joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10087e57
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1007a7b0
xor ebx, ebx
cmp dword [0x100fd0cc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10087f2d
push 0x100bdd44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1008800d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x100bdd38
push edi
call esi
cmp eax, ebx
je 0x1008800d
push eax
call fcn.1007a742
mov dword [esp], 0x100bdd28
push edi
mov dword [0x100fd0cc], eax
call esi
push eax
call fcn.1007a742
mov dword [esp], 0x100bdd14
push edi
mov dword [0x100fd0d0], eax
call esi
push eax
call fcn.1007a742
mov dword [0x100fd0d4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1007a33e
test eax, eax
pop ecx
pop ecx
je 0x10087efb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1006ed01
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10087f2d
push 0x100bdcf8
push edi
call esi
push eax
call fcn.1007a742
cmp eax, ebx
pop ecx
mov dword [0x100fd0dc], eax
je 0x10087f2d
push 0x100bdce0
push edi
call esi
push eax
call fcn.1007a742
pop ecx
mov dword [0x100fd0d8], eax
mov eax, dword [0x100fd0d8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10087fb2
cmp dword [0x100fd0dc], ecx
je 0x10087fb2
push eax
call fcn.1007a7b9
push dword [0x100fd0dc]
mov esi, eax
call fcn.1007a7b9
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10087fb2
cmp edi, ebx
je 0x10087fb2
call esi
cmp eax, ebx
je 0x10087f7f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10087f7f
test byte [ebp - 0x18], 1
jne 0x10087fb2
lea eax, [ebp - 0x10]
push eax
call fcn.1007a375
test eax, eax
pop ecx
je 0x10087f9a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1006ed01
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10087fa9
or dword [ebp + 0x10], 0x200000
jmp 0x10087fed
or dword [ebp + 0x10], 0x40000
jmp 0x10087fed
mov eax, dword [0x100fd0d0]
cmp eax, dword [ebp - 8]
je 0x10087fed
push eax
call fcn.1007a7b9
cmp eax, ebx
pop ecx
je 0x10087fed
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10087fed
mov eax, dword [0x100fd0d4]
cmp eax, dword [ebp - 8]
je 0x10087fed
push eax
call fcn.1007a7b9
cmp eax, ebx
pop ecx
je 0x10087fed
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100fd0cc]
call fcn.1007a7b9
cmp eax, ebx
pop ecx
je 0x1008800d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1008800f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1008d3d9
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x100fd188], 0
push esi
jne 0x1008d34c
call fcn.1008d277
test eax, eax
je 0x1008d38f
mov eax, dword [0x100fd188]
cmp eax, 1
jne 0x1008d36d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1008d38f
pop esi
ret
push eax
call dword [0x100fd190]
test eax, eax
jne 0x1008d3d7
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1008d393
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x100fd188]
call dword [0x100fd190]
mov edi, eax
test edi, edi
je 0x1008d3ba
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x1008d3d6
lea edi, [esi + 0xff0]
push esi
push dword [0x100fd188]
call dword [0x100fd18c]
add esi, 0x10
cmp esi, edi
jb 0x1008d3c0
mov eax, esi
pop edi
pop esi
ret
jmp 0x1008d339

Function at 0x1008d5d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x19c
push 4
push 0x3000
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1008d607
xor eax, eax
jmp 0x1008d69f
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1008d645
jmp 0x1008d683
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
movzx eax, word [edx]
cmp eax, 0x5a4d
je 0x1008d65a
jmp 0x1008d683
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0x4550
je 0x1008d673
jmp 0x1008d683
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
add edx, dword [ecx + 0x28]
mov dword [ebp - 0xc], edx
xor eax, eax
jne 0x1008d619
cmp dword [ebp - 4], 0
je 0x1008d69c
push 0x8000
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1008e240
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x100fd308], 0
jne 0x1008e2d8
mov dword [ebp - 0x21c], 0
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.winhttp.dll
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
mov dword [0x100fd308], ecx
xor eax, eax
cmp dword [0x100fd308], 0
setne al
jmp 0x1008e2dd
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006ef21
mov esp, ebp
pop ebp
ret
Function at 0x1008ef20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x30], 0
je 0x1008ef67
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x30]
push eax
call fcn.1008ee60
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x30]
push edx
call fcn.1008eee0
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 8], 0
je 0x1008ef89
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call fcn.1008e510
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 4], 0
je 0x1008efab
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
call fcn.1008e510
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x1008efcb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x34], 0
je 0x1008efeb
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x3c], 0
je 0x1008f00b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3c], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x40], 0
je 0x1008f05a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
push 0xbb8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x40], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
add eax, 0x44
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esp, ebp
pop ebp
ret
Function at 0x1008ff50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x128], 0
push 0x118
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1008ffa5
mov eax, 1
jmp 0x1008fff0
cmp dword [ebp - 0x124], 5
jne 0x1008ffde
cmp dword [ebp - 0x120], 1
jne 0x1008ffc6
movzx edx, word [ebp - 0x14]
cmp edx, 1
jge 0x1008ffc6
xor eax, eax
jmp 0x1008fff0
cmp dword [ebp - 0x120], 0
jne 0x1008ffdc
movzx eax, word [ebp - 0x14]
cmp eax, 3
jge 0x1008ffdc
xor eax, eax
jmp 0x1008fff0
jmp 0x1008ffeb
cmp dword [ebp - 0x124], 5
jae 0x1008ffeb
xor eax, eax
jmp 0x1008fff0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006ef21
mov esp, ebp
pop ebp
ret

Function at 0x100904d0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b3da8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000177b
mov byte [ebp - 4], 1
mov ecx, dword [0x100cb580]
mov dword [ebp - 0x30], ecx
mov edx, dword [0x100cb580]
push edx
push 0x5c
lea ecx, [ebp - 0x2c]
call fcn.100375af
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [0x100cb580]
je 0x1009058a
mov ecx, dword [ebp - 0x30]
push ecx
push 0
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.10001944
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x60]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.100017c8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
call fcn.100017b3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp - 0x2c]
push edx
call fcn.1000177b
mov dword [ebp - 0x64], eax
call fcn.100904d0
add esp, 0x1c
push 0
lea ecx, [ebp + 8]
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100905ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100905d5
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100017b3
mov eax, dword [ebp - 0x54]
jmp 0x10090617
mov dword [ebp - 0x58], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.100017b3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.100017b3
mov eax, dword [ebp - 0x58]
jmp 0x10090617
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
mov esp, ebp
pop ebp
ret
Function at 0x10090630
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.10071bc0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.100735a0
add esp, 8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100906d0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x224], esp
lea edx, [ebp - 0x218]
push edx
call fcn.10001745
mov dword [ebp - 0x22c], eax
call fcn.100904d0
add esp, 0x1c
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x220], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x228]
add ecx, 0x2c
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 0xc], 0
je 0x1009070c
mov ecx, dword [ebp - 0x228]
add ecx, 0x2c
call fcn.10004dc8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006ef21
mov esp, ebp
pop ebp
ret 8

Function at 0x10090dc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov word [ebp - 0x420], 0
push 0x410
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.10071bc0
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x2f
mov edx, dword [ebp + 8]
push edx
call fcn.1006f337
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x10090e92
push str.QMDownload
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x428], esp
lea edx, [ebp - 0x420]
push edx
call fcn.10001745
mov dword [ebp - 0x42c], eax
call fcn.100904d0
add esp, 0x1c
mov eax, dword [ebp - 0x424]
add eax, 2
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x420]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10009e2c
mov eax, dword [ebp - 0x424]
add eax, 2
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10009e2c
jmp 0x10090eac
push 0x100c2e88
mov ecx, dword [ebp + 0xc]
call fcn.10009e2c
push 0x100c2e8c
mov ecx, dword [ebp + 0x10]
call fcn.10009e2c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006ef21
mov esp, ebp
pop ebp
ret
Function at 0x10090ec0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x8c], 0
je 0x10090edc
xor eax, eax
jmp 0x10091099
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 4], 0
jne 0x10090eec
xor eax, eax
jmp 0x10091099
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
call fcn.10009e2c
mov eax, dword [ebp - 0x20]
cmp dword [eax + 8], 0
jne 0x10090f18
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 8], 0
jne 0x10090f28
xor eax, eax
jmp 0x10091099
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x88], 0
je 0x10090f80
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x88]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
je 0x10090f6c
push 1
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x24], eax
jmp 0x10090f73
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0x88], 0
call fcn.1008ff50
test eax, eax
je 0x10090fce
call fcn.1008ff30
cmp eax, 1
jne 0x10090fce
push 0x5c
call fcn.1006ec8d
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10090fb3
mov ecx, dword [ebp - 0x14]
call fcn.1008f3e0
mov dword [ebp - 0x28], eax
jmp 0x10090fba
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x88], ecx
jmp 0x10091007
push 0x30
call fcn.1006ec8d
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10090fee
mov ecx, dword [ebp - 0x1c]
call fcn.1008ec20
mov dword [ebp - 0x2c], eax
jmp 0x10090ff5
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x88], ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [ebp - 0x20]
mov dword [edx + 0x64], eax
push 0x10090000
push 0xfffffffffffffffc
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x64]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x8c], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0x10090760
push 0
push 0
call fcn.100728ee
add esp, 0x18
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0xc], 0
jne 0x1009108d
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x8c], 0
mov ecx, dword [ebp - 0x20]
xor eax, eax
cmp dword [ecx + 0xc], 0
setne al
mov esp, ebp
pop ebp
ret 4
Function at 0x100913c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x3c], ecx
cmp dword [ebp + 0x10], 0
jne 0x100913d6
xor eax, eax
jmp 0x10091515
mov dword [ebp - 0xc], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x3c]
add ecx, 0x2c
call fcn.10048580
lea edx, [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x3c]
add ecx, 0x2c
call fcn.100479d0
push eax
lea ecx, [ebp - 8]
call fcn.10048630
movzx eax, al
test eax, eax
je 0x10091459
lea ecx, [ebp - 0x18]
call fcn.10047690
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
lea edx, [ebp + 8]
push edx
mov ecx, dword [ebp - 0x3c]
add ecx, 0x2c
call fcn.100484c0
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x10091512
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
call fcn.10048670
add eax, 4
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx]
jbe 0x10091509
cmp dword [ebp - 0x20], 0x12c
jbe 0x10091509
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [eax + 8]
jbe 0x10091509
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], 0
fild qword [ebp - 0x44]
fdiv qword [0x100cfdd8]
fstp qword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [eax + 8]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], 0
fild qword [ebp - 0x4c]
fdiv qword [ebp - 0x30]
fnstcw word [ebp - 0x4e]
movzx eax, word [ebp - 0x4e]
or eax, 0xc00
mov dword [ebp - 0x54], eax
fldcw word [ebp - 0x54]
fistp qword [ebp - 0x5c]
fldcw word [ebp - 0x4e]
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov dword [ecx], edx
jmp 0x10091512
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10091af7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x10091b06
cmp dword [ebp + 0x10], 0
jg 0x10091b0e
mov eax, dword [ebp + 8]
jmp 0x10091c91
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jl 0x10091c57
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
sub eax, 8
mov dword [ebp + 0x10], eax
jmp 0x10091b17
cmp dword [ebp + 0x10], 0
je 0x10091c8b
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x100c2fe8]
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
inc eax
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
jne 0x10091c5d
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x10092cb1
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], 0
jne 0x10092cd1
xor eax, eax
jmp 0x10092dc9
and dword [ebp - 4], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x10092dc6
push 0x22c
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.10071bc0
add esp, 0xc
mov dword [ebp - 0x240], 0x22c
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10092dbd
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
je 0x10092da6
and word [ebp - 0x450], 0
push 0x206
push 0
lea eax, [ebp - 0x44e]
push eax
call fcn.10071bc0
add esp, 0xc
push 0x103
push dword [ebp - 0x244]
lea eax, [ebp - 0x450]
push eax
call fcn.10072233
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
push dword [ebp + 8]
lea eax, [ebp - 0x450]
push eax
call fcn.100731fe
pop ecx
pop ecx
test eax, eax
jne 0x10092da6
mov dword [ebp - 4], 1
jmp 0x10092dbd
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0xc], eax
jmp 0x10092d1d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006ef21
leave
ret