joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071160
Capabilities:
Copy file

Disassembly:
sub esp, 0x404
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x400], eax
push ebp
mov ebp, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x410]
push edi
mov edi, dword [esp + 0x418]
mov cl, cl
push 0x1ff
lea eax, [esp + 0x211]
push 0
push eax
mov byte [esp + 0x218], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08b0], 0xffffd0e7
push 0x1ff
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08c0], 0x5839
push edi
lea edx, [esp + 0x210]
push edx
push esi
call fcn.1005fa80
add esp, 0xc
cmp dword [0x101d08c8], 0xffff89b0
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1005fa80
add esp, 0xc
push edx
pop edx
cmp dword [esp + 0x420], 0
pop edi
pop esi
pop ebp
je 0x10071248
push 0
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [0x101d08b0], 0x2f18
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x404
ret
push 1
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp dword [0x101d08bc], 0x7693
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x404
ret

Function at 0x10071280
Capabilities:
Delete file

Disassembly:
sub esp, 0x204
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x200], eax
push esi
mov esi, dword [esp + 0x20c]
push edi
mov edi, dword [esp + 0x214]
cmp dword [0x101d08d4], 0xfffffede
push 0x1ff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.1012ea60
add esp, 0xc
mov ebx, ebx
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.1005fa80
add esp, 0xc
mov dl, dl
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ch, ch
mov ecx, dword [esp + 0x208]
pop edi
pop esi
xor ecx, esp
call fcn.1012e3ba
add esp, 0x204
ret

Function at 0x10071300
Capabilities:
Move file

Disassembly:
sub esp, 0x404
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x400], eax
push ebp
mov ebp, dword [esp + 0x414]
push esi
mov esi, dword [esp + 0x410]
push edi
mov edi, dword [esp + 0x418]
cmp dword [0x101d08bc], 0x7693
push 0x1ff
lea eax, [esp + 0x211]
push 0
push eax
mov byte [esp + 0x218], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08d4], 0xfffffede
push 0x1ff
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.1012ea60
add esp, 0xc
mov al, al
push edi
lea edx, [esp + 0x210]
push edx
push esi
call fcn.1005fa80
add esp, 0xc
mov bh, bh
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.1005fa80
add esp, 0xc
cmp dword [0x101d08b4], 0xffffabbe
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
cmp dword [0x101d08b8], 0x2d0b
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1012e3ba
add esp, 0x404
ret

Function at 0x10072320
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
mov byte [eax], 0
cmp dword [0x101d08b0], 0x2f18
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
push ecx
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
ret
Function at 0x10072720
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x10c
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x108], eax
push 0xff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.1012ea60
add esp, 0xc
mov eax, eax
mov al, 0x30
mov byte [esp], al
mov byte [esp + 1], 0x38
mov byte [esp + 2], al
mov byte [esp + 3], 0x34
mov byte [esp + 4], 0
cmp dword [0x101d08d0], 0xffffb36b
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x100727a1
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x10c
ret
lea edx, [esp]
lea ecx, [esp + 8]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100727c8
test al, al
je 0x100727c4
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100727c8
add ecx, 2
add edx, 2
test al, al
jne 0x100727a8
xor eax, eax
jmp 0x100727cd
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x108]
xor edx, edx
test eax, eax
sete dl
xor ecx, esp
mov eax, edx
call fcn.1012e3ba
add esp, 0x10c
ret

Function at 0x100727f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov al, 0x6c
push esi
mov dl, 0x68
mov cl, 0x65
xor ebx, ebx
push edi
mov edi, dword [esp + 0x30]
mov byte [esp + 0xc], 0x53
mov byte [esp + 0xd], dl
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], al
mov byte [esp + 0x10], al
mov byte [esp + 0x11], 0x33
mov byte [esp + 0x12], 0x32
mov byte [esp + 0x13], 0x2e
mov byte [esp + 0x14], 0x64
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], bl
cmp dword [0x101d08c8], 0xffff89b0
mov byte [esp + 0x19], dl
mov byte [esp + 0x1b], al
mov byte [esp + 0x1c], al
mov dl, 0x45
mov al, 0x78
mov byte [esp + 0x18], 0x53
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], cl
mov byte [esp + 0x20], 0x63
mov byte [esp + 0x21], 0x75
mov byte [esp + 0x22], 0x74
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x41
mov byte [esp + 0x27], bl
cmp dword [0x101d08b8], 0xffffd2f4
mov eax, eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp dword [0x101d08b0], 0xffffd0e7
cmp esi, ebx
je 0x100728fe
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x101d08bc], 0xffff896c
push edi
call eax
mov edi, eax
cmp dword [0x101d08b8], 0xffffd2f4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xchg ebx, eax
xchg ebx, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x20
ret
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1012e3ba
add esp, 0x20
ret
Function at 0x10072920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x1c], eax
mov cl, 0x6c
mov al, 0x65
mov dl, 0x72
mov byte [esp], 0x75
mov byte [esp + 1], 0x73
mov byte [esp + 2], al
mov byte [esp + 3], dl
mov byte [esp + 4], 0x33
mov byte [esp + 5], 0x32
mov byte [esp + 6], 0x2e
mov byte [esp + 7], 0x64
mov byte [esp + 8], cl
mov byte [esp + 9], cl
mov byte [esp + 0xa], 0
mov bh, bh
mov cl, 0x74
mov byte [esp + 0xc], 0x47
mov byte [esp + 0xd], al
mov byte [esp + 0xe], cl
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], 0x70
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x12], 0x46
mov byte [esp + 0x13], 0x6f
mov byte [esp + 0x14], dl
mov byte [esp + 0x15], 0x53
mov byte [esp + 0x16], 0x79
mov byte [esp + 0x17], 0x73
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x6d
mov byte [esp + 0x1b], 0
cmp dword [0x101d08cc], 0x4dfc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xchg ebx, eax
xchg ebx, eax
test eax, eax
je 0x100729ed
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x20
ret
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
cmp dword [0x101d08c8], 0x764f
push 0x58
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov esi, esi
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [0x101d08d4], 0x121
mov ecx, dword [esp + 0x24]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1012e3ba
add esp, 0x20
ret
Function at 0x10072b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x30], eax
xor eax, eax
push ebx
mov byte [esp + 0x24], al
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov word [esp + 0x31], ax
mov byte [esp + 0x33], al
cmp dword [0x101d08cc], 0x4dfc
mov dl, 0x65
mov cl, 0x6e
mov bl, 0x74
mov byte [esp + 0x14], 0x47
mov byte [esp + 0x15], dl
mov byte [esp + 0x16], cl
mov byte [esp + 0x17], 0x75
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], 0x49
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], bl
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], al
cmp dword [0x101d08bc], 0xffff896c
mov byte [esp + 4], 0x41
mov byte [esp + 5], 0x75
mov byte [esp + 6], bl
mov byte [esp + 7], 0x68
mov byte [esp + 8], dl
mov byte [esp + 9], cl
mov byte [esp + 0xa], bl
mov byte [esp + 0xb], 0x69
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x41
mov byte [esp + 0xe], 0x4d
mov byte [esp + 0xf], 0x44
mov byte [esp + 0x10], al
mov dl, dl
mov eax, 0
cpuid
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x14]
lea eax, [esp + 0x24]
pop ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10072c77
test dl, dl
je 0x10072c73
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10072c77
add eax, 2
add ecx, 2
test dl, dl
jne 0x10072c57
xor eax, eax
jmp 0x10072c7c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10072c94
mov eax, 1
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x34
ret
lea ecx, [esp]
lea eax, [esp + 0x20]
jmp 0x10072ca0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10072cc0
test dl, dl
je 0x10072cbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10072cc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10072ca0
xor eax, eax
jmp 0x10072cc5
sbb eax, eax
sbb eax, 0xffffffff
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 0xfffffffe
xor ecx, esp
add eax, 2
call fcn.1012e3ba
add esp, 0x34
ret

Function at 0x10072d70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x800], eax
push 0x7ff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08cc], 0xffffb203
push 0x800
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push ecx
pop ecx
mov ecx, dword [esp + 0x800]
mov al, byte [esp]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x804
ret

Function at 0x10073020
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x40
mov ebx, ebx
mov dword [esp], 0x40
cmp dword [0x101d08d4], 0xfffffede
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
neg eax
sbb eax, eax
and eax, dword [esp + 4]
add esp, 0x40
ret
Function at 0x100749c0
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
nop
push 0x38
lea eax, [esp + 0x18]
push 0
push eax
call fcn.1012ea60
add esp, 0xc
mov al, al
mov ebp, ebp
mov ebx, dword [esp + 0x54]
push ebx
xor edi, edi
call fcn.1006b6b0
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esp, 4
mov dword [esp + 0x10], eax
jmp 0x10074a00
lea esi, [edi*8]
sub esi, edi
add esi, esi
add esi, esi
mov eax, 1
mov dword [esp + esi + 0x14], eax
cmp dword [0x101d08c4], 0xfffff546
cmp dword [esp + 0x10], 0
je 0x10074a2c
mov dword [esp + esi + 0x1c], eax
nop
mov word [esp + esi + 0x18], bx
cmp dword [0x101d08bc], 0xffff896c
push 0
push ebx
call ebp
mov word [esp + esi + 0x1a], ax
cmp dword [0x101d08d0], 0x4c94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + esi + 0x20], eax
mov ecx, ecx
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
mov dword [esp + esi + 0x24], eax
cmp dword [0x101d08bc], 0x7693
cmp edi, 1
jne 0x10074a7b
or dword [esp + 0x38], 2
mov cl, cl
add edi, 1
cmp edi, 2
jl 0x10074a00
mov eax, dword [esp + 0x58]
test eax, eax
mov edi, dword [esp + 0x50]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, 1
push 0x1c
jne 0x10074b29
lea edx, [esp + 0x20]
call fcn.10073ec0
add esp, 0xc
cmp dword [0x101d08c8], 0xffff89b0
cmp dword [edi + 0x2608], 0
je 0x10074af9
mov esi, dword [edi + 0x2638]
test esi, esi
jle 0x10074ae1
call fcn.101308e7
cdq
idiv esi
mov dl, dl
mov al, al
mov ecx, esi
sar ecx, 1
sub edx, ecx
add edx, esi
jmp 0x10074ae6
mov edx, 1
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x101d08b4], 0x5441
jmp 0x10074b08
mov edx, dword [edi + 0x2638]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x1c
lea edx, [esp + 0x3c]
mov ecx, 1
call fcn.10073ec0
add esp, 0xc
push eax
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
cmp eax, 1
jne 0x10074b4c
lea edx, [esp + 0x20]
call fcn.10073ec0
add esp, 0xc
cmp dword [0x101d08d0], 0x4c94
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
lea edx, [esp + 0x3c]
call fcn.10073ec0
add esp, 0xc
cmp dword [0x101d08bc], 0xffff896c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret
Function at 0x100759a0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x10], eax
mov bl, bl
mov esi, dword [esp + 0x14]
cmp esi, 0xa0
je 0x100759c4
cmp esi, 0xa1
jne 0x100759d5
mov esi, 0x10
cmp dword [0x101d08c8], 0x764f
jmp 0x10075a0d
cmp esi, 0xa4
je 0x100759e5
cmp esi, 0xa5
jne 0x100759f6
mov esi, 0x12
cmp dword [0x101d08b8], 0x2d0b
jmp 0x10075a0d
cmp esi, 0xa2
je 0x10075a06
cmp esi, 0xa3
jne 0x10075a0d
mov esi, 0x11
mov dl, dl
mov eax, dword [edi + 0x40]
xor ebp, ebp
cmp eax, ebp
jne 0x10075a2b
push 2
push esi
push edi
call fcn.100749c0
add esp, 0xc
mov dl, dl
pop edi
pop esi
lea eax, [ebp + 1]
pop ebp
ret
cmp eax, 1
jne 0x10075bb4
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov eax, eax
shl eax, 0x10
or eax, 1
mov ebx, eax
cmp dword [0x101d08c4], 0xfffff546
cmp dword [0x101d08cc], 0x4dfc
push esi
call fcn.1006b6b0
add esp, 4
test eax, eax
je 0x10075a70
or ebx, 0x1000000
mov cl, cl
cmp dword [0x101d08bc], 0xffff896c
cmp dword [edi + 0x18], ebp
je 0x10075aa8
cmp dword [edi + 0x32d0], ebp
jne 0x10075aa8
push 0x717be38b
push edi
call fcn.1006dc00
add esp, 8
test eax, eax
jne 0x10075aa8
or ebx, 0x4000000
push ebx
pop ebx
mov ebp, 0x4000000
mov ecx, ecx
cmp esi, 0x12
jne 0x10075ab6
mov dword [edi + 0x64], 0
mov dl, dl
cmp dword [edi + 0x64], 0
jne 0x10075b37
cmp esi, 0x79
je 0x10075b37
or ebx, 0xc0000000
mov ch, ch
cmp dword [edi + 0x32b0], 0
je 0x10075ade
mov ebx, ebp
cmp dword [0x101d08cc], 0x4dfc
cmp dword [edi + 0x32ac], 0
je 0x10075b12
mov ecx, dword [edi + 0x32b4]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x101
push edx
call fcn.10072430
add esp, 0x1c
mov al, al
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x101
push eax
call fcn.100722e0
cmp dword [0x101d08d4], 0x121
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
cmp dword [0x101d08c4], 0xfffff546
or ebx, 0xe0000000
mov esi, esi
cmp dword [edi + 0x32b0], 0
je 0x10075b5e
mov ebx, ebp
cmp dword [0x101d08c0], 0x5839
cmp dword [edi + 0x32ac], 0
je 0x10075b97
mov ecx, dword [edi + 0x32b4]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push ebx
push esi
push 0x105
push edx
call fcn.100722f0
cmp dword [0x101d08b4], 0x5441
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
mov eax, dword [esp + 0x14]
push ebx
push esi
push 0x105
push eax
call fcn.100722e0
mov ebp, ebp
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
cmp eax, 2
jne 0x10075b09
cmp esi, 0x12
jne 0x10075bcf
mov dword [edi + 0x64], ebp
cmp dword [0x101d08d0], 0x4c94
push 2
push esi
push edi
call fcn.100dd210
add esp, 0xc
cmp dword [0x101d08bc], 0x7693
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x10075bf0
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1006c810
mov edx, edx
test eax, eax
jle 0x10075c08
mov dword [esp + 8], eax
jmp fcn.100750f0
xor eax, eax
ret

Function at 0x10075c10
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1006c810
cmp dword [0x101d08c8], 0x764f
test eax, eax
jle 0x10075c30
mov dword [esp + 8], eax
jmp fcn.10075690
xor eax, eax
ret
Function at 0x10075c40
Capabilities:
Log keystrokes

Disassembly:
mov ecx, dword [esp + 8]
call fcn.1006c810
push edx
pop edx
test eax, eax
jle 0x10075c58
mov dword [esp + 8], eax
jmp fcn.100759a0
xor eax, eax
ret
Function at 0x10077220
Capabilities:
Get keyboard layout

Disassembly:
push 0xffffffffffffffff
push 0x10191a9b
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
push esi
push edi
mov eax, dword [0x101e5aec]
xor eax, esp
push eax
lea eax, [esp + 0x21c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x230]
push 0
push eax
call fcn.100722c0
mov cl, cl
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ebp, eax
mov dh, dh
lea ecx, [esp + 0x10]
call fcn.101059b0
mov dword [esp + 0x224], 0
mov al, al
lea ecx, [esp + 0x10]
call fcn.10104850
mov esi, eax
cmp dword [0x101d08bc], 0x7693
test esi, esi
mov edi, dword [esp + 0x234]
je 0x100772fc
lea esp, [esp]
mov ecx, edi
lea eax, [esi + 0xf]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100772d5
test dl, dl
je 0x100772d1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100772d5
add eax, 2
add ecx, 2
test dl, dl
jne 0x100772b5
xor eax, eax
jmp 0x100772da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100772f4
mov esi, dword [esi + 0x90]
cmp dword [0x101d08b4], 0x5441
test esi, esi
jne 0x100772b0
jmp 0x100772fc
test esi, esi
jne 0x1007739e
lea ecx, [esp + 0x10]
call fcn.1014ddc0
mov esi, eax
cmp dword [0x101d08c0], 0xffffa7c6
test esi, esi
je 0x1007735d
mov ecx, edi
lea eax, [esi + 0xf]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10077340
test dl, dl
je 0x1007733c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10077340
add eax, 2
add ecx, 2
test dl, dl
jne 0x10077320
xor eax, eax
jmp 0x10077345
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1007739a
mov esi, dword [esi + 0x90]
cmp dword [0x101d08d4], 0xfffffede
test esi, esi
jne 0x10077315
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10104860
xor eax, eax
mov ecx, dword [esp + 0x21c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x218
ret
test esi, esi
je 0x1007735d
push 0xff
lea eax, [esp + 0x11d]
push 0
push eax
mov byte [esp + 0x124], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08cc], 0x4dfc
push 0xff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov byte [esp + 0x24], 0
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08b4], 0x5441
lea edx, [esp + 0x18]
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x100773f2
cmp dword [0x101d08bc], 0x7693
lea edx, [esp + 0x18]
push edx
call fcn.1018a3b3
add esp, 4
cmp dword [0x101d08d4], 0x121
push 0x10
lea eax, [esp + 0x11c]
push eax
push ebp
call fcn.1018a455
add esp, 0xc
mov esi, esi
push eax
pop eax
lea ecx, [esp + 0x18]
lea eax, [esp + 0x118]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10077461
test dl, dl
je 0x1007745d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10077461
add eax, 2
add ecx, 2
test dl, dl
jne 0x10077441
xor eax, eax
jmp 0x10077466
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1007735d
mov dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.10104860
mov eax, 1
jmp 0x10077373
Function at 0x10077490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x68
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x64], eax
call fcn.1006f3c0
test eax, eax
jne 0x100774b6
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x68
ret
push ebx
xor ebx, ebx
cmp dword [0x102ea710], ebx
je 0x10077585
call fcn.1006f3c0
test eax, eax
je 0x10077585
push 0x3f
lea eax, [esp + 0x2d]
push ebx
push eax
mov byte [esp + 0x34], bl
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08d4], 0x121
cmp dword [0x101d08b8], 0xffffd2f4
mov dword [esp + 0x28], 2
mov ah, ah
mov dword [esp + 0x2c], 0x17
mov dl, dl
mov dword [esp + 4], ebx
mov bl, bl
cmp dword [0x101d08cc], 0xffffb203
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x30], ecx
cmp dword [0x101d08b8], 0x2d0b
lea eax, [esp + 4]
cdq
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], edx
cmp dword [0x101d08b0], 0x2f18
push ebx
lea edx, [esp + 0xc]
push edx
push ebx
push ebx
lea eax, [esp + 0x38]
push 0x18
push eax
call fcn.10026710
add esp, 0x18
push edx
pop edx
cmp eax, ebx
je 0x1007763f
cmp dword [esp + 4], ebx
jne 0x1007763f
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x68
ret
cmp dword [fcn.102f6eac], ebx
jne 0x10077651
mov cl, 0x65
mov byte [esp + 0xc], 0x6b
mov byte [esp + 0xd], cl
mov byte [esp + 0xe], 0x72
mov byte [esp + 0xf], 0x6e
mov byte [esp + 0x10], cl
mov byte [esp + 0x11], 0x6c
mov byte [esp + 0x12], 0x33
mov byte [esp + 0x13], 0x32
mov byte [esp + 0x14], bl
cmp dword [0x101d08d4], 0x121
mov al, 0x73
mov dl, 0x6f
mov byte [esp + 0x18], 0x49
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x57
mov byte [esp + 0x1b], dl
mov byte [esp + 0x1c], 0x77
mov byte [esp + 0x1d], 0x36
mov byte [esp + 0x1e], 0x34
mov byte [esp + 0x1f], 0x50
mov byte [esp + 0x20], 0x72
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], 0x63
mov byte [esp + 0x23], cl
mov byte [esp + 0x24], al
mov byte [esp + 0x25], al
mov byte [esp + 0x26], bl
cmp dword [0x101d08c4], 0xab9
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [fcn.102f6eac], eax
push ebx
pop ebx
cmp dword [fcn.102f6eac], ebx
jne 0x10077651
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x68
ret
push esi
cmp dword [0x101d08c8], 0xffff89b0
mov dword [esp + 8], ebx
cmp dword [0x101d08c8], 0x764f
mov eax, dword [esp + 0x74]
push ebx
push ebx
push eax
push ebx
push 0x400
call fcn.10071e30
add esp, 0x14
mov esi, eax
mov ah, ah
cmp esi, ebx
jne 0x1007769a
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x68
ret
lea ecx, [esp + 8]
push ecx
push esi
call dword [fcn.102f6eac]
cmp dword [0x101d08c0], 0x5839
push esi
call fcn.10052250
add esp, 4
mov cl, cl
mov ecx, dword [esp + 0x6c]
xor eax, eax
cmp dword [esp + 8], ebx
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.1012e3ba
add esp, 0x68
ret