joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010b490
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1010ba70
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x20]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1f4
jae 0x1010b4c8
jmp 0x1010b682
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], eax
cmp dword [0xe61730], 0xffffffff
jne 0x1010b4e2
jmp 0x1010b682
mov eax, dword [0xe61730]
push eax
mov ecx, 0x402bc0
call ecx
mov edx, 0x96a4c0
mov ecx, eax
call edx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1010b50e
mov ecx, dword [ebp - 0x10]
call fcn.1010b3f0
jmp 0x1010b682
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x30]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x320
jae 0x1010b52b
jmp 0x1010b682
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x320]
cmp eax, 2
je 0x1010b53f
jmp 0x1010b682
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 0x7e]
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x34], edx
je 0x1010b56c
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 0x7e]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x30], eax
jmp 0x1010b682
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 0x31a]
cmp eax, 6
je 0x1010b5b6
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + 0x31a]
cmp edx, 7
je 0x1010b5b6
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0x31a]
cmp ecx, 0xe7
je 0x1010b5b6
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x30c]
test eax, eax
je 0x1010b5b6
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x78]
cmp edx, 1
jne 0x1010b5c3
mov ecx, dword [ebp - 0x10]
call fcn.1010b3f0
jmp 0x1010b682
push 8
push 0xaa
push 0xbd
lea ecx, [ebp - 0xc]
call fcn.10010580
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x34]
shr ecx, 8
and ecx, 0xff
mov edx, 1
imul edx, edx, 0
mov byte [ebp + edx - 8], cl
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x34]
and ecx, 0xff
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 8], cl
mov eax, dword [ebp - 0x14]
mov cl, byte [eax + 0xac]
mov byte [ebp - 6], cl
mov edx, dword [ebp - 0x14]
mov al, byte [edx + 0xb0]
mov byte [ebp - 5], al
movzx ecx, byte [ebp - 0xb]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.10168e10
add esp, 8
mov eax, dword [0xe8cb7c]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x1010b670
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x34
push eax
lea ecx, [ebp - 0x28]
push ecx
call fcn.1003d5d0
add esp, 0xc
push eax
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.10053770
mov ecx, dword [ebp - 0x10]
call fcn.1010b3f0
mov dword [0xe61730], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret
Function at 0x1010ba70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x2c]
cmp eax, 0x3e8
jae 0x1010ba91
jmp 0x1010bbe0
mov edx, dword [0xe61e18]
push edx
mov eax, 0x4e65a0
call eax
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x1010bbd4
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.1000ac20
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.1000ac40
jmp 0x1010bad5
lea ecx, [ebp - 0xc]
call fcn.1000b650
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0xc]
call fcn.1000adc0
movzx eax, al
test eax, eax
je 0x1010bbd4
lea ecx, [ebp - 0xc]
call fcn.1000b630
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
mov eax, 0x57d9a0
call eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, 0x402bc0
call edx
mov edx, 0x96a4c0
mov ecx, eax
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1010bb29
jmp 0x1010bacd
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
je 0x1010bb36
jmp 0x1010bacd
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x78]
test eax, eax
je 0x1010bb43
jmp 0x1010bacd
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 8]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xac], edx
jne 0x1010bb67
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 9]
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], edx
je 0x1010bbcf
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x54ea80
call edx
add esp, 4
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 8]
mov byte [eax + 0x2d], dl
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 9]
mov byte [eax + 0x2e], dl
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xac], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 9]
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x78], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x276], 0
mov edx, dword [ebp - 4]
mov byte [edx + 0x274], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 1
jmp 0x1010bacd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], eax
mov esp, ebp
pop ebp
ret
Function at 0x1011a360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
call fcn.1011b200
cmp eax, 0x46
jle 0x1011a382
mov ecx, dword [ebp - 4]
call fcn.1011a1b0
movzx eax, al
test eax, eax
jne 0x1011a395
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
xor al, al
jmp 0x1011a4dc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x1c]
cmp eax, 0x190
jae 0x1011a3af
xor al, al
jmp 0x1011a4dc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x1011a3c8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 8
jge 0x1011a4da
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2d]
test edx, edx
jne 0x1011a3e2
jmp 0x1011a3bf
cmp dword [ebp - 8], 7
jne 0x1011a474
push 0x20
push 0x41
mov eax, dword [ebp - 4]
cvttss2si ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
imul edx, edx, 0x23
cvtsi2ss xmm0, edx
mov eax, dword [ebp - 4]
addss xmm0, dword [eax + 0xc]
cvttss2si ecx, xmm0
push ecx
mov ecx, 0x101e1258
call fcn.1014ce40
movzx edx, al
test edx, edx
je 0x1011a472
push 0x8a
mov ecx, 0x10208be4
call fcn.1011cc30
movzx eax, al
test eax, eax
je 0x1011a43e
xor al, al
jmp 0x1011a4dc
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test eax, eax
je 0x1011a472
push 0x8e
mov ecx, 0x10208be4
call fcn.1011cd60
mov edx, dword [ebp - 4]
mov byte [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0
mov al, 1
jmp 0x1011a4dc
jmp 0x1011a4cc
push 0x20
push 0x23
mov ecx, dword [ebp - 4]
cvttss2si edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xc]
imul eax, eax, 0x23
cvtsi2ss xmm0, eax
mov ecx, dword [ebp - 4]
addss xmm0, dword [ecx + 0xc]
cvttss2si edx, xmm0
push edx
mov ecx, 0x101e1258
call fcn.1014ce40
movzx eax, al
test eax, eax
je 0x1011a4cc
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test eax, eax
je 0x1011a4cc
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov ecx, dword [ebp - 4]
call fcn.1011a130
mov al, 1
jmp 0x1011a4dc
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x1011a3bf
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1011a4e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
jne 0x1011a4f4
jmp 0x1011a55c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
cmp eax, 0x3c
jbe 0x1011a55c
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2c]
test ecx, ecx
jne 0x1011a531
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x28], 0xb
jne 0x1011a52f
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 1
jmp 0x1011a550
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], edx
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x28], 1
jne 0x1011a550
mov edx, dword [ebp - 4]
mov byte [edx + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov esp, ebp
pop ebp
ret

Function at 0x10142d50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
sub eax, dword [ecx + 0xf4]
cmp eax, 0x3e8
jbe 0x10142dbe
mov edx, dword [ebp - 4]
cmp dword [edx + 0xec], 0
jle 0x10142d8e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xec]
sub ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0xec], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xf0], 0
jle 0x10142daf
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xf0]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xf0], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xf4], eax
mov esp, ebp
pop ebp
ret
Function at 0x101437b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 7
mov ecx, 0x101e1258
call fcn.1014ce10
movzx eax, al
test eax, eax
jne 0x10143815
push 8
mov ecx, 0x101e1258
call fcn.1014ce10
movzx ecx, al
test ecx, ecx
jne 0x10143815
push 0xe
mov ecx, 0x101e1258
call fcn.1014ce10
movzx edx, al
test edx, edx
jne 0x10143815
push 0xf
mov ecx, 0x101e1258
call fcn.1014ce10
movzx eax, al
test eax, eax
jne 0x10143815
push 0x4e
mov ecx, 0x101e1258
call fcn.1014ce10
movzx ecx, al
test ecx, ecx
je 0x1014381a
jmp 0x101438fe
movzx edx, byte [0x101df657]
cmp edx, 1
jne 0x10143863
push 0x94
mov ecx, 0x10208be4
call fcn.1011cc30
movzx eax, al
test eax, eax
jne 0x1014385e
mov ecx, 0x10205020
call fcn.100c20b0
movzx ecx, al
test ecx, ecx
jne 0x1014385e
mov ecx, 0x10205088
call fcn.100c20b0
movzx edx, al
test edx, edx
je 0x10143863
jmp 0x101438fe
mov eax, 0x7dd0f0
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10143878
jmp 0x101438fe
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
je 0x101438fe
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x10262d00]
add edx, 0xfa
cmp eax, edx
jb 0x101438fe
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, word [ecx]
test edx, edx
jge 0x101438af
jmp 0x101438fe
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
mov byte [ebp - 9], al
push 8
push 1
push 0x79
lea ecx, [ebp - 0x10]
call fcn.10010580
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + 0x43]
mov byte [ebp - 0xa], dl
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 0xf]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10168e10
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10262d00], eax
mov esp, ebp
pop ebp
ret
Function at 0x10148090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
xor eax, eax
mov word [ebp - 4], ax
mov dword [ebp - 8], 0
jmp 0x101480af
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x20
jae 0x101480e3
mov edx, dword [ebp - 8]
movsx ecx, byte [edx + 0x10272fe6]
mov eax, dword [ebp - 8]
xor edx, edx
mov esi, 0x11
div esi
movsx edx, byte [edx + 0x1027303c]
xor ecx, edx
movzx eax, cl
movzx ecx, word [ebp - 4]
add ecx, eax
mov word [ebp - 4], cx
jmp 0x101480a6
mov byte [0x101dff26], 0xe2
mov byte [0x101dff25], 0x26
movzx edx, word [ebp - 4]
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x101dff26]
add ecx, eax
mov byte [0x101dff26], cl
movzx edx, word [ebp - 4]
shr edx, 8
and edx, 0xff
movzx eax, dl
movzx ecx, byte [0x101dff25]
add ecx, eax
mov byte [0x101dff25], cl
mov edx, dword [0xd227b0]
mov dword [0x101dff44], edx
mov eax, dword [0xd227f8]
mov dword [0x101dff40], eax
push 0x101481b0
push 0xd227b0
call fcn.10170ae0
add esp, 8
push 0x10148170
push 0xd227f8
call fcn.10170ae0
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10152600
Capabilities:
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x101bc5bc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea edx, [ebp - 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
xor eax, 0x12b586fd
mov dword [ebp - 0x1c], eax
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + ecx - 0xc]
xor edx, 0x5d78a568
mov dword [ebp - 0x18], edx
mov eax, 1
imul eax, eax, 6
movzx ecx, word [ebp + eax - 0xc]
and ecx, 0xffff
movzx edx, word [ebp - 0x50]
shl edx, 0x10
or ecx, edx
xor ecx, 0xf45bc124
mov dword [ebp - 0x2c], ecx
movzx eax, word [ebp - 0x30]
and eax, 0xffff
movzx ecx, word [ebp - 0x2e]
shl ecx, 0x10
or eax, ecx
xor eax, 0xb542d8e2
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
push str._08X__08X__08X__08X
mov eax, dword [ebp - 0x20]
add eax, 8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret
Function at 0x10152770
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 4
push 0x14
call fcn.1006d62d
add esp, 4
mov dword [ebp - 0x10], eax
push 0x288
call fcn.1006d62d
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x101527bf
mov edx, dword [ebp - 0xc]
push edx
call fcn.1006d62d
add esp, 4
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x10152863
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, 1
imul eax, eax, 5
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul eax, eax, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul eax, eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
push str._02X:_02X:_02X:_02X:_02X:_02X
mov eax, dword [ebp - 0x10]
push eax
call fcn.1006e94a
add esp, 0x20
mov ecx, dword [ebp - 8]
push ecx
call fcn.1006da11
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret

Function at 0x10153600
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0x101bc768
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx ecx, word [ebp - 0x4c]
push ecx
movzx edx, word [ebp - 0x4a]
push edx
movzx eax, word [ebp - 0x46]
push eax
push str.LOGLOG__02d__02d__02d.txt
lea ecx, [ebp - 0x3c]
push ecx
call fcn.1006e94a
add esp, 0x14
lea edx, [ebp + 0x10]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x101e3630
call fcn.1005ad80
add esp, 0xc
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x58], 1
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x54], edx
cmp dword [ebp - 0x54], 1
je 0x10153680
jmp 0x10153691
push 0x101e3630
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 8]
call fcn.101535b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret

Function at 0x101536d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [0x1020be0c], 0
jne 0x101536e2
jmp 0x10153734
push 0
push 0
push 0x10153740
call fcn.1006fef3
add esp, 0xc
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x101bc6e4
push 0x101dff36
call fcn.10153780
add esp, 8
push str._Plugin_Loaded
push 0x101dff36
call fcn.10153780
add esp, 8
push str._____________________________________________
push 0x101dff36
call fcn.10153780
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10153780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1020be0c], 0
jne 0x101537a1
jmp 0x101538d2
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x838], eax
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x82c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x101e3630
call fcn.1005ad80
add esp, 0xc
mov dword [ebp - 0x82c], 0
mov byte [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xf], ecx
mov dword [ebp - 0xb], ecx
mov word [ebp - 7], cx
movzx edx, word [ebp - 0x814]
push edx
movzx eax, word [ebp - 0x816]
push eax
movzx ecx, word [ebp - 0x818]
push ecx
push str._02d:_02d:_02d:
lea edx, [ebp - 0x10]
push edx
call fcn.1005ada0
add esp, 0x14
push 0x101e3630
push 0x101bc764
lea eax, [ebp - 0x810]
push eax
call fcn.1005add0
add esp, 0xc
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10153600
add esp, 8
lea eax, [ebp - 0x810]
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
add ecx, 1
mov dword [ebp - 0x834], ecx
mov edx, dword [ebp - 0x828]
mov al, byte [edx]
mov byte [ebp - 0x821], al
add dword [ebp - 0x828], 1
cmp byte [ebp - 0x821], 0
jne 0x10153867
mov ecx, dword [ebp - 0x828]
sub ecx, dword [ebp - 0x834]
mov dword [ebp - 0x830], ecx
push 0
lea edx, [ebp - 0x83c]
push edx
mov eax, dword [ebp - 0x830]
push eax
lea ecx, [ebp - 0x810]
push ecx
push 0
mov ecx, dword [ebp + 8]
call fcn.101536a0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 7
push 0
mov ecx, dword [ebp + 8]
call fcn.101536a0
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret

Function at 0x101538e0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x101bcb54
mov ecx, 0x10272fa0
call fcn.101653a0
movzx eax, al
test eax, eax
jne 0x10153915
push 0x10
push 0x101bcb60
push str.Main.mspro_not_found_or_is_invalid
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x101dff36
call fcn.101536d0
mov ecx, 0x101df6d8
call fcn.100c4680
push str.DataEnc1.dat
mov ecx, 0x10272570
call fcn.1015e280
push str.DataDec2.dat
mov ecx, 0x10272570
call fcn.1015e2a0
call fcn.10148090
mov ecx, 0x10272e50
call fcn.10164a60
mov ecx, 0x10272fa0
call fcn.101654c0
mov ecx, 0x10272fa0
call fcn.10165550
mov ecx, 0x10272fa0
call fcn.101655e0
mov ecx, 0x10272fa0
call fcn.10165750
mov ecx, 0x10206e90
call fcn.100d1480
mov ecx, 0x10204960
call fcn.100b2f30
mov ecx, 0x101dff3e
call fcn.1016c4d0
movzx ecx, byte [0x1027332d]
cmp ecx, 1
jne 0x101539bd
push 0
push 0
push 0
push 0x10153d10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1015dd70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x101db820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ecx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1015ddaf
xor al, al
jmp 0x1015def9
push 0
lea ecx, [ebp - 0x30]
push ecx
push 6
lea edx, [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movzx ecx, word [ebp - 0x38]
movzx edx, word [ebp + 0xc]
cmp ecx, edx
jne 0x1015ddd7
cmp dword [ebp - 0x36], 0x36
je 0x1015dde8
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1015def9
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x1015ddfb
mov edx, dword [ebp - 0x28]
add edx, 0x24
mov dword [ebp - 0x2c], edx
jmp 0x1015de04
mov eax, dword [ebp - 0x28]
add eax, 0x54
mov dword [ebp - 0x2c], eax
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x24], 0
jmp 0x1015de2c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 4
jge 0x1015de51
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, dword [eax + edx*4 + 0x84]
xor edx, dword [ebp + ecx*4 - 0x14]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + eax*4], edx
jmp 0x1015de23
push 0
lea edx, [ebp - 0x30]
push edx
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], 0
jmp 0x1015de79
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 4
jge 0x1015de9f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ecx + eax*4 + 0x84]
xor eax, dword [ebp + edx*4 - 0x14]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov dword [edx + ecx*4 + 0x10], eax
jmp 0x1015de70
push 0
lea eax, [ebp - 0x30]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x20], 0
jmp 0x1015dec7
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1015deed
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [edx + ecx*4 + 0x84]
xor ecx, dword [ebp + eax*4 - 0x14]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [eax + edx*4 + 0x20], ecx
jmp 0x1015debe
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d500
mov esp, ebp
pop ebp
ret 0xc