joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45199c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451b47
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451b28
mov dl, 1
mov eax, dword [0x4122d4]
call fcn.00403628
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043e4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x451b17
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043f8dc
test al, al
je 0x451b0a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451b58
lea eax, [ebp - 0x254]
call fcn.00409094
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x451b0a
xor eax, eax
push ebp
push 0x451b03
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x451b90
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x451aec
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404654
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x451aec
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b0a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x451a0d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415db0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451b4e
lea eax, [ebp - 0x260]
call fcn.004043e4
ret

Function at 0x452490
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x458bdc]
cmp byte [eax + 0xa5], 0
jne 0x452501
cmp dword [0x458bf4], 0
jne 0x4524c2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45244c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x458bf4], eax
cmp dword [0x458bf0], 0
jne 0x4524dd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x458bf0], eax
cmp dword [0x458bf8], 0
jne 0x452501
push esp
push 0
push 0
push 0x4523f0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x458bf8], eax
pop edx
ret
Function at 0x452b94
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458bdc]
cmp dword [eax + 0x30], 0
je 0x452c3e
cmp dword [ebx + 0x94], 0
jne 0x452c38
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452b24
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x452c38
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x452bfe
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x452c38
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414220
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452c0d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45379c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4537d1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044d4
jmp 0x4537de
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404438
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x454900
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x454941
mov eax, esi
call fcn.0043af08
test al, al
je 0x454941
mov eax, dword [ebx + 0x84]
call fcn.0043ac04
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x454941
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043ac04
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x100018eb
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10001a9b
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x100019e9
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x1000198c
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x100019cf
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x100019a3
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x100019be
test al, 0x40
je 0x100019b5
mov ecx, dword [edi + 0x20]
jmp 0x100019bc
test al, 0x80
je 0x100019cf
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x100019cf
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x1000195b
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10003ae9
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x40
call fcn.1007759d
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
jmp 0x10003b2d
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
jmp 0x10003b5a
mov dword [ebp - 8], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
cmp dword [ebp - 8], esp
je 0x10003b86
push 0x5c
push 0x40785b9
push 6
call fcn.100775a9
add esp, 0xc
jmp 0x10003ba4
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild qword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fdiv qword [0x100b673b]
fstp qword [ebp - 0x18]
push 0
push 0
push 0
push 0x80000601
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 2
mov ebx, 0x68
call fcn.100789e0
add esp, 0x1c
push 0x80000601
push edx
push eax
push 1
mov ebx, 0x198
call fcn.10077e20
add esp, 0x10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.10003c36
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10003c1c
push ebx
call fcn.10077597
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x10003c24
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.10077597
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x100048df
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
jmp 0x10004900
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x10004961
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x1000494a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x10004939
xor ecx, eax
xor edx, ebx
dec edi
jne 0x1000492a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x10005431
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
jmp 0x10005458
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 4], esp
je 0x10005484
push 0x4e
push 0x40785a8
push 6
call fcn.100775a9
add esp, 0xc
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x8000
mov eax, dword [ebp - 8]
cwde
push 0x80000301
push 0
push eax
push 2
mov ebx, 0xc4
call fcn.10078be0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
jmp 0x100054c5
mov esp, ebp
pop ebp
ret 4
Function at 0x10006f5c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
jmp 0x10006f8a
jmp 0x10006fa8
push 0x80000301
push 0
push 1
push 0x80000002
push 0
push 0
push 0x80000004
push 0
push str.taskkill__im_explorer.exe__f
push 3
mov ebx, 0x2c0
call fcn.10078ed0
add esp, 0x28
jmp 0x10006ffc
mov dword [ebp - 8], esp
push 0x258
xor eax, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000702a
push 0xa7
push 0x40785a7
push 6
call fcn.100775a9
add esp, 0xc
jmp 0x10007048
jmp 0x10007066
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.10078a80
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000709b
push ebx
call fcn.10077597
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x100070bd
lea eax, [ebp - 4]
push eax
call fcn.10007228
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 1
push 0
push 0x24
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10007109
push 0x1bd
push 0x40785a7
push 6
call fcn.100775a9
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000716c
jmp 0x10007134
mov eax, str.C:WINDOWS
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000714a
push ebx
call fcn.10077597
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x1000716c
jmp 0x1000718a
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.10078fc0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push str.explorer.exe
push str.Open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100071ee
push 0x2b2
push 0x40785a7
push 6
call fcn.100775a9
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10007201
push ebx
call fcn.10077597
add esp, 4
cmp dword [ebp - 0x10], 2
mov eax, 0
setne al
jmp 0x10007212
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007223
push ebx
call fcn.10077597
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a5a5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x1000a5da
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [0x100f5181]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a606
push 0x31
push 0x40785c9
push 6
call fcn.100775a9
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x1000a627
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.10078a80
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000a65a
push ebx
call fcn.10077597
add esp, 4
pop eax
mov dword [ebp - 8], eax
jmp 0x1000a67c
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x100b6731]
fstp qword [ebp - 0x18]
mov dword [ebp - 0x1c], esp
fld qword [ebp - 0x18]
call fcn.100020b3
push eax
push dword [ebp - 8]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1000a6c6
push 0xd0
push 0x40785c9
push 6
call fcn.100775a9
add esp, 0xc
jmp 0x1000a6e4
mov eax, dword [ebp - 8]
test eax, eax
je 0x1000a700
push eax
mov ebx, eax
call fcn.100022be
inc eax
push eax
call fcn.1007759d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1000a705
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000a716
push ebx
call fcn.10077597
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x1003ca1b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0
je 0x1003ca42
mov eax, dword [0x100f4c5d]
mov dword [ebp - 4], eax
jmp 0x1003ca4a
mov eax, dword [0x100f4c59]
mov dword [ebp - 4], eax
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fild dword [ebp + 0x10]
fstp qword [ebp - 0x14]
fadd qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fild dword [ebp + 0x14]
fstp qword [ebp - 0x2c]
fadd qword [ebp - 0x2c]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
call fcn.100020b3
push eax
fld qword [ebp - 0x1c]
call fcn.100020b3
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1003cc64
test eax, eax
je 0x1003cbcf
cmp dword [ebp + 0x1c], 0
jne 0x1003cae5
push 1
push 0xf
push 1
push 0x40400000
push dword [0x100f4c61]
fild dword [ebp + 0x14]
fstp dword [ebp - 8]
push dword [ebp - 8]
fild dword [ebp + 0x10]
fstp dword [ebp - 0xc]
push dword [ebp - 0xc]
fild dword [ebp + 0xc]
fstp dword [ebp - 0x10]
push dword [ebp - 0x10]
fild dword [ebp + 8]
fstp dword [ebp - 0x14]
push dword [ebp - 0x14]
call fcn.1003beec
jmp 0x1003cb22
push 1
push 0xf
push 1
push 0x40400000
push dword [0x100f4c5d]
fild dword [ebp + 0x14]
fstp dword [ebp - 8]
push dword [ebp - 8]
fild dword [ebp + 0x10]
fstp dword [ebp - 0xc]
push dword [ebp - 0xc]
fild dword [ebp + 0xc]
fstp dword [ebp - 0x10]
push dword [ebp - 0x10]
fild dword [ebp + 8]
fstp dword [ebp - 0x14]
push dword [ebp - 0x14]
call fcn.1003beec
push 1
call fcn.10005431
test eax, eax
je 0x1003cbca
cmp dword [0x100f4efd], 0
jne 0x1003cb62
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100f4efd], eax
mov eax, 1
jmp 0x1003cc5e
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fild dword [0x100f4efd]
fstp qword [ebp - 0x18]
fsub qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x100b680a]
fcomp qword [0x100b7d3f]
fnstsw ax
test ah, 0x41
jne 0x1003cbca
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100f4efd], eax
mov eax, 1
jmp 0x1003cc5e
jmp 0x1003cc09
push 1
push 0xf
push 1
push 0x40400000
push dword [ebp - 4]
fild dword [ebp + 0x14]
fstp dword [ebp - 8]
push dword [ebp - 8]
fild dword [ebp + 0x10]
fstp dword [ebp - 0xc]
push dword [ebp - 0xc]
fild dword [ebp + 0xc]
fstp dword [ebp - 0x10]
push dword [ebp - 0x10]
fild dword [ebp + 8]
fstp dword [ebp - 0x14]
push dword [ebp - 0x14]
call fcn.1003beec
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x100b69b9]
fstp qword [ebp - 0x14]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x100b6731]
fstp qword [ebp - 0x24]
push 1
push 0x41800000
push dword [0x100f4c51]
push dword [ebp + 0x18]
fld qword [ebp - 0x24]
fstp dword [ebp - 0x28]
push dword [ebp - 0x28]
fld qword [ebp - 0x14]
fstp dword [ebp - 0x2c]
push dword [ebp - 0x2c]
call fcn.1003c860
mov eax, 0
jmp 0x1003cc5e
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10061d05
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
jmp 0x10061d2c
mov dword [ebp - 4], esp
push 1
push 0x100b651c
push 0x100b651c
mov ebx, dword [ebp + 8]
push dword [ebx]
push str.open
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 4], esp
je 0x10061d73
push 0x18
push 0x40785b6
push 6
call fcn.100775a9
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x10062e41
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
fild dword [0x100f5089]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fild dword [ebp + 8]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.100020b3
mov dword [ebp + 8], eax
fild dword [0x100f508d]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x10]
fadd qword [ebp - 0x10]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.100020b3
mov dword [ebp + 0xc], eax
mov ebx, dword [ebp + 0x10]
cmp dword [ebx], 0x2d7
jne 0x10062ea9
call fcn.10062ffc
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
fild dword [ebp + 0xc]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [0x100b6743]
fstp qword [ebp - 0x10]
push 1
push 0xf
push 1
push 0x40400000
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x41600000
push 0x41600000
fld qword [ebp - 0x10]
fstp dword [ebp - 0x14]
push dword [ebp - 0x14]
fild dword [ebp + 8]
fstp dword [ebp - 0x18]
push dword [ebp - 0x18]
call fcn.1003beec
push 1
call fcn.10005431
test eax, eax
je 0x10062ff6
fild dword [ebp + 0xc]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fadd qword [0x100b6743]
fstp qword [ebp - 0x10]
fild dword [ebp + 8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x100b6729]
fstp qword [ebp - 0x20]
fild dword [ebp + 0xc]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fadd qword [0x100b6729]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.100020b3
push eax
fld qword [ebp - 0x20]
call fcn.100020b3
push eax
fld qword [ebp - 0x10]
call fcn.100020b3
push eax
push dword [ebp + 8]
call fcn.1003cc64
test eax, eax
je 0x10062ff6
cmp dword [0x100f50b5], 0
jne 0x10062f8f
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x2d7
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100f50b5], eax
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fild dword [0x100f50b5]
fstp qword [ebp - 0x14]
fsub qword [ebp - 0x14]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fsub qword [0x100be693]
fcomp qword [0x100b7d3f]
fnstsw ax
test ah, 0x41
jne 0x10062ff6
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0x2d7
push 0
mov ebx, 0x308
call sub.KERNEL32.dll_GetTickCount
add esp, 4
mov dword [0x100f50b5], eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100763f7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.100765a7
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x100764f5
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10076498
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x100764db
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x100764af
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x100764ca
test al, 0x40
je 0x100764c1
mov ecx, dword [edi + 0x20]
jmp 0x100764c8
test al, 0x80
je 0x100764db
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x100764db
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10076467
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x10078190
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.1007c0c5
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x100781fa
push esi
lea edi, [eax + 0x400]
call fcn.1007c0ba
push edi
call fcn.1007c0c5
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x100781ca
push esi
xor edi, edi
call dword [0x100f5820]
add esp, 4
test eax, eax
je 0x10078216
push eax
push esi
call fcn.1007aad0
add esp, 8
mov edi, eax
push esi
call fcn.1007c0ba
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10078f43
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10078f11.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10078f11.2
jmp dword [eax*4 + 0x10078f9c]
mov word [esp + 0x48], di
jmp 0x10078f4a
mov word [esp + 0x48], 2
jmp 0x10078f4a
mov word [esp + 0x48], 3
jmp 0x10078f4a
mov word [esp + 0x48], 4
jmp 0x10078f4a
mov word [esp + 0x48], 7
jmp 0x10078f4a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x10078f94
cmp dword [esp + 0x70], edi
je 0x10078f80
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x10079770
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x100797d9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.10077a00
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret