joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10056000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10056047
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x18]
push 0
push eax
push 6
lea eax, [ebp - 0x20]
push eax
push edi
call ebx
mov eax, 0x1112
cmp word [ebp - 0x20], ax
jne 0x10056154
cmp dword [ebp - 0x1e], 0x36
jne 0x10056154
cmp byte [ebp + 0x10], 0
mov eax, 0x101131fc
push esi
push 0
mov esi, 0x101131cc
cmovne esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [0x1011322c]
xor eax, dword [ebp - 0x14]
mov dword [esi], eax
mov eax, dword [0x10113230]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov eax, dword [0x10113234]
xor eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, dword [0x10113238]
xor eax, dword [ebp - 8]
push 0
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [0x1011322c]
xor eax, dword [ebp - 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [0x10113230]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [0x10113234]
xor eax, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
mov eax, dword [0x10113238]
xor eax, dword [ebp - 8]
push 0
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x18]
push eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push edi
call ebx
mov eax, dword [0x1011322c]
xor eax, dword [ebp - 0x14]
mov dword [esi + 0x20], eax
mov eax, dword [0x10113230]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov eax, dword [0x10113234]
xor eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [0x10113238]
xor eax, dword [ebp - 8]
push edi
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop ebx
xor ecx, ebp
pop edi
call fcn.1006459b
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10059a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10059930
sub eax, 0x836486
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x836481
mov dword [ebp - 4], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10059a96
mov eax, dword [ebp - 0x10]
mov ecx, 0x836481
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x10059a98
call esi
push ebx
mov ebx, 0x100598a0
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 4], 0
lea eax, [ebx - 0x7dd309]
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x7dd304
call edi
test eax, eax
je 0x10059aec
mov eax, dword [ebp - 0x10]
mov ecx, 0x7dd304
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x10059aee
call esi
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
sub ebx, 0x833b0d
mov dword [ebp - 4], 0
push 0x833b08
mov dword [ebp - 0xf], ebx
call edi
pop ebx
test eax, eax
je 0x10059b3d
mov eax, dword [ebp - 0x10]
mov ecx, 0x833b08
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x10059b3f
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1005a020
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x1005a0d0
push 0x7dcfd0
push 0xe9
call fcn.10063f10
push 0x1005a530
push 0x7897c7
push 0xe9
call fcn.10063f10
push 0x1005a690
push 0x78aaa6
push 0xe9
call fcn.10063f10
add esp, 0x24
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x599183
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x599183
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 6
push 0x599183
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1005a5f0
push 0x599183
push 0xe9
call fcn.10063f10
push 0x1005a790
push 0x83b934
push 0xe9
call fcn.10063f10
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1005a7b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [0x1030aa2c]
mov esi, 0x861110
push 7
call esi
mov ebx, 0x85ec20
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 8
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 0xc
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 0xe
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 0xf
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 0x41
call esi
mov ecx, eax
call ebx
test al, al
jne 0x1005a998
push 0x4e
call fcn.10039dd0
test al, al
jne 0x1005a998
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1005a998
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ecx, dword [0x1030a824]
add ecx, 0xfa
cmp eax, ecx
jb 0x1005a998
mov edx, dword [0x7bc4f04]
movzx eax, word [edx + 0x208]
cmp ax, 1
jle 0x1005a8e9
cmp dword [0xe61e18], 0xa
jne 0x1005a8b0
mov ecx, dword [0x879340c]
cmp ecx, 0x239
jle 0x1005a8b0
cmp ecx, 0x275
jge 0x1005a8b0
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x1005a8b0
cmp ecx, 0x56
jl 0x1005a998
cmp ax, 1
jle 0x1005a8e9
cmp dword [0xe61e18], 0x27
jne 0x1005a8e9
mov ecx, dword [0x879340c]
cmp ecx, 0x239
jle 0x1005a8e9
cmp ecx, 0x275
jge 0x1005a8e9
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x1005a8e9
cmp ecx, 0x56
jl 0x1005a998
movzx edx, word [edx + 0x22c]
cmp dx, 1
jle 0x1005a960
test ax, ax
jg 0x1005a92a
cmp dword [0xe61e18], 0xa
jne 0x1005a92a
mov ecx, dword [0x879340c]
cmp ecx, 0x1d1
jle 0x1005a92a
cmp ecx, 0x1fc
jge 0x1005a92a
mov ecx, dword [0x8793410]
cmp ecx, 0x29
jle 0x1005a92a
cmp ecx, 0x56
jl 0x1005a998
cmp dx, 1
jle 0x1005a960
test ax, ax
jg 0x1005a960
cmp dword [0xe61e18], 0x27
jne 0x1005a960
mov eax, dword [0x879340c]
cmp eax, 0x1d1
jle 0x1005a960
cmp eax, 0x1fc
jge 0x1005a960
mov eax, dword [0x8793410]
cmp eax, 0x29
jle 0x1005a960
cmp eax, 0x56
jl 0x1005a998
cmp word [edi], 0
jl 0x1005a998
xor eax, eax
mov byte [ebp - 1], 0
mov dword [ebp - 7], eax
lea ecx, [ebp - 8]
mov word [ebp - 3], ax
mov edx, 8
mov word [ebp - 4], ax
mov al, byte [edi + 0x43]
mov dword [ebp - 8], 0x17908c1
mov byte [ebp - 2], al
call fcn.1005d410
call esi
mov dword [0x1030a824], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1005bed0
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1009400c]
xor eax, esp
mov dword [esp + 0x40c], eax
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
call fcn.10003bc0
push ecx
lea eax, [edi + 0xbe7cc]
push eax
push str.main.premium
lea ecx, [esp + 0x1c]
call fcn.10003d30
test al, al
je 0x1005bf49
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.main.premium
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1005bf49
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xbe7c8
je 0x1005bf61
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0xbe7c8
add edi, 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005bf42
xor edx, edx
mov eax, edx
lea ecx, [edi + edx]
shr eax, 8
xor al, 0x95
add al, byte [ecx]
xor al, dl
inc edx
xor al, 0xda
mov byte [ecx], al
cmp edx, 0xbe7c8
jb 0x1005bf86
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x414]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.1006459b
mov esp, ebp
pop ebp
ret 4

Function at 0x1005bfc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [ecx + 4], 2
je 0x1005c01b
lea eax, [ecx + 0x45]
push eax
lea eax, [ebp - 0x104]
push str.XTEAM_MAIN_10405__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x1005c029
lea eax, [ebp - 0x104]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006459b
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1005c040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x518
mov eax, dword [0x1009400c]
xor eax, esp
mov dword [esp + 0x514], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x1b4], 0
je 0x1005c153
cmp word [esi + 0x31c], 0
je 0x1005c153
push 0x104
lea eax, [esp + 0x414]
push 0
push eax
call fcn.10066f50
add esp, 0xc
lea eax, [esp + 0x410]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1005c0b0
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edi, [esi + 0xd3]
push edi
lea ecx, [esp + 0x414]
call fcn.10064050
push eax
call fcn.1006ff32
add esp, 8
test eax, eax
je 0x1005c0d8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx eax, word [esi + 0x31c]
push eax
push ecx
call fcn.10050420
test al, al
je 0x1005c0f2
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esp + 0x10]
call fcn.10003bc0
push ecx
lea eax, [esp + 0x10]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.10003d30
test al, al
jne 0x1005c12b
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1b4]
cmp eax, dword [esp + 0xc]
je 0x1005c153
push 0x10
push str.Error
push str.Main.exe_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x51c]
pop edi
pop esi
xor ecx, esp
call fcn.1006459b
mov esp, ebp
pop ebp
ret

Function at 0x1005c170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1b8], 0
je 0x1005c1fc
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0xf3]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c1c1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1b8]
cmp eax, dword [ebp - 0x408]
je 0x1005c1d7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c1ea
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c1fc
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret
Function at 0x1005c210
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1bc], 0
je 0x1005c29c
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x113]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c261
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1bc]
cmp eax, dword [ebp - 0x408]
je 0x1005c277
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c28a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c29c
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret

Function at 0x1005c2b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1c0], 0
je 0x1005c33c
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x133]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c301
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1c0]
cmp eax, dword [ebp - 0x408]
je 0x1005c317
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c32a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c33c
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret

Function at 0x1005c350
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1c4], 0
je 0x1005c3dc
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x153]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c3a1
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1c4]
cmp eax, dword [ebp - 0x408]
je 0x1005c3b7
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c3ca
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c3dc
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret
Function at 0x1005c3f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1c8], 0
je 0x1005c47c
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x173]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c441
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1c8]
cmp eax, dword [ebp - 0x408]
je 0x1005c457
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c46a
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c47c
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret

Function at 0x1005c490
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x1cc], 0
je 0x1005c548
push edi
lea ecx, [ebp - 0x404]
call fcn.10003bc0
push ecx
lea eax, [ebp - 0x408]
push eax
lea edi, [esi + 0x193]
push edi
lea ecx, [ebp - 0x404]
call fcn.10003d30
test al, al
jne 0x1005c4f9
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esi + 0x1cc]
cmp eax, dword [ebp - 0x408]
je 0x1005c523
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
test eax, eax
jne 0x1005c536
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1008da18
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005c548
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1006459b
mov esp, ebp
pop ebp
ret
Function at 0x1005dbf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0xe609e8], 5
jne 0x1005dc76
cmp dword [0x101fca3c], 1
jne 0x1005dc76
push esi
call fcn.1005dc80
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101fca30]
cmp eax, dword [0x101fca28]
jbe 0x1005dc3c
xor edx, edx
push 0
push 0
lea ecx, [edx + 2]
call fcn.1005ddf0
add esp, 8
mov eax, 0x63a180
mov ecx, 0x8793750
pop esi
jmp eax
call esi
sub eax, dword [0x101fca34]
cmp eax, dword [0x101fca2c]
jb 0x1005dc75
mov eax, dword [0x101fca38]
sub eax, 0
je 0x1005dc69
sub eax, 1
jne 0x1005dc6e
call fcn.1005dec0
call esi
mov dword [0x101fca34], eax
pop esi
ret
call fcn.1005de50
call esi
mov dword [0x101fca34], eax
pop esi
ret

Function at 0x1005e200
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101fca38], 2
jne 0x1005e278
movq xmm0, qword [0x101fca54]
lea ecx, [ebp - 0x10]
mov ax, word [0x101fca5c]
mov edx, 0xe
mov dword [ebp - 0x10], 0x3f30ec1
movq qword [ebp - 0xc], xmm0
mov word [ebp - 4], ax
call fcn.1005d410
mov dword [0x101fca3c], 1
mov dword [0x101fca38], 3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101fca34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101fca30], eax
mov dword [0x101fca2c], 0x7530
mov dword [0x101fca28], 0x7530
mov esp, ebp
pop ebp
ret

Function at 0x1005e280
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x101fca38], 3
jne 0x1005e2b0
cmp dword [0x101fca20], 0
je 0x1005e2b0
mov edx, 5
mov dword [ebp - 8], 0x51bf05c1
lea ecx, [ebp - 8]
mov byte [ebp - 4], 0
call fcn.1005d410
mov dword [0x101fca3c], 0
mov dword [0x101fca38], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101fca34], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101fca30], eax
mov dword [0x101fca2c], 0
mov dword [0x101fca28], 0
mov dword [0x101fca24], 0
mov dword [0x101fca20], 0
mov esp, ebp
pop ebp
ret
Function at 0x10060bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [0xe609e8], 4
mov edx, eax
jne 0x10060de9
movd xmm1, dword [0x101fcaac]
movss xmm0, dword [0x101f7274]
mov eax, dword [0x101fcab4]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10060c88
comiss xmm1, dword [0x101f727c]
ja 0x10060c88
movss xmm0, dword [0x101f7278]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x10060c88
comiss xmm2, dword [0x101f7280]
ja 0x10060c88
cmp dword [ebp + 8], 0x201
jne 0x10060c63
mov byte [0x101f7288], 1
pop esi
pop ebp
ret 4
sub edx, dword [0x101f7284]
mov byte [0x101f7288], 0
cmp edx, 0x1f4
jb 0x10060de9
call esi
mov dword [0x101f7284], eax
pop esi
pop ebp
ret 4
movss xmm0, dword [0x101f734c]
comiss xmm0, xmm1
ja 0x10060cf5
comiss xmm1, dword [0x101f7354]
ja 0x10060cf5
movss xmm0, dword [0x101f7350]
movd xmm2, eax
cvtdq2ps xmm2, xmm2
comiss xmm0, xmm2
ja 0x10060cf5
comiss xmm2, dword [0x101f7358]
ja 0x10060cf5
cmp dword [ebp + 8], 0x201
jne 0x10060cd0
mov byte [0x101f7360], 1
pop esi
pop ebp
ret 4
sub edx, dword [0x101f735c]
mov byte [0x101f7360], 0
cmp edx, 0x1f4
jb 0x10060de9
call esi
mov dword [0x101f735c], eax
pop esi
pop ebp
ret 4
movss xmm0, dword [0x101f7424]
comiss xmm0, xmm1
ja 0x10060d62
comiss xmm1, dword [0x101f742c]
ja 0x10060d62
movss xmm0, dword [0x101f7428]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x10060d62
comiss xmm1, dword [0x101f7430]
ja 0x10060d62
cmp dword [ebp + 8], 0x201
jne 0x10060d3d
mov byte [0x101f7438], 1
pop esi
pop ebp
ret 4
sub edx, dword [0x101f7434]
mov byte [0x101f7438], 0
cmp edx, 0x1f4
jb 0x10060de9
call esi
mov dword [0x101f7434], eax
pop esi
pop ebp
ret 4
push 0x54
mov ecx, 0x101f5d40
call fcn.10039e30
test al, al
je 0x10060da8
cmp dword [ebp + 8], 0x201
jne 0x10060d87
mov byte [0x101f7510], 1
pop esi
pop ebp
ret 4
sub edx, dword [0x101f750c]
mov byte [0x101f7510], 0
cmp edx, 0x1f4
jb 0x10060de9
call esi
mov dword [0x101f750c], eax
pop esi
pop ebp
ret 4
push 0x57
mov ecx, 0x101f5d40
call fcn.10039e30
test al, al
je 0x10060de9
cmp dword [ebp + 8], 0x201
jne 0x10060dcd
mov byte [0x101f75e8], 1
pop esi
pop ebp
ret 4
sub edx, dword [0x101f75e4]
mov byte [0x101f75e8], 0
cmp edx, 0x1f4
jb 0x10060de9
call esi
mov dword [0x101f75e4], eax
pop esi
pop ebp
ret 4
Function at 0x10062c40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
mov edi, 0x10062d10
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 4], 0
lea eax, [edi - 0x425477]
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x425472
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10062ca8
mov eax, dword [ebp - 0x10]
mov ecx, 0x425472
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call ebx
test eax, eax
jne 0x10062caa
call esi
lea eax, [ebp - 4]
mov byte [ebp - 0x10], 0xe8
push eax
push 0x40
push 5
sub edi, 0x425489
mov dword [ebp - 4], 0
push 0x425484
mov dword [ebp - 0xf], edi
call ebx
test eax, eax
je 0x10062cf8
mov eax, dword [ebp - 0x10]
mov ecx, 0x425484
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call ebx
test eax, eax
jne 0x10062cfa
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100639f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
mov esi, ecx
mov bl, dl
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10063a22
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov byte [esi], bl
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10063a16
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10063a50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
mov esi, ecx
mov ebx, edx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10063a82
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [esi], ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10063a76
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret