joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e8a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45e8d3
push esi
call fcn.00461990
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45e8cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45e959
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45e942
mov eax, dword [esi + 8]
test eax, eax
je 0x45e8f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45e93e
cmp eax, 2
je 0x45e942
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45e8ea
cmp eax, 3
je 0x45e91d
cmp eax, 1
jne 0x45e8ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45e8ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45e8ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045e980
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45e968
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045e980
add esp, 4
pop esi
ret

Function at 0x46a980
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x46aa23
test eax, eax
jbe 0x46aa23
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x46aa23
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x46a9ce
xor esi, esi
jmp 0x46a9d4
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x46a9ff
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.0046ed70
add esi, eax
push esi
mov ebx, esi
call fcn.0046ed70
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x46a9e0
pop ebp
test edi, edi
pop edi
jne 0x46aa23
test ebx, ebx
je 0x46aa23
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00484230
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x46ab65
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x46ac7d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46ac7d
mov eax, dword [esi + 0x3c]
push eax
call fcn.00495470
mov esi, eax
test esi, esi
je 0x46ac7d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x46ac7d
mov ecx, esi
call fcn.0046aad0
cmp edi, eax
jge 0x46ac7d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x46ac03
mov dword [esp + 0x34], 1
jmp 0x46ac5e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x46ac7d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0046a050
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x473560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x473681
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x473665
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x4735b7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x473595
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x4740c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x474120
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x474120
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x474120
xor eax, eax
inc eax
jmp 0x474122
xor eax, eax
leave
ret 0x10
Function at 0x47414b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x4741b9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5f020c
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4741b0
cmp dword [ebp - 0xc], 4
jne 0x4741b0
cmp dword [ebp - 0x10], edi
je 0x4741b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x611c70], edi
xor eax, eax
jmp 0x4741f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x611c70], edi
jge 0x4741f3
lea eax, [ebp - 0x34]
push eax
mov dword [0x611c70], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x4741f3
cmp word [ebp - 0x14], 5
jb 0x4741f3
call fcn.00474126
test eax, eax
je 0x4741f3
emms
mov dword [0x611c70], 1
mov eax, dword [0x611c70]
pop edi
leave
ret

Function at 0x495e13
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x495e4b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00493eca
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00493ea2
jmp 0x495e57
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x497501
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x497543
call fcn.0049cffb
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x497543
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49753a
xor eax, eax
jmp 0x49754b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00497551
pop edi
pop esi
pop ebx
ret 4

Function at 0x49d52b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49d559
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49d577
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049d491
jmp 0x49d577
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49d577
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049d491
test edi, edi
mov eax, edi
jne 0x49d561
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10002c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10002ca7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10002cd8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10002cd4
cmp esi, eax
jae 0x10002cd8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10002cc4
cmp esi, eax
jb 0x10002cde
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x10006410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
fld dword [eax + 8]
fstp dword [esi + 8]
fld dword [eax + 0xc]
fstp dword [esi + 0xc]
fld dword [eax + 0x10]
fstp dword [esi + 0x10]
fld dword [eax + 0x14]
fstp dword [esi + 0x14]
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x18], ecx
mov edx, dword [eax + 0x1c]
mov dword [esi + 0x1c], edx
mov ecx, dword [eax + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [eax + 0x24]
mov dword [esi + 0x24], edx
mov ecx, dword [eax + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [eax + 0x2c]
mov dword [esi + 0x2c], edx
mov ecx, dword [eax + 0x30]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 0x34]
mov dword [esi + 0x34], edx
movzx ecx, byte [eax + 0x38]
mov byte [esi + 0x38], cl
mov edx, dword [eax + 0x3c]
mov dword [esi + 0x3c], edx
mov ecx, dword [eax + 0x40]
mov dword [esi + 0x40], ecx
mov edx, dword [eax + 0x44]
mov dword [esi + 0x44], edx
mov ecx, dword [eax + 0x48]
mov dword [esi + 0x48], ecx
mov edx, dword [eax + 0x4c]
mov dword [esi + 0x4c], edx
mov ecx, dword [eax + 0x50]
mov dword [esi + 0x50], ecx
mov edx, dword [eax + 0x54]
mov dword [esi + 0x54], edx
mov ecx, dword [eax + 0x58]
mov dword [esi + 0x58], ecx
mov edx, dword [eax + 0x5c]
mov dword [esi + 0x5c], edx
mov ecx, dword [eax + 0x60]
mov dword [esi + 0x60], ecx
mov edx, dword [eax + 0x64]
mov dword [esi + 0x64], edx
movzx ecx, byte [eax + 0x68]
mov byte [esi + 0x68], cl
mov edx, dword [eax + 0x6c]
mov dword [esi + 0x6c], edx
mov ecx, dword [eax + 0x70]
mov dword [esi + 0x70], ecx
mov edx, dword [eax + 0x74]
mov dword [esi + 0x74], edx
mov ecx, dword [eax + 0x78]
mov dword [esi + 0x78], ecx
mov edx, dword [eax + 0x7c]
mov dword [esi + 0x7c], edx
mov ecx, dword [eax + 0x80]
mov dword [esi + 0x80], ecx
mov edx, dword [eax + 0x84]
mov dword [esi + 0x84], edx
mov ecx, dword [eax + 0x88]
mov dword [esi + 0x88], ecx
mov edx, dword [eax + 0x8c]
mov dword [esi + 0x8c], edx
mov ecx, dword [eax + 0x90]
mov dword [esi + 0x90], ecx
mov edx, dword [eax + 0x94]
mov dword [esi + 0x94], edx
mov ecx, dword [eax + 0x98]
mov dword [esi + 0x98], ecx
mov eax, dword [eax + 0x9c]
sub eax, 0x10
call fcn.10001cb0
add eax, 0x10
mov dword [esi + 0x9c], eax
mov eax, esi
ret
Function at 0x10008170
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x1007ce10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
je 0x100081ce
cmp dword [esi + 0x14], 1
jne 0x100081ce
cmp dword [esi], 0
jne 0x100081b4
push 0x80004003
call fcn.10066a70
mov edi, dword [esi]
mov eax, dword [edi]
mov ecx, dword [eax + 0x3c]
push edi
call ecx
test eax, eax
jge 0x100081ce
push 0x10085edc
push edi
push eax
call fcn.10066a80
mov eax, dword [esi + 0x5cc]
sub eax, 0x10
call fcn.10001cb0
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ebp, 0xffffffff
cmp eax, ebp
jne 0x1000822b
lea eax, [edi - 0x10]
mov dword [esp + 0x20], ebp
lea edx, [eax + 0xc]
lock xadd dword [edx], ebp
dec ebp
test ebp, ebp
jg 0x10008216
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
lea ecx, [esp + 0x10]
push ecx
mov ecx, str.providerMicrosoft.Jet.OLEDB.4.0_Data_Source
call fcn.10001a30
mov byte [esp + 0x20], 1
mov eax, dword [edi - 0xc]
push eax
push edi
lea edx, [esp + 0x18]
push edx
call fcn.10016980
push 0x3e
push str._Jet_OLEDB:Database_Passwordmagic_Persist_Security_InfoFalse
lea eax, [esp + 0x18]
push eax
call fcn.10016980
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, esi
call fcn.10002f30
mov eax, 1
cmp dword [esi + 0x10], eax
jne 0x1000827a
mov dword [esi + 0x14], eax
jmp 0x10008281
mov dword [esi + 0x14], 0
mov esi, dword [esi + 0x14]
mov byte [esp + 0x20], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100082a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x20], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x100082c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x10017410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1007c7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x10097060]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x30], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x34]
test esi, esi
je 0x10017460
mov eax, dword [esi]
jmp 0x10017462
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0xb0]
push edi
call eax
test eax, eax
jge 0x10017483
push 0x10088d34
push edi
push eax
call fcn.10066a80
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebp
call fcn.10067674
add esp, 0x10
test esi, esi
mov word [esp + 0xc], 0
je 0x100174d4
lea edx, [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x100174d4
mov eax, dword [esi]
test eax, eax
je 0x100174bb
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x100174cb
push eax
call fcn.10067257
add esp, 4
push esi
call fcn.10067257
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
Function at 0x10017d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x5976c]
sub esp, 0x24
push ebx
push edi
mov edi, 1
xor ecx, ecx
cmp eax, edi
je 0x10017f5a
mov ebx, dword [ebp + 8]
cmp ebx, ecx
lea eax, [esi + 0xb296c]
je 0x10017d42
mov ecx, ebx
lea edx, [ecx + 2]
mov dword [ebp - 4], edx
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x10017d32
sub ecx, dword [ebp - 4]
sar ecx, 1
push ebx
mov ebx, ecx
call fcn.10002470
mov dword [0x1009a218], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], edi
mov dword [esi + 0x59834], eax
lea edi, [esi + 0x597e8]
lea ebx, [ebp - 8]
mov eax, edi
mov dword [esi + 0x597dc], 4
mov dword [esi + 0x597e4], 0x46
call fcn.100053d0
mov dword [eax], 1
lea ebx, [ebp - 0xc]
mov eax, edi
mov dword [ebp - 0xc], 8
call fcn.100053d0
mov dword [eax], 0
lea ebx, [ebp - 0x10]
mov eax, edi
mov dword [ebp - 0x10], 4
call fcn.100053d0
mov dword [eax], 1
lea ebx, [ebp - 0x14]
mov eax, edi
mov dword [ebp - 0x14], 9
call fcn.100053d0
mov dword [eax], 0
lea ebx, [ebp - 0x18]
mov eax, edi
mov dword [ebp - 0x18], 0xa
call fcn.100053d0
mov dword [eax], 0
lea ebx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0x1c], 5
call fcn.100053d0
xor edi, edi
mov dword [eax], edi
mov dword [esi + 0x59828], edi
mov dword [esi + 0x59838], 1
mov dword [0x1009a1ec], edi
mov dword [0x10099e30], edi
mov dword [ebp - 4], edi
mov eax, dword [0x1009a550]
mov eax, dword [eax]
push eax
mov ecx, dword [0x1009a554]
mov eax, dword [0x1009a558]
call eax
test eax, eax
je 0x10017e38
mov ebx, dword [eax + 8]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jne 0x10017e47
mov dword [0x1009a1e4], 1
call fcn.10063050
mov ecx, dword [ebp + 8]
lea ebx, [esi + 0x18]
push ebx
call fcn.10009280
test eax, eax
jne 0x10017e66
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.1001ea50
push ebx
call fcn.10063500
add esp, 4
cmp eax, edi
je 0x10017e5c
push ebx
call fcn.1004adc0
add esp, 4
cmp eax, edi
mov dword [esi + 0x59774], eax
je 0x10017e5c
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
test eax, eax
je 0x10017e5c
mov ecx, dword [esi + 0x59774]
mov dword [ecx + 0x10], ebx
mov eax, dword [esi + 0x59774]
fld dword [eax + 0x24]
fstp dword [esi + 0xdc]
fld dword [eax + 0x20]
fstp dword [esi + 0xd8]
fld dword [eax + 0x28]
fstp dword [esi + 0xe0]
mov eax, dword [esi + 0x638]
cmp eax, 0xdac
mov dword [0x1009866c], eax
jae 0x10017ee0
mov dword [0x1009866c], 0xdac
xor edx, edx
cmp dword [esi + 0x34], 4
mov eax, esi
sete dl
mov dword [0x10099e28], edx
call fcn.1001c380
push esi
mov dword [esi + 0x59824], eax
call fcn.10019f70
test eax, eax
je 0x10017e5c
mov eax, dword [esi + 0x5c0]
cmp eax, edi
mov ebx, 1
mov dword [0x10099e20], ebx
mov dword [0x10099e24], eax
je 0x10017f2b
call fcn.10066150
jmp 0x10017f30
call fcn.100661d0
push edi
push edi
push esi
push 0x100181e0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x59770], eax
je 0x10017f5a
mov dword [esi + 0x5976c], ebx
mov eax, ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10018c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
cmp dword [edi + 0x55c], 1
push ebx
push esi
je 0x10018ca5
cmp dword [edi + 0x560], 0
je 0x10018cb7
lea esi, [edi + 0x59848]
push esi
call fcn.10021e20
push esi
call fcn.100222d0
mov esi, edi
call fcn.10018730
cmp dword [edi + 0x597dc], 1
jne 0x10018db5
call fcn.10065ba0
test eax, eax
jne 0x10018db5
cmp dword [edi + 0x4c0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x10018d88
push edi
call fcn.1001ed60
mov dword [edi + 0x5982c], eax
call ebx
mov esi, eax
sub esi, dword [edi + 0x59830]
cmp dword [edi + 0x597b0], 0
jne 0x10018d6e
cmp dword [edi + 0x164], 0
je 0x10018d46
mov eax, dword [edi + 0x5982c]
cmp eax, dword [edi + 0x16c]
jae 0x10018d46
mov eax, dword [edi + 0x59774]
call fcn.100040a0
cmp eax, dword [edi + 0x168]
jbe 0x10018d46
cmp esi, dword [edi + 0x170]
jae 0x10018d46
mov ecx, edi
call fcn.10018c60
test eax, eax
je 0x10018d6e
push edi
call fcn.1001ae30
push edi
call fcn.1001b270
push edi
call fcn.10019c90
mov eax, edi
call fcn.10019b20
cmp dword [edi + 0x4bc], 0
jne 0x10018d6e
push edi
call fcn.1001be00
cmp dword [edi + 0x164], 0
je 0x10018d88
cmp dword [edi + 0x5982c], 0
jne 0x10018d88
call ebx
mov dword [edi + 0x59830], eax
call ebx
sub eax, dword [edi + 0x59800]
cmp eax, 0x4e20
jbe 0x10018dcd
cmp dword [edi + 0x597fc], 1
jbe 0x10018dcd
lea esi, [edi + 0x597f4]
call fcn.1001f150
push edi
call fcn.1001ba10
pop esi
pop ebx
pop ecx
ret
cmp dword [edi + 0x4c0], 0
jne 0x10018dcd
call fcn.10065ba0
test eax, eax
jne 0x10018dcd
push edi
call fcn.10019c90
push edi
call fcn.1001ba10
pop esi
pop ebx
pop ecx
ret
Function at 0x10023de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, eax
test esi, esi
je 0x10023e2f
mov eax, 0x10031470
test eax, eax
je 0x10023e2f
mov dword [0x1009a728], 0
mov dword [0x1009a738], esi
mov dword [0x1009a73c], 0x10031470
call fcn.10068285
cdq
mov ecx, 5
idiv ecx
add edx, 0xb
mov dword [0x1009a728], edx
call fcn.10023850
cmp dword [0x1009a72c], 0
jne 0x10023e34
xor eax, eax
pop esi
pop ecx
ret
call fcn.10023920
call fcn.100239b0
test al, al
je 0x10023e2f
mov edx, dword [0x1009a730]
add edx, 5
push edi
push edx
call fcn.10067252
add esp, 4
mov edi, eax
call fcn.10023820
mov ecx, dword [0x1009a730]
cmp eax, ecx
je 0x10023e6c
pop edi
xor eax, eax
pop esi
pop ecx
ret
lea eax, [ecx + esi]
add ecx, edi
sub eax, ecx
mov byte [ecx], 0xe9
sub eax, 5
mov dword [ecx + 1], eax
mov ecx, dword [0x1009a730]
lea eax, [esp + 8]
push eax
push 0x40
add ecx, 5
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.10023ab0
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x100251c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10097060]
xor eax, esp
mov dword [esp + 0x108], eax
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, ecx
test esi, esi
mov dword [esp + 8], esi
je 0x10025323
test ebp, ebp
je 0x10025323
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100251f8
sub eax, edx
push ebx
mov ebx, eax
mov eax, ebp
mov dword [esp + 0x10], ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10025210
sub eax, edx
test ebx, ebx
push edi
mov edi, eax
je 0x10025308
test bl, 1
jne 0x10025308
test edi, edi
je 0x10025308
push 0xff
lea eax, [esp + 0x1d]
push 0
push eax
mov byte [esp + 0x24], cl
call fcn.100696f0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10025254
sub eax, edx
cmp eax, 0x100
jbe 0x1002526d
mov eax, pe_nt_image_headers32
jmp 0x1002527d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10025272
sub eax, edx
push eax
lea ecx, [esp + 0x1c]
push esi
push ecx
call fcn.1006ad10
lea edx, [esp + 0x24]
push edx
call fcn.100250a0
mov esi, dword [esp + 0x24]
add esp, 0x10
xor ebx, ebx
shr esi, 1
je 0x100252bd
mov eax, ebx
xor edx, edx
div edi
mov cl, bl
and cl, 3
add ebx, 1
mov al, byte [edx + ebp]
sar al, cl
not al
xor byte [esp + ebx + 0x17], al
cmp ebx, esi
jb 0x100252a0
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100252c4
sub eax, edx
add eax, 1
cmp eax, 0x100
jbe 0x100252e0
mov eax, pe_nt_image_headers32
jmp 0x100252f5
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100252e7
sub eax, edx
add eax, 1
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.1006ad10
add esp, 0xc
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.100673c5
add esp, 0x10c
ret
mov ecx, dword [esp + 0x110]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.100673c5
add esp, 0x10c
ret