0x1f
call sub.MSVCR90.dll__amsg_exit
pop ecx
jmp 0x407959
mov eax, dword [0x412c04]
test eax, eax
jne 0x407953
mov dword [0x412c04], esi
push 0x40d2ec
push 0x40d2e0
call sub.MSVCR90.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x407959
jmp 0x407a7d
mov dword [0x4123fc], esi
mov eax, dword [0x412c04]
cmp eax, esi
jne 0x40797d
push 0x40d2dc
push 0x40d2c8
call sub.MSVCR90.dll__initterm
pop ecx
pop ecx
mov dword [0x412c04], 2
cmp dword [ebp - 0x20], ebx
jne 0x40798a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x412c0c], ebx
je 0x4079ab
push 0x412c0c
call fcn.00407e50
pop ecx
test eax, eax
je 0x4079ab
push ebx
push 2
push ebx
call dword [0x412c0c]
mov eax, dword [sym.imp.MSVCR90.dll__wcmdln]
cmp dword [eax], ebx
je 0x407a7d
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x407a15
cmp cx, bx
je 0x4079d0
cmp dword [ebp - 0x1c], ebx
jne 0x407a15
movzx ecx, word [eax]
cmp cx, bx
je 0x4079e5
cmp cx, 0x20
ja 0x4079e5
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x4079d0
test byte [ebp - 0x40], 1
je 0x4079f1
movzx ecx, word [ebp - 0x3c]
jmp 0x4079f4
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x4123f8], eax
cmp dword [0x4123ec], ebx
jne 0x407a5a
push eax
call dword [sym.imp.MSVCR90.dll_exit]
cmp cx, 0x22
jne 0x407a26
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x4079ba
cmp dword [0x4123fc], ebx
jne 0x407a68
call dword [sym.imp.MSVCR90.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x4123f8]
jmp 0x407a89
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00407bc1
ret
call fcn.00582000
jmp 0x4078b1
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
dec ebx
inc esi
rcr esi, 0xd5
bswap edi
sbb edx, 0x4c
not edx
and esi, 0x8f
not ebx
sbb eax, 0x33
rcr edx, 0xe
neg edi
not esi
bswap eax
dec eax
sub edi, 0x18
sub edx, 0xad
bswap edx
sbb ebx, 0xa1
bswap ebx
bswap eax
inc edi
rcr edx, 0x8a
rol edx, 0xf8
neg eax
add eax, 0x3d
inc ebx
imul ebx
rcl edx, 0x6b
inc esi
or edx, 0xb3
bswap esi
not edx
sbb ebx, 0xe5
dec edi
neg ebx
neg ebx
bswap ebx
ror edi, 0x8f
rcr edx, 3
dec edx
inc esi
neg eax
sub esi, 0xdb
neg edx
mov eax, 0x2f
not eax
bswap edx
or eax, 0x27
ror edi, 0x50
add edi, 0xfe
xor ecx, ecx
xor edi, edi
inc edi
bswap edi
rcr edx, 0x92
rol esi, 0x78
inc eax
neg ebx
dec edi
mov eax, 0x98
bswap edi
sbb edi, 0x73
inc edi
and esi, 0xd2
or edi, 0xba
add esi, 0x86
rol edi, 0x67
ror edx, 0xed
dec edi
dec esi
sbb edi, 0x56
rcl esi, 0x7c
imul ebx
dec esi
not ebx
rol eax, 0x78
sbb esi, 0xe9
neg esi
ror esi, 0xf6
not edi
sub ebx, 0x11
imul ebx
add ebx, 0xa6
bswap ebx
inc esi
neg edi
rol eax, 0x22
imul edx
not edi
add esi, 7
neg esi
inc edx
rcl esi, 0xb0
dec ebx
and eax, 0x34
inc eax
sbb eax, 0x69
rol edx, 2
ror esi, 0
not ebx
inc eax
dec ebx
mov ecx, dword [ebp + 0xc]
bswap eax
inc eax
bswap eax
imul ebx
dec ebx
and edi, 0x9d
rol eax, 0x9b
sbb edx, 0x4d
bswap ebx
neg esi
not edi
ror edi, 0xb3
neg esi
sub eax, 0xfc
dec edi
rol edi, 0x82
not edi
add ebx, 0xf4
and edx, 0xe4
sub eax, 0x28
add edx, 0x3c
bswap eax
sub ebx, 0x31
neg ebx
inc esi
rcl eax, 0
rol edi, 0x1c
bswap eax
sub edx, 0xf0
sbb edi, 0x3d
or edx, 0xa4
imul esi
neg edi
ror eax, 0x94
bswap edi
bswap ebx
rcl eax, 0xe0
rol eax, 0x57
dec eax
imul esi
bswap ebx
not edi
sbb edx, 0x88
ror edx, 0x18
sbb edx, 0x2a
bswap ebx
neg esi
ror eax, 0xed
rol esi, 0x75
inc esi
mov edi, dword [ebp + 8]
mov eax, eax
xor eax, eax
xor esi, eax
xor ebx, eax
xor eax, eax
xor eax, eax
mov eax, ebx
mov esi, esi
mov ebx, esi
xor eax, esi
mov eax, eax
xor esi, eax
not byte [edi]
mov ebx, eax
mov ebx, eax
mov ebx, ebx
xor esi, esi
mov esi, ebx
mov eax, eax
xor eax, eax
mov ebx, eax
mov esi, esi
sub byte [edi], 0x67
mov ebx, ebx
xor esi, ebx
mov esi, eax
mov ebx, eax
xor esi, eax
mov eax, eax
xor ebx, esi
mov esi, eax
mov ebx, esi
add byte [edi], 0x84
mov eax, esi
xor eax, esi
mov ebx, eax
xor esi, ebx
mov esi, ebx
xor esi, ebx
xor esi, eax
xor eax, ebx
mov esi, esi
imul byte [edi]
inc edi
loop 0x4011a6
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403323
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402219
and dword [ebp - 4], 0
cmp dword [0x45f4b0], 0
mov ebx, eax
jne 0x4033d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403485
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a8d0
push edi
call esi
test eax, eax
je 0x403485
push eax
call fcn.004021a7
mov dword [esp], 0x40a8c0
push edi
mov dword [0x45f4b0], eax
call esi
push eax
call fcn.004021a7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45f4b4], eax
call esi
push eax
call fcn.004021a7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45f4b8], eax
call esi
push eax
call fcn.004021a7
pop ecx
mov dword [0x45f4c0], eax
test eax, eax
je 0x4033d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021a7
pop ecx
mov dword [0x45f4bc], eax
mov eax, dword [0x45f4bc]
cmp eax, ebx
je 0x40342c
cmp dword [0x45f4c0], ebx
je 0x40342c
push eax
call fcn.00402222
push dword [0x45f4c0]
mov esi, eax
call fcn.00402222
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40342c
test edi, edi
je 0x40342c
call esi
test eax, eax
je 0x403423
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403423
test byte [ebp - 0xc], 1
jne 0x40342c
or dword [ebp + 0x10], 0x200000
jmp 0x403465
mov eax, dword [0x45f4b4]
cmp eax, ebx
je 0x403465
push eax
call fcn.00402222
pop ecx
test eax, eax
je 0x403465
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403465
mov eax, dword [0x45f4b8]
cmp eax, ebx
je 0x403465
push eax
call fcn.00402222
pop ecx
test eax, eax
je 0x403465
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45f4b0]
call fcn.00402222
pop ecx
test eax, eax
je 0x403485
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403487
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40518e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45ebf8]
jne 0x405198
repz ret
jmp fcn.004068b5
Function at 0x1000f9a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
movsd qword [ebp - 0x30], xmm0
mov dword [ebp - 4], 0
jmp 0x1000f9cf
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x64
jge 0x1000fac4
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 8], 0
jmp 0x1000f9f5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x64
jge 0x1000f9ff
fyl2xp1
jmp 0x1000f9ec
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0x24]
call fcn.100106c0
movsd qword [ebp - 0x48], xmm0
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [ebp - 0xc], 0
jmp 0x1000fa3b
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0x64
jge 0x1000fa56
rdtsc
shl edx, 0x20
or eax, edx
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
pop edx
pop ecx
pop ebx
pop eax
jmp 0x1000fa32
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
sbb edx, dword [ebp - 0x24]
call fcn.100106c0
movsd qword [ebp - 0x40], xmm0
movsd xmm0, qword [ebp - 0x40]
divsd xmm0, qword [ebp - 0x48]
movsd qword [ebp - 0x38], xmm0
movsd xmm0, qword [ebp - 0x38]
comisd xmm0, xmmword [str.333333]
jbe 0x1000fa9f
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x1000faa8
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
movsd xmm0, qword [ebp - 0x30]
addsd xmm0, qword [ebp - 0x38]
movsd qword [ebp - 0x30], xmm0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000f9c6
movsd xmm0, qword [ebp - 0x30]
divsd xmm0, qword [0x10031010]
movsd qword [ebp - 0x30], xmm0
cmp dword [ebp - 0x10], 0x3c
jle 0x1000fae5
mov dword [ebp - 0x18], 1
jmp 0x1000faec
mov dword [ebp - 0x18], 0
movzx eax, byte [ebp - 0x18]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10019efa
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10019f39
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10019f39
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10019f39
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10019f39
cmp dword [ecx + 0x74], 0xe
jbe 0x10019f39
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001ea10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ea3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ea3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10020f84
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034d40
push 0x10034d38
push str.FlsAlloc
push 0x1f
call fcn.1002139b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10020fb8
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x10020fbe
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10021002
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034d50
push 0x10034d48
push str.FlsGetValue
push 0x21
call fcn.1002139b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10021039
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10021041
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10034d58
push 0x10034d50
push str.FlsSetValue
push 0x22
call fcn.1002139b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1002107b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]