joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bb30
Capabilities:
Create thread

Disassembly:
push ecx
mov edx, 0x10040558
mov ecx, 0x1015d3e0
jmp 0x1000bb40
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000bb60
test al, al
je 0x1000bb5c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000bb60
add ecx, 2
add edx, 2
test al, al
jne 0x1000bb40
xor eax, eax
jmp 0x1000bb65
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000bb6e
call fcn.1000b9c0
push 0
push 0
push 0
push 0x1000b300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1015d47c], 1
jne 0x1000bba6
push 0x10040eec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push str.PluginRG.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop ecx
ret

Function at 0x1000c42f
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov ecx, dword [ebp - 6]
mov dword [esp + 4], 0xd8979c10
mov dword [esp], edx
neg ax
xor ecx, ebx
neg word [esp + 2]
neg eax
jb 0x103f0e78
movsx edx, cx
bswap eax
rol word [esp + edx - 0x654], 0x44
xor ebx, eax
shl ecx, cl
jns 0x102458f8
sub dword [esp + eax - 0x70663d1e], 0x11affe98
inc ecx
neg edx
jne 0x1029703c
bswap ecx
neg eax
neg ecx
xor ebx, ecx
inc dl
neg dx
and edx, 0xb78e578e
mov dword [esi + edx - 0x158e040e], ecx
xadd word [esp + edx - 0x158e03fe], dx
lea esi, [esi + edx*4 - 0x563b621e]
sal byte [esp + edx*2 - 0x2b1db105], 0xa1
mov ecx, dword [ebp + edx*4 - 0x563b621e]
xor al, 0xa9
sbb word [esp + edx*2 - 0x2b1db108], ax
xor dx, word [esp + edx*2 - 0x2b1db10a]
lea ebp, [ebp + edx*2 - 0x2b1db9d0]
xor ecx, ebx
xor ecx, 0xce072599
inc edx
not ecx
sal word [esp + edx - 0x158edce4], 0xce
sub dword [esp + edx - 0x158edce0], edx
shl byte [esp + edx*2 - 0x2b1db9c5], 0x23
lea ecx, [eax + ecx - 0x2578f2cc]
not al
ror ecx, 1
sal dword [esp + edx*2 - 0x2b1db9c4], 0xf8
push edx
sub ax, word [esp + edx - 0x158edce2]
xor ecx, 0xe7ae728a
call fcn.102998c5
inc ecx
not ecx
jmp 0x1016cf3b
Function at 0x1000c850
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll__beginthreadex]
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x1000c4f0
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push 0x1000bdc0
push ebx
push ebx
mov dword [0x1015e6f8], eax
call edi
push ebx
push ebx
push ebx
push 0x1000b0f0
push ebx
push ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x48
push ebx
push ebx
push ebx
push 0x100061d0
push ebx
push ebx
mov dword [0x1015ec50], 0x1004107c
mov byte [0x1015e497], bl
mov byte [0x1015ec54], bl
mov word [0x1015ec38], bx
mov word [0x1015ec3b], bx
mov byte [0x1015ec3d], bl
mov word [0x1015ec56], bx
mov byte [0x1015e700], bl
call esi
mov ebx, 0x101583a0
call fcn.10014e90
test al, al
jne 0x1000c90a
push 0x10051468
call fcn.10027f00
add esp, 4
mov dword [0x1015e86c], 0
call fcn.10009910
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10028da0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push eax
push 8
call ebx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000c95a
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push 0x14
push eax
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000c95a
cmp dword [esp + 0x14], 0
setne al
test al, al
jne 0x1000c95f
call fcn.100272e0
call fcn.1000bb30
call fcn.1000c500
cmp byte [0x1015e700], 0
je 0x1000c98f
mov eax, dword [0x1015ec64]
push 0
push 0x24
push 0x1015e874
push eax
mov dword [0x10160844], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [0x1015d470], 1
jne 0x1000c9a9
push 0
push 0
push 0
push 0x1001caa0
push 0
push 0
call esi
push 0
push 0
push 0
push 0x1000f040
push 0
push 0
call esi
call fcn.10004d10
push 0
push 0
push 0
push 0x100048e0
push 0
push 0
call esi
call fcn.10014fd0
test al, al
jne 0x1000c9eb
push 0x10051568
call fcn.10027f00
add esp, 4
call fcn.10027eb0
call fcn.10015350
test al, al
je 0x1000c8fe
push 0
push 0
push 0
push 0x1000b8b0
push 0
push 0
call esi
push 0x1000c340
push 0x9c40
push 0
push 0
mov dword [0x1015e5e8], eax
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.1000bbb0
call fcn.1000d840
call fcn.10009ed0
push 0
push 0
push 0
push 0x1000b4e0
push 0
push 0
call edi
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d840
Capabilities:
Create thread

Disassembly:
cmp dword [0x1015d480], 0
je 0x1000d890
mov eax, dword [0x1015e6fc]
push 0x10160c00
mov dword [0x101534d0], eax
xor eax, eax
push eax
push 0x101534cc
push 0x1000d960
push eax
push eax
mov dword [0x1016083c], 5
mov dword [0x101534d8], eax
mov dword [0x101534dc], eax
mov dword [0x101534e0], eax
mov dword [0x101534e4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x101534d4], eax
ret

Function at 0x1000d8a0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
cmp dword [0x10160840], 0
push edi
je 0x1000d8ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10160840]
cmp eax, dword [ecx]
jne case.0x1000d8ee.0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi*4 + 0x101534d8]
cmp eax, 0x1388
jb 0x1000d8e4
call edi
mov dword [esi*4 + 0x101534d8], eax
mov dword [esi*4 + 0x101534e0], 0
mov eax, dword [0x1016083c]
cmp eax, 5
ja case.0x1000d8ee.0
jmp dword [eax*4 + 0x1000d940]
inc dword [esi*4 + 0x101534e0]
pop edi
ret
inc dword [esi*4 + 0x101534e0]
cmp dword [esi*4 + 0x101534e0], 5
jbe case.0x1000d8ee.0
call fcn.100121e0
mov dword [0x1015e85c], 0x10040fac
mov dword [0x1015e858], 0x10041274
call fcn.1000d2a0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
jmp fcn.10009910

Function at 0x1000d8fe
Capabilities:
Terminate process

Disassembly:
cmp dword [0x10160840], 0
push edi
je 0x1000d8ba
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10160840]
cmp eax, dword [ecx]
jne case.0x1000d8ee.0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi*4 + 0x101534d8]
cmp eax, 0x1388
jb 0x1000d8e4
call edi
mov dword [esi*4 + 0x101534d8], eax
mov dword [esi*4 + 0x101534e0], 0
mov eax, dword [0x1016083c]
cmp eax, 5
ja case.0x1000d8ee.0
jmp dword [eax*4 + 0x1000d940]
inc dword [esi*4 + 0x101534e0]
pop edi
ret
inc dword [esi*4 + 0x101534e0]
cmp dword [esi*4 + 0x101534e0], 5
jbe case.0x1000d8ee.0
call fcn.100121e0
mov dword [0x1015e85c], 0x10040fac
mov dword [0x1015e858], 0x10041274
call fcn.1000d2a0
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
jmp fcn.10009910

Function at 0x1000db00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000db73
lea ecx, [ebp - 8]
push ecx
push 0x101534ec
lea edx, [ebp - 0xc]
push edx
push eax
mov eax, dword [ebp - 4]
push str.LangSelection
push eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000db69
push 0x100412a0
push 0x10
push 0x101534ec
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10014e90
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea esi, [ebp - 0x408]
call fcn.10009110
lea eax, [ebp - 0x408]
push eax
lea esi, [ebx + 0x51b0]
mov eax, str..Xor_PlusSettings_tga.ozn
call fcn.10009250
test al, al
je 0x10014f03
push 0
push 0x20
push 3
push 0
push 1
push connect
push str..Xor_PlusSettings_tga.ozn
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10014f03
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x5104
je 0x10014f15
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x40c]
push ecx
push 0x5104
lea esi, [ebx + 4]
push esi
push edi
mov dword [ebp - 0x40c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10014efc
mov eax, esi
mov ecx, 0x5104
mov dl, byte [eax]
sub dl, 0xb
xor dl, 0x7d
mov byte [eax], dl
inc eax
dec ecx
jne 0x10014f43
call fcn.1000db00
lea eax, [ebx + 0x70]
call fcn.1000db80
lea eax, [ebx + 0x1a38]
call fcn.1000dbe0
lea eax, [ebx + 0x3400]
call fcn.1000dc40
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10021ef0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
lea ecx, [esi + 0x9c4]
mov edi, 0xe3
lea esp, [esp]
mov eax, dword [ecx + 4]
xor eax, dword [ecx]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx + 0x634]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x10021f00
lea ecx, [esi + 0xd50]
mov edi, 0x18c
nop
mov eax, dword [ecx]
xor eax, dword [ecx + 4]
and eax, 0x7fffffff
xor eax, dword [ecx]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [ecx - 0xd4c]
shr eax, 1
xor edx, eax
mov dword [ecx - 0x9c0], edx
add ecx, 4
dec edi
jne 0x10021f40
mov eax, dword [esi + 0x1380]
xor eax, dword [esi + 4]
and eax, 0x7fffffff
xor eax, dword [esi + 0x1380]
mov ecx, eax
and cl, 1
movzx edx, cl
neg edx
sbb edx, edx
and edx, 0x9908b0df
xor edx, dword [esi + 0x634]
shr eax, 1
xor edx, eax
mov dword [esi + 0x9c0], edx
mov dword [esi], edi
pop edi
ret

Function at 0x10021fb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
push esi
add eax, 0x638
mov edx, 0x68
push edi
lea ecx, [ecx]
mov esi, dword [eax - 0x630]
mov ecx, dword [eax - 0x634]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, dword [eax - 0x634]
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, ecx
xor edi, dword [eax]
mov dword [eax + 0x38c], edi
mov edi, dword [eax - 0x62c]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 4]
xor esi, ecx
mov dword [eax + 0x390], esi
mov esi, dword [eax - 0x628]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
shr ecx, 1
and edi, 0x9908b0df
xor edi, dword [eax + 8]
xor edi, ecx
mov dword [eax + 0x394], edi
mov edi, dword [eax - 0x624]
mov ecx, edi
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
shr ecx, 1
and esi, 0x9908b0df
xor esi, dword [eax + 0xc]
xor esi, ecx
mov dword [eax + 0x398], esi
mov esi, dword [eax - 0x620]
mov ecx, esi
xor ecx, edi
and ecx, 0x7fffffff
xor ecx, edi
mov ebx, ecx
and bl, 1
movzx edi, bl
neg edi
sbb edi, edi
and edi, 0x9908b0df
xor edi, dword [eax + 0x10]
shr ecx, 1
xor edi, ecx
mov ecx, dword [eax - 0x61c]
xor ecx, esi
and ecx, 0x7fffffff
xor ecx, esi
mov ebx, ecx
mov dword [eax + 0x39c], edi
and bl, 1
movzx esi, bl
neg esi
sbb esi, esi
and esi, 0x9908b0df
xor esi, dword [eax + 0x14]
shr ecx, 1
xor esi, ecx
mov dword [eax + 0x3a0], esi
add eax, 0x18
dec edx
jne 0x10021fc0
pop edi
pop esi
pop ebx
ret
Function at 0x10027f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x100
push 0
push 0x10160cb0
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp + 8]
add esp, 0xc
xor eax, eax
sub ecx, 0x10160cb0
mov dl, byte [ecx + eax + 0x10160cb0]
sub dl, 0x1b
xor dl, 0xc
mov byte [eax + 0x10160cb0], dl
inc eax
cmp eax, 0x100
jl 0x10027f22
mov eax, 0x10160cb0
pop ebp
ret
Function at 0x100288d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035fbd
mov eax, dword fs:[0]
push eax
mov eax, 0x123c
call fcn.100350f0
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
push eax
push 0
mov dword [ebp - 4], 0
push 0x410
mov dword [ebp - 0x244], 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
mov dword [ebp - 0x238], edi
test edi, edi
je 0x10028a5a
lea eax, [ebp - 0x240]
push eax
push 0x1000
lea ecx, [ebp - 0x1248]
push ecx
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x10028a53
mov eax, dword [ebp - 0x240]
shr eax, 2
xor edi, edi
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x10028a4d
jmp 0x100289a0
mov eax, dword [ebp + edi*4 - 0x1248]
mov ecx, dword [ebp - 0x238]
push 0x104
lea edx, [ebp - 0x218]
push edx
push eax
push ecx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x10028a40
xor edx, edx
lea eax, [ebp - 0x218]
mov word [ebp - 0x234], dx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
lea edx, [eax + 2]
jmp 0x100289f0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100289f0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x234]
call fcn.10013a00
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
call fcn.10031fb0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
jb 0x10028a40
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
inc edi
cmp edi, dword [ebp - 0x23c]
jb 0x100289a0
mov edi, dword [ebp - 0x238]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10028bc0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003605b
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.100350f0
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1030]
push eax
push 0x1000
lea ecx, [ebp - 0x1010]
push ecx
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x10028cf8
mov eax, dword [ebp - 0x1030]
shr eax, 2
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1014], edi
cmp eax, ebx
jbe 0x10028cf8
jmp 0x10028c40
mov eax, dword [ebp + edi*4 - 0x1010]
push eax
lea ecx, [ebp - 0x1028]
mov dword [ebp - 0x1018], eax
call fcn.100288d0
add esp, 4
lea edx, [ebp - 0x1028]
push edx
push ecx
lea ecx, [ebp - 0x1018]
mov dword [ebp - 4], ebx
call fcn.10031cb0
add esp, 4
call fcn.10031e30
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1028]
cmp esi, ebx
je 0x10028cd3
mov edi, dword [ebp - 0x1024]
cmp esi, edi
je 0x10028cc3
cmp dword [esi + 0x14], 8
jb 0x10028ca7
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], cx
add esi, 0x1c
cmp esi, edi
jne 0x10028c95
mov esi, dword [ebp - 0x1028]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, dword [ebp - 0x1014]
add esp, 4
inc edi
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x1024], ebx
mov dword [ebp - 0x1020], ebx
mov dword [ebp - 0x1014], edi
cmp edi, dword [ebp - 0x102c]
jb 0x10028c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x1002e8e0
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10037d80
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x1004b034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x4c]
push ecx
xor ebx, ebx
push 1
push ebx
push ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x58], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsA]
test eax, eax
je 0x1002ea7c
mov dword [ebp - 0x60], ebx
cmp dword [ebp - 0x50], ebx
jbe 0x1002e9b4
xor esi, esi
lea ebx, [ebx]
mov ecx, dword [ebp - 0x4c]
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x68], ebx
mov edx, dword [esi + ecx]
push 8
push edx
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1002e9a5
mov eax, dword [ebp - 0x54]
mov edi, dword [eax]
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
push ecx
lea edx, [ebp - 0x5c]
push edx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x64], ebx
mov ecx, dword [esi + eax]
push 5
push ecx
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationA]
test eax, eax
je 0x1002e99b
cmp edi, 1
jne 0x1002e991
inc dword [ebp - 0x58]
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x54]
push eax
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, dword [ebp - 0x60]
inc eax
add esi, 0xc
mov dword [ebp - 0x60], eax
cmp eax, dword [ebp - 0x50]
jb 0x1002e940
mov ecx, dword [ebp - 0x4c]
push ecx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
cmp dword [ebp - 0x58], 1
jle 0x1002ea7c
call fcn.100121e0
mov edi, 0x2c
mov eax, str.fg7G93tDwHtyaehLEucsh5TlGySP6Y3Xe_n6UVzUSh8
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.10002d20
mov edx, esi
push edx
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], ebx
call fcn.10002750
add esp, 8
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov esi, 0x10
cmp dword [ebp - 0x18], esi
jb 0x1002ea1b
mov ecx, dword [ebp - 0x2c]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
mov dword [0x1015e85c], 0x10040fac
cmp dword [ebp - 0x34], esi
jb 0x1002ea42
mov edx, dword [ebp - 0x48]
mov dword [0x1015e858], edx
jmp 0x1002ea4a
lea eax, [ebp - 0x48]
mov dword [0x1015e858], eax
call fcn.1000d2a0
mov eax, 0x10040acf
push 0xbb8
mov dword [0x1015e858], eax
mov dword [0x1015e85c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10009910
cmp dword [ebp - 0x34], esi
jb 0x1002ea7c
mov ecx, dword [ebp - 0x48]
push ecx
call edi
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034620
mov esp, ebp
pop ebp
ret
Function at 0x10034620
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004b034]
jne 0x1003462a
repz ret
jmp fcn.10034b69

Function at 0x10166c89
Capabilities:
Encode data using xor

Disassembly:
dec edx
sar ax, cl
push ecx
xor ebx, edx
sal word [esp + ecx*2 - 0x43ddb750], 0x68
shl ecx, cl
add ebp, edx
and dword [esp + 9], ecx
dec esp
and al, 9
sar byte [esp + 0xc], 0x86
movzx eax, word [esi - 7]
mov dword [esp + 4], ecx
sal dword [esp + 2], 0xd4
sbb esi, 7
not cl
lea edx, [ecx + ecx*8 + 0x552a0321]
push ecx
xor ax, bx
inc dword [esp + edx - 0xc4cac17]
call fcn.101db136
test ecx, eax
fbld tbyte [0x1105cab1]
jecxz 0x10166c9e
mov al, 0xca
add dword [0xcab0c5f7], esp
adc eax, 0xb0c5bb11
retf 0x2b59

Function at 0x10167d80
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx*4 - 0x266f2c80]
xor ebx, ecx
inc eax
mov dword [esi + edx - 0x4000f63a], ecx
mov dword [esp + edx - 0x4000f636], edx
jno 0x102992fb
mov ecx, 0x8cb77184
lea ecx, [ecx + ecx*2 + 0x4a939b2d]
mov cx, word [esi]
push 0x2a88498b
mov eax, 0x5cbd8b0b
movzx eax, byte [eax + ebp - 0x5cbd8b0c]
xor al, bl
ror al, 1
inc edx
mov dword [0xc8d0c332], eax
add al, 0x1e
mov word [esp + 2], 0x5e8b
neg al
dec al
mov edx, dword [esp]
xor bl, al
call fcn.1017d804
xor dh, ch
push esp
xchg dword [eax - 0xda042a], esi
mov bl, 0x4b
loopne 0x10167dbd
sti
and eax, 0x87abee9f
call 0x33b5d7e0
arpl word [esi + 0x4a7cefc3], bp
push ecx
inc esp
dec ebx
hlt
js 0x103a01f3
mov eax, ecx
add ecx, eax
bswap edx
push ecx
ror edx, 1
lea eax, [eax + 0x463efb8a]
sub eax, 0x84abfd32
adc ax, ax
xor edx, 0xe2167807
call fcn.1022c22e
mov eax, dword [edi]
sub edi, 0xfffffffc
xor eax, ebx
push 0x4a2ba12a
ror eax, 3
mov edx, 0x5b98e530
bswap eax
inc eax
not dl
mov ecx, dword [esp + 4]
add ecx, 0xee8bf
jmp ecx

Function at 0x1016a184
Capabilities:
Check for vm using instruction vpcext

Disassembly:
xor edx, ebx
push ecx
lea edx, [eax + edx + 0x59b56e8d]
shr byte [esp + ecx - 0x2bfd], 0xa7
mov dword [esp + ecx*4 - 0xaffc], ecx
rol dword [esp + ecx*4 - 0xb000], 0xcb
not edx
dec ecx
neg edx
or cl, ch
dec edx
xchg byte [esp + ecx - 0x2bf9], ah
xor dword [esp + ecx*2 - 0x57fa], ecx
xor ebx, edx
and cx, cx
shl eax, cl
sbb dword [esp + eax + 4], eax
adc ebp, edx
mov cx, word [edi + eax]
sal word [esp + eax*2 + 2], 0xd
add ax, word [eax + edi + 2]
add edi, 2
call fcn.10243bd9
neg edx
xor ebx, eax
sal cl, 0x41
adc edi, eax
add byte [esp + edx*2 - 0x677d4ffd], dh
movzx ecx, word [edx + ebp - 0x33bea806]
xadd word [esp + edx - 0x33bea800], dx
sub edx, edx
movsx eax, dx
lea ebp, [ebp + edx*4 - 6]
jae 0x101c53a3
mov edx, 0xf0a1473b
sub ebp, 4
lea edx, [edx*4 + 0x558f7599]
xor edx, edx
jb 0x102c7837
mov eax, dword [edx + ebp]
jno 0x10351010
bswap edx
Function at 0x10171959
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + eax - 0x70400000], eax
mov dword [ebp + eax - 0x70400002], ecx
mov eax, dword [esi + eax - 0x70400000]
xor eax, ebx
mov edx, 0xf8e0896
shl dx, 0xab
inc eax
movsx ecx, dl
bswap ecx
xor eax, 0x2e8ad926
dec eax
push ecx
bswap eax
sub eax, 0xcfa9479c
xor ebx, eax
add edi, eax
xchg dh, cl
push edx
movsx eax, cx
movzx edx, word [esi + edx - 0xf8dfffc]
lea esi, [esi + ecx*2 - 0x15a]
mov byte [esp + ecx*4 - 0x2b8], ch
xor dx, bx
inc ax
ror dword [esp + ecx*2 - 0x160], 0x1e
neg word [esp + ecx - 0xac]
ror dx, 1
add dx, 0xf1a4
jmp 0x10185fe0
rol dx, 1
inc ecx
pop ecx
sub dx, 0x988c
rol ecx, 7
xor dx, 0x4f0a
shr ax, 0xe6
xor bx, dx
xor byte [esp + ecx - 0x1c000019], cl
mov word [ebp + ecx - 0x1c000023], dx
xchg word [esp + eax*2 - 1], ax
neg ecx
lea ebp, [ebp + eax*8 - 4]
pop eax
push eax
adc cx, 0xb589
pop ecx
pop eax
jbe fcn.1034425b

Function at 0x10173eb3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov dword [esp + ecx - 0x60002427], 0xac996ba2
not dword [esp + ecx - 0x60002420]
mov word [esi + ecx - 0x6000242b], ax
mov ecx, dword [ebp + ecx - 0x60002430]
adc ebp, 0xfffffffb
mov eax, dword [esp + 8]
xor ecx, ebx
shl eax, 0xa1
mov edx, 0x5b2b3d0a
call fcn.1029a0c9

Function at 0x10173eea
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ecx
xor edx, 0x923ce13e
inc al
lea eax, [eax*8 + 0x762d2d99]
xor ebx, edx
add edi, edx
lea ecx, [ecx + ecx*2 + 0x732f16ae]
shr ecx, 0xda
mov cl, byte [esi + ecx - 0x21]
sub ax, ax
lea esi, [esi + eax - 0x57e10005]
movsx edx, al
xor cl, bl
mov dword [esp + eax - 0x57e0fffc], eax
sub cl, 0x9d
sal dx, 0xe9
ror cl, 1
rol eax, 0xf8
inc cl
jmp 0x1038d084
lea edx, [edx + eax*4 + 0x6bb56621]
xor cl, 0x8b
xor bl, cl
inc eax
lea eax, [edx*8 + 0x2610ee16]
mov word [ebp + edx - 0x6d14ea1f], cx
rol ax, 0x27
inc dl
lea eax, [ebp + edx - 0x6d14ea20]
lea edx, [edx + edx*2 - 0x3efb60cf]
ror word [esp + edx*8 - 0x421aecb2], 0xa9
pop edx
mov dword [edx + ebp - 2], eax
sub byte [esp + edx*2 + 2], 0x2f
sbb edx, 0x930d1d97
lea ebp, [edx + ebp - 0x6cf2e26b]
jb 0x1023520f