joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060600
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x10152ae9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x14], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x18], esi
mov byte [esi + 4], bl
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 1
test bl, bl
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100606a8
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
mov ebp, ebp
cmp edi, ebx
je 0x100606a0
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov dh, dh
cmp eax, ebx
je 0x100606a0
mov ecx, eax
lea ebp, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
cmp dl, bl
jne 0x10060681
sub ecx, ebp
push ecx
push eax
mov ecx, esi
call fcn.1000a1e0
xchg ebx, eax
xchg ebx, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
mov bl, bl
call dword [sym.imp.USER32.dll_CloseClipboard]
test dl, dl
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x100606c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10152b32
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x238], eax
push ebx
push esi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x248]
mov dword fs:[0], eax
mov esi, dword [esp + 0x258]
xor ebx, ebx
push 0x1ff
lea eax, [esp + 0x49]
push ebx
mov dword [esp + 0x24], ebx
push eax
mov dword [esp + 0x2c], esi
mov byte [esp + 0x50], bl
call fcn.100f4ed0
add esp, 0xc
mov ah, ah
test cl, cl
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
test edi, edi
mov dl, 0x25
mov cl, 0x30
mov al, 0x64
mov byte [esp + 0x24], dl
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0x34
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0x2d
mov byte [esp + 0x29], dl
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], 0x32
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], 0x2d
mov byte [esp + 0x2e], dl
mov byte [esp + 0x2f], cl
mov byte [esp + 0x30], 0x32
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0x20
mov byte [esp + 0x33], dl
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], 0x32
mov byte [esp + 0x36], al
mov byte [esp + 0x37], 0x3a
mov byte [esp + 0x38], dl
mov byte [esp + 0x39], cl
mov byte [esp + 0x3a], 0x32
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], 0x3a
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], 0x32
mov byte [esp + 0x40], al
mov byte [esp + 0x41], bl
test ecx, ecx
movzx edx, word [esp + 0x18]
movzx eax, word [esp + 0x16]
movzx ecx, word [esp + 0x14]
push edx
movzx edx, word [esp + 0x16]
push eax
movzx eax, word [esp + 0x16]
push ecx
movzx ecx, word [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x60]
push eax
call fcn.100f5cb0
add esp, 0x20
test cl, cl
lea eax, [esp + 0x44]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10060810
sub eax, edx
push eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.1000a1e0
mov dword [esp + 0x250], ebx
mov dword [esp + 0x1c], 1
mov eax, esi
mov ecx, dword [esp + 0x248]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x238]
xor ecx, esp
call fcn.100f43d6
add esp, 0x248
ret
Function at 0x10061a80
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x10152e72
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x22c], esi
mov ebp, dword [esp + 0x234]
mov edi, dword [esp + 0x238]
mov ebx, dword [esp + 0x23c]
mov dword [esp + 0x18], esi
mov dword [ebp + 0x18], 0xf
mov dword [ebp + 0x14], esi
mov dword [esp + 0x1c], ebp
mov byte [ebp + 4], 0
mov dword [esp + 0x22c], esi
mov dword [esp + 0x18], 1
mov dh, dh
push 0x1ff
lea eax, [esp + 0x25]
push esi
push eax
mov byte [esp + 0x2c], 0
call fcn.100f4ed0
add esp, 0xc
test dh, dh
push ebx
lea ecx, [esp + 0x24]
push ecx
push edi
call fcn.1003c920
add esp, 0xc
test edx, edx
mov byte [esp + 0x14], 0x72
mov byte [esp + 0x15], 0x62
mov byte [esp + 0x16], 0
mov ebx, ebx
push 0x40
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.100f5bd9
add esp, 0xc
mov edi, eax
nop
cmp edi, esi
je 0x10061bdd
push 2
push esi
push edi
call fcn.100f5b54
add esp, 0xc
test ecx, ecx
push edi
call fcn.100f5a5f
add esp, 4
mov ebx, eax
mov edx, edx
push esi
push esi
push edi
call fcn.100f5b54
add esp, 0xc
mov cl, cl
lea ecx, [ebx + 1]
push ecx
call fcn.100f3e38
add esp, 4
mov esi, eax
mov ah, ah
test esi, esi
je 0x10061bd2
push edi
push ebx
push 1
push esi
call fcn.100f58ac
add esp, 0x10
mov dl, dl
mov byte [esi + ebx], 0
mov ah, ah
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10061bb1
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.1000a1e0
mov ebx, ebx
push esi
call fcn.100f3efb
add esp, 4
push edx
pop edx
push edi
call fcn.100f5594
add esp, 4
mov bl, bl
mov eax, ebp
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100f43d6
add esp, 0x21c
ret
Function at 0x100627d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101530b9
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 4], bl
mov dword [esp + 0x48], ebx
mov dword [esp + 0xc], 1
test ah, ah
test eax, 0x682c
mov byte [esp + 0x14], 0x25
mov byte [esp + 0x15], 0x49
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x34
mov byte [esp + 0x18], 0x58
mov byte [esp + 0x19], bl
push ecx
pop ecx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.100f5cb0
add esp, 0x10
mov ebx, ebx
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10062876
sub eax, edx
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.1000a1e0
test eax, 0xe4e
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100f43d6
add esp, 0x40
ret
Function at 0x10076e80
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10153682
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x154]
mov dword fs:[0], eax
mov esi, dword [esp + 0x164]
mov edi, dword [esp + 0x168]
mov eax, dword [esp + 0x16c]
xor ebx, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebx
test ebx, ebx
mov dword [esp + 0x10], ebx
test esi, esi
push ebx
pop ebx
push ebx
push ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x30]
push ecx
push eax
push edi
call fcn.100693b0
add esp, 0x1c
test eax, eax
jne 0x10076f21
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x101597f0
mov ecx, esi
mov byte [esi + 4], bl
call fcn.1000a1e0
jmp 0x10076fa8
push ebx
pop ebx
mov cl, 0x25
mov al, 0x64
mov byte [esp + 0x48], cl
mov byte [esp + 0x49], al
mov byte [esp + 0x4a], 0x2c
mov byte [esp + 0x4b], cl
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], bl
xchg ebx, eax
xchg ebx, eax
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push edx
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x5c]
push edx
call fcn.100f5cb0
add esp, 0x10
mov dh, dh
cmp dword [edi + 0x32f4], ebx
jne 0x10076f77
mov eax, dword [esp + 0x10]
push eax
call fcn.100f3efb
add esp, 4
mov bh, bh
lea eax, [esp + 0x50]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
lea edx, [eax + 1]
jmp 0x10076f90
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10076f90
sub eax, edx
push eax
lea ecx, [esp + 0x54]
push ecx
mov ecx, esi
call fcn.1000a1e0
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x14], 1
mov eax, esi
mov ecx, dword [esp + 0x154]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.100f43d6
add esp, 0x150
ret
Function at 0x1007d6e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10153a48
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x5c]
cmp eax, 2
mov ebp, dword [esp + 0x58]
mov esi, dword [esp + 0x60]
jne 0x1007d75f
mov esi, dword [ebp + 0x3300]
mov edi, dword [esi + 8]
cmp dword [esi + 4], edi
jbe 0x1007d736
call fcn.100f6196
mov ebx, dword [esi + 4]
cmp ebx, dword [esi + 8]
jbe 0x1007d743
call fcn.100f6196
push edi
push esi
push ebx
push esi
lea eax, [esp + 0x48]
push eax
mov ecx, esi
call fcn.1005af50
mov bh, bh
mov eax, 1
jmp 0x1007d881
cmp eax, 1
jne 0x1007d785
add ebp, 0x32fc
push ebp
push 0x101596f0
push esi
call fcn.100f6765
add esp, 0xc
test dh, dh
mov eax, 1
jmp 0x1007d881
xor ebx, ebx
cmp eax, ebx
jne 0x1007d87f
mov cl, 0x25
mov al, 0x64
mov dl, 0x2c
mov byte [esp + 0x38], cl
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], dl
mov byte [esp + 0x3b], cl
mov byte [esp + 0x3c], al
mov byte [esp + 0x3d], dl
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], al
mov byte [esp + 0x40], dl
mov byte [esp + 0x41], cl
mov byte [esp + 0x42], al
mov byte [esp + 0x43], bl
mov dl, dl
test al, al
lea ecx, [esp + 0x24]
call fcn.100e610c
mov dword [esp + 0x50], ebx
push ecx
pop ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
push 0x101593b0
push esi
call fcn.100436a0
add esp, 0x10
mov edi, eax
test cl, cl
test bh, bh
xor esi, esi
cmp edi, ebx
jle 0x1007d862
jmp 0x1007d800
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, ecx
cmp esi, ebx
jl 0x1007d87a
cmp esi, dword [esp + 0x2c]
jge 0x1007d87a
mov edx, dword [esp + 0x28]
mov eax, dword [edx + esi*4]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x48]
push ecx
push eax
call fcn.100f6765
add esp, 0x18
test cl, cl
mov ecx, dword [ebp + 0x3300]
lea edx, [esp + 0x14]
push edx
call fcn.10068c10
mov cl, cl
add esi, 1
cmp esi, edi
jl 0x1007d800
mov dword [esp + 0x50], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.100e6454
mov eax, 1
jmp 0x1007d881
jmp fcn.100e2ea6
xor eax, eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100f43d6
add esp, 0x40
ret
Function at 0x1007d8a0
Capabilities:
Create thread

Disassembly:
sub esp, 0x210
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x21c]
push 0x1ff
lea eax, [esp + 0x19]
push 0
push eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0x20], 0
call fcn.100f4ed0
add esp, 0xc
test dl, dl
push esi
lea ecx, [esp + 0x18]
push ecx
push edi
call fcn.1003c920
add esp, 0xc
mov bh, bh
lea eax, [esp + 0x14]
lea edx, [eax + 1]
jmp 0x1007d900
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1007d900
sub eax, edx
add eax, 1
push eax
call fcn.100f3e38
add esp, 4
mov esi, eax
test esi, esi
test esi, esi
je 0x1007d98d
lea eax, [esp + 0x14]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x1007d930
push ebp
mov al, al
mov dword [esp + 0xc], 0
push eax
pop eax
call fcn.1002d010
mov ebp, eax
mov dh, dh
lea edx, [esp + 0xc]
push edx
push 0
push esi
push 0x1004cb20
push 0
push 0
call fcn.100f664f
add esp, 0x18
mov edi, eax
mov ah, ah
push ebp
call fcn.1002d0e0
add esp, 4
test eax, 0xa3a
test edi, edi
pop ebp
jne 0x1007d9a6
push esi
call fcn.100f3efb
add esp, 4
test esi, esi
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.100f43d6
add esp, 0x210
ret
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test dl, dl
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [edx + 0x3284]
mov dword [esp + 0x10], eax
call fcn.10020c40
push eax
pop eax
mov ecx, dword [esp + 0x214]
mov eax, dword [esp + 8]
pop edi
pop esi
xor ecx, esp
call fcn.100f43d6
add esp, 0x210
ret
Function at 0x100836c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push edi
test eax, 0x6c37
test eax, 0x7f11
test eax, 0x7d4a
mov edi, dword [esp + 0x1c]
push 5
push edi
call fcn.1004d8f0
add esp, 8
push ecx
pop ecx
test eax, eax
jne 0x100836ef
mov eax, edi
pop edi
add esp, 0x14
ret
push ebx
push ebp
push esi
push 0
push eax
call fcn.1004d8f0
add esp, 8
mov esi, eax
test ebx, ebx
test cl, cl
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
test dl, dl
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100837bf
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, esi
mov eax, eax
test ebx, ebx
jne 0x1008373b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10083763
test eax, 0x4d13
lea eax, [esp + 0x14]
push eax
push esi
call ebp
test al, al
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1008379f
push 2
push esi
call fcn.1004d8f0
add esp, 8
mov esi, eax
test ah, ah
cmp edi, esi
je 0x100837bf
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push ecx
pop ecx
sub eax, dword [esp + 0x10]
cmp eax, dword [0x1018f904]
jae 0x100837bb
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10083728
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push esi
call fcn.100836c0
add esp, 0x10
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret
xor edi, edi
test ch, ch
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x10083ed0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [esp + 0x28]
jne 0x10083f69
cmp dword [esi], 0
je 0x10083f69
mov al, 0x69
mov dl, 0x54
mov cl, 0x6f
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x1a], 0
test eax, 0x528
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esi + 0x10], eax
push eax
pop eax
mov esi, dword [esi + 0x10]
test esi, esi
je 0x10083f8d
push 1
push edi
call esi
mov ebx, ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100f43d6
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100f43d6
add esp, 0x18
ret

Function at 0x10083fa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push edi
xor edi, edi
push ecx
pop ecx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0x14
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
test eax, 0x1ced
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x33
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0
nop
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov cl, cl
test esi, esi
je 0x1008409f
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0x57
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x77
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], 0x78
mov byte [esp + 0x35], 0
mov dl, dl
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test bh, bh
test eax, eax
je 0x10084096
lea ecx, [esp + 8]
push ecx
call eax
test ecx, ecx
mov edi, 1
test bl, bl
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test edi, edi
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100f43d6
add esp, 0x34
ret
Function at 0x10084760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
push ecx
pop ecx
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
test ch, ch
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
test eax, eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test edx, edx
test esi, esi
jne 0x1008482d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100f43d6
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
mov bh, bh
test eax, 0x63e4
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.100f4ed0
add esp, 0xc
test al, al
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x10084868
mov edi, dword [esp + 0x34]
push edx
pop edx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov bh, bh
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100f43d6
add esp, 0x5c
ret
Function at 0x100856c0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.10085470
add esp, 4
mov esi, eax
test eax, 0x48cc
test esi, esi
je 0x10085729
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10085729
push ebx
push ebp
push edi
push eax
pop eax
push 0
push esi
call fcn.1004d8b0
add esp, 8
mov esi, eax
xchg ebx, eax
xchg ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov ecx, ecx
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
test esi, esi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test ch, ch
push 0
push esi
push edi
call ebx
mov ah, ah
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100860b0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10153f9b
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov eax, dword [esp + 0x15c]
xor ebx, ebx
cmp eax, ebx
jne 0x10086105
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, esi
jmp 0x100862ad
cmp eax, 1
jne 0x100862ab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dl, dl
push 5
push eax
call fcn.1004d8f0
add esp, 8
nop
push ebx
push eax
call fcn.1004d8f0
add esp, 8
mov ebp, eax
mov eax, eax
mov edi, ebp
push ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x14], eax
test dl, dl
mov al, 0x6c
mov byte [esp + 0x34], 0x53
mov byte [esp + 0x35], 0x68
mov byte [esp + 0x36], 0x65
mov byte [esp + 0x37], al
mov byte [esp + 0x38], al
mov byte [esp + 0x39], 0x5f
mov byte [esp + 0x3a], 0x54
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x61
mov byte [esp + 0x3d], 0x79
mov byte [esp + 0x3e], 0x57
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x64
mov byte [esp + 0x41], bl
test esi, esi
cmp ebp, ebx
je 0x100862a7
nop
mov ebp, edi
mov ecx, ecx
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10086271
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10086271
push 0xff
lea eax, [esp + 0x49]
push ebx
push eax
mov byte [esp + 0x50], bl
call fcn.100f4ed0
add esp, 0xc
test edi, edi
push ebx
lea esi, [esp + 0x1c]
call fcn.10085300
add esp, 4
mov dword [esp + 0x150], ebx
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x100861ee
mov ecx, dword [eax + 4]
jmp 0x100861f1
lea ecx, [eax + 4]
lea edx, [esp + 0x44]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x100861f5
mov dword [esp + 0x150], 0xffffffff
cmp dword [esp + 0x30], esi
jb 0x10086221
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov al, al
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, ecx
cmp eax, ebx
jne 0x10086271
lea ecx, [esp + 0x34]
lea eax, [esp + 0x44]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10086268
cmp dl, bl
je 0x10086264
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10086268
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10086248
xor eax, eax
jmp 0x1008626d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x100862a7
push 2
push edi
call fcn.1004d8f0
add esp, 8
mov edi, eax
test edx, edx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
test eax, 0x565a
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1018f904]
jae 0x100862a3
cmp edi, ebx
jne 0x10086190
mov eax, ebp
jmp 0x100862ad
xor ebp, ebp
test ecx, ecx
mov eax, ebp
jmp 0x100862ad
xor eax, eax
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.100f43d6
add esp, 0x140
ret