joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ba30
Capabilities:
Parse pe header

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 1
jb 0x1002badc
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
sub esi, edx
lea esp, [esp]
mov al, byte [edx]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x1002ba5d
jmp dword [ecx*4 + 0x1002bae0]
mov al, 0x41
jmp case.default.0x1002ba5d
mov al, 0x42
jmp case.default.0x1002ba5d
mov al, 0x43
jmp case.default.0x1002ba5d
mov al, 0x44
jmp case.default.0x1002ba5d
mov al, 0x45
jmp case.default.0x1002ba5d
mov al, 0x46
jmp case.default.0x1002ba5d
mov al, 0x47
jmp case.default.0x1002ba5d
mov al, 0x48
jmp case.default.0x1002ba5d
mov al, 0x49
jmp case.default.0x1002ba5d
mov al, 0x4a
jmp case.default.0x1002ba5d
mov al, 0x4b
jmp case.default.0x1002ba5d
mov al, 0x4c
jmp case.default.0x1002ba5d
mov al, 0x4d
jmp case.default.0x1002ba5d
mov al, 0x4e
jmp case.default.0x1002ba5d
mov al, 0x4f
jmp case.default.0x1002ba5d
mov al, 0x50
jmp case.default.0x1002ba5d
mov al, 0x51
jmp case.default.0x1002ba5d
mov al, 0x52
jmp case.default.0x1002ba5d
mov al, 0x53
jmp case.default.0x1002ba5d
mov al, 0x54
jmp case.default.0x1002ba5d
mov al, 0x55
jmp case.default.0x1002ba5d
mov al, 0x56
jmp case.default.0x1002ba5d
mov al, 0x57
jmp case.default.0x1002ba5d
mov al, 0x58
jmp case.default.0x1002ba5d
mov al, 0x59
jmp case.default.0x1002ba5d
mov al, 0x5a
mov byte [esi + edx], al
mov al, byte [edx]
inc edx
test al, al
je 0x1002badb
dec edi
jne 0x1002ba50
pop esi
pop edi
ret

Function at 0x1002bb50
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x10074020]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call sub.MSVCR120.dll_getenv
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x1002bbb5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x1002bbb5
lea edx, [esp]
push edx
call dword [0x10074010]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10060d08
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.10060d08
add esp, 0x108
ret
Function at 0x10030690
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x100306a9
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.1000e120
push edx
push eax
call fcn.1000e150
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x100306f6
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.1000e120
push edx
push eax
call fcn.1000e150
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x100306f8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10032b20
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x10032b52
push 0x2e
push esi
call sub.ntdll.dll_strchr
add esp, 8
test eax, eax
je 0x10032b50
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x10032e50
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x24
mov eax, dword [0x10074020]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
mov ebp, dword [esp + 0x30]
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10032ef7
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea esi, [esp + 0x20]
mov eax, ebp
mov word [esp + 0x14], 0x208
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.10032dc0
mov ecx, esi
push 8
push ecx
call fcn.10037090
mov ecx, dword [esp + 0x10]
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0x14
lea eax, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x10032f09
mov edx, dword [esp + 4]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10060d08
add esp, 0x24
ret
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 8]
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push 0
push 0
mov dword [edi + 4], edx
mov edx, dword [esp + 0x20]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x24]
pop ebp
xor ecx, esp
mov eax, 1
call fcn.10060d08
add esp, 0x24
ret
Function at 0x10033080
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov eax, ebp
push edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10033090
sub eax, edx
mov edi, eax
lea ebx, [edi + edi]
push ebx
call dword [0x10074004]
mov esi, eax
add esp, 4
test esi, esi
jne 0x100330b9
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
test edi, edi
je 0x100330d0
nop
mov cl, byte [eax + ebp]
mov byte [esi + eax*2], cl
mov byte [esi + eax*2 + 1], 0
inc eax
cmp eax, edi
jb 0x100330c0
push 0xf0000000
push 1
push 0
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov edi, dword [esp + 0x28]
test eax, eax
je 0x1003314f
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x8002
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10033142
mov edx, dword [esp + 0x10]
push 0
push ebx
push esi
push edx
mov dword [esp + 0x28], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push 2
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov dword [edi + 0x10], eax
push esi
mov byte [edi + 0x14], al
call dword [0x10074008]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x100335a0
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100335d6
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x8003
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push esi
mov esi, dword [esp + 0x18]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100335e0
sub eax, edx
push eax
call fcn.10029480
add esp, 4
push 0
push eax
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 2
push edx
mov dword [esp + 0x18], 0
call esi
cmp dword [esp + 4], 0x10
jne 0x1003363d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push eax
push ecx
push 2
push edx
call esi
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x1003364d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x1003365e
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret
Function at 0x10035630
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x10035652
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x10035646
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x10035682
cmp dword [esi + 8], 0
jne 0x10035675
mov ecx, dword [eax + 8]
push 0x1006f518
push ecx
call sub.MSVCR120.dll_fopen
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x10035675
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call sub.MSVCR120.dll_fread
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100356a4
mov eax, dword [esi + 8]
test eax, eax
je 0x1003569e
push eax
call sub.MSVCR120.dll_fclose
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x10036f10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x10074004]
mov edi, eax
add esp, 4
test edi, edi
jne 0x10036f35
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x10036f7c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x10036f80
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x10036fdc
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x10036fa3
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x10037018
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x1006f8bf
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x1006f8c0
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x10036fe7
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x10039bc0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061e28
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
jmp fcn.1015cbc5

Function at 0x10039f50
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061e58
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
jmp fcn.1015ff23

Function at 0x1003a1f0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061e88
mov eax, dword fs:[0]
push eax
sub esp, 0xc4
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x74], ecx
jmp fcn.1016211b
Function at 0x1003a4b0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jmp fcn.10162e00

Function at 0x1003a590
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jmp fcn.10163737

Function at 0x1003a690
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061ed8
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x70], ecx
mov dword [ebp - 4], 0
jmp fcn.1016620b

Function at 0x1003a930
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x324], 0
jne 0x1003a972
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x320], 0
jne 0x1003a972
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x31c], 0
jne 0x1003a972
mov ecx, dword [ebp - 0x20]
call fcn.10039bc0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x324], 0
je 0x1003ab94
mov byte [ebp - 0x27], 0xc3
lea ecx, [ebp - 0x27]
mov dword [ebp - 0x64], ecx
lea edx, [ebp - 0x26]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x324]
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x234
mov dword [ebp - 0x18], ecx
jmp 0x1016762b
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x320], 0
je 0x1003adb7
mov byte [ebp - 0x25], 0xc3
lea edx, [ebp - 0x25]
mov dword [ebp - 0x70], edx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x320]
add ecx, 2
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x14c
mov dword [ebp - 0x14], edx
jmp 0x10168a72
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x31c], 0
je 0x1003afd7
mov byte [ebp - 0x29], 0xc3
lea eax, [ebp - 0x29]
mov dword [ebp - 0x7c], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x78], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x31c]
add edx, 2
mov dword [ebp - 0x80], edx
mov eax, dword [ebp - 0x20]
add eax, 0x64
mov dword [ebp - 0x1c], eax
jmp 0x10169f88
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10060d08
mov esp, ebp
pop ebp
ret
Function at 0x1003ca60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x4000
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR120.dll_malloc]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1003ca8e
xor eax, eax
jmp 0x1003cae8
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x10
call sub.ntdll.dll_ZwQuerySystemInformation
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc0000004
jne 0x1003cadc
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR120.dll_free]
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
add eax, 0x4000
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0xc0000004
je 0x1003ca74
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100411e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
jmp fcn.1016fd34
Function at 0x10046350
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062967
mov eax, dword fs:[0]
push eax
sub esp, 0x1e8
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xb8], eax
mov ecx, dword [ebp - 0xb8]
call fcn.1003e8b0
mov ecx, dword [ebp - 0xb8]
mov dword [ecx + 0x18], str.111111111111
mov edx, dword [ebp - 0xb8]
mov byte [edx + 0x1c], 0
mov eax, dword [ebp - 0xb8]
mov dword [eax + 0x20], 0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x5c]
add ecx, 0x24
mov dword [ebp - 0xc4], ecx
mov ecx, dword [ebp - 0xc4]
call fcn.1003e8b0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0x18], str.111111111111
mov eax, dword [ebp - 0xc4]
mov byte [eax + 0x1c], 0
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0x20], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x5c]
add edx, 0x48
mov dword [ebp - 0xa4], edx
mov ecx, dword [ebp - 0xa4]
call fcn.1003e8b0
mov eax, dword [ebp - 0xa4]
mov dword [eax + 0x18], str.111111111111
mov ecx, dword [ebp - 0xa4]
mov byte [ecx + 0x1c], 0
mov edx, dword [ebp - 0xa4]
mov dword [edx + 0x20], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x5c]
mov dword [eax + 0x6c], 0
jmp fcn.101a3ec3

Function at 0x10047090
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062ac8
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2a8], ecx
mov dword [ebp - 0x288], 0
mov dword [ebp - 4], 2
jmp fcn.101a8d8f

Function at 0x100474a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062be5
mov eax, dword fs:[0]
push eax
sub esp, 0x1b4
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe4], ecx
jmp fcn.101b27d7
Function at 0x1004ad50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10074020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 1
jmp 0x1004ad78
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfe
jge 0x1004adb5
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [ebp - 0x1c], ax
movsx edx, word [ebp - 0x1c]
test edx, edx
je 0x1004ada1
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov byte [eax + 0xc], 1
movsx ecx, word [ebp - 0x1c]
test ecx, ecx
jne 0x1004adb3
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x18]
mov byte [edx + 0xc], 0
jmp 0x1004ad6f
mov dword [ebp - 0x20], 1
jmp 0x1004adc7
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfe
jge 0x1004ae66
mov ecx, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.1004ac90
mov byte [ebp - 0x11], al
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x1004ae61
mov dword [ebp - 0x10], 0
jmp 0x1004adfd
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [edx + 4]
sub ecx, dword [eax]
sar ecx, 2
cmp dword [ebp - 0x10], ecx
jae 0x1004ae61
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x20]
jne 0x1004ae5f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*4]
cmp dword [ecx], 0
je 0x1004ae5f
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edx + eax*4]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
pushal
call dword [ebp - 8]
popal
jmp 0x1004adf4
jmp 0x1004adbe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10060d08
mov esp, ebp
pop ebp
ret
Function at 0x1004b2c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063180
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10074020]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0x10066ae8
lea ecx, [ebp - 0x30]
push ecx
call fcn.10047fd0
add esp, 0xc
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp + 8]
call fcn.1003ebd0
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10038f80
cmp dword [ebp + 0x1c], 0x10
jb 0x1004b330
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
jmp 0x1004b336
lea edx, [ebp + 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.1004b9f0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp + 8]
call fcn.10038f80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1004fc30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
movzx edx, byte [ecx]
test edx, edx
jne 0x1004fc6e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov byte [ecx], 1
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.MSVCR120.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov esp, ebp
pop ebp
ret 4

Function at 0x10052225
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x2c]
call fcn.1003bcd0
stc
pushfd
cmc
add esp, 0x10
jmp 0x1008251e

Function at 0x100523ae
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edx
lea esp, [esp + 0xc]
call fcn.10058810
dec cx
rol dh, 2
xor dl, 0xb1
mov dword [ebp - 0x30], eax
shr al, cl
mov byte [ebp - 0x24], 0xeb
aad 0x19
lea ecx, [ebp - 0x24]
das
mov dword [ebp - 0x48], ecx
rol ch, cl
lea edx, [ebp - 0x23]
btr eax, ecx
clc
mov dword [ebp - 0x44], edx
rdtsc
pushal
bt cx, ax
and al, ah
mov eax, dword [ebp - 0x30]
shrd edx, eax, cl
setge cl
mov dword [ebp - 0x10], eax
xor dx, 0x5e07
xor cx, 0xba7f
mov ecx, dword [ebp - 0x10]
bswap dx
mov dword [ebp - 0x98], ecx
daa
lahf
or ax, 0xe1fa
bswap dx
mov edx, dword [ebp - 0x44]
sbb al, 0xec
sub ah, ah
sbb al, dl
test edx, edi
sub edx, dword [ebp - 0x48]
lahf
mov dword [ebp - 0xa8], edx
jmp loc.10077356

Function at 0x1005419a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], cx
test eax, eax
jmp loc.1007a317

Function at 0x10054875
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
je 0x10095cb6
movzx dx, cl
call fcn.100a810f
lea ecx, [edi*2 - 0x38315045]
movsx ax, al
lea ecx, [edx*8 + 0x293890d1]
push 4
xchg ch, al
lea eax, [ebp - 0x60]
push 0xece7214a
not ch
mov byte [esp], 0x7a
call fcn.1007962b