joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cc110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x310039
mov dword [ebp - 0x50], 0x390039
mov dword [ebp - 0x4c], 0x350036
mov dword [ebp - 0x48], 0x320045
mov dword [ebp - 0x44], 0x380046
mov dword [ebp - 0x40], 0x410037
mov dword [ebp - 0x3c], 0x340030
mov dword [ebp - 0x38], 0x300037
mov dword [ebp - 0x34], 0x330042
mov dword [ebp - 0x30], 0x310030
mov dword [ebp - 0x2c], 0x410035
mov dword [ebp - 0x28], 0x430042
mov dword [ebp - 0x24], 0x300042
mov dword [ebp - 0x20], 0x350038
mov dword [ebp - 0x1c], 0x300036
mov dword [ebp - 0x18], 0x450046
mov word [ebp - 0x14], ax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100cc22b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001d330
test al, al
jne 0x100cc20b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc1f0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10020080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10017a40
int3
Function at 0x100cc310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x410035
mov dword [ebp - 0x50], 0x340032
mov dword [ebp - 0x4c], 0x360036
mov dword [ebp - 0x48], 0x430032
mov dword [ebp - 0x44], 0x330044
mov dword [ebp - 0x40], 0x440039
mov dword [ebp - 0x3c], 0x430034
mov dword [ebp - 0x38], 0x410044
mov dword [ebp - 0x34], 0x390038
mov dword [ebp - 0x30], 0x410042
mov dword [ebp - 0x2c], 0x390031
mov dword [ebp - 0x28], 0x390036
mov dword [ebp - 0x24], 0x310045
mov dword [ebp - 0x20], 0x410045
mov dword [ebp - 0x1c], 0x430030
mov dword [ebp - 0x18], 0x360045
mov word [ebp - 0x14], ax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100cc42b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001d330
test al, al
jne 0x100cc40b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc3f0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10020080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10017a40
int3
Function at 0x100cc510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x380038
mov dword [ebp - 0x50], 0x360032
mov dword [ebp - 0x4c], 0x660062
mov dword [ebp - 0x48], 0x380065
mov dword [ebp - 0x44], 0x330062
mov dword [ebp - 0x40], 0x660065
mov dword [ebp - 0x3c], 0x300038
mov dword [ebp - 0x38], 0x330039
mov dword [ebp - 0x34], 0x620032
mov dword [ebp - 0x30], 0x340034
mov dword [ebp - 0x2c], 0x380033
mov dword [ebp - 0x28], 0x370066
mov dword [ebp - 0x24], 0x380030
mov dword [ebp - 0x20], 0x360066
mov dword [ebp - 0x1c], 0x630032
mov dword [ebp - 0x18], 0x360065
mov word [ebp - 0x14], ax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100cc62b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001d330
test al, al
jne 0x100cc60b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc5f0
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10020080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10017a40
int3
Function at 0x100cc640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x340031
mov dword [ebp - 0x50], 0x330032
mov dword [ebp - 0x4c], 0x450031
mov dword [ebp - 0x48], 0x380043
mov dword [ebp - 0x44], 0x460039
mov dword [ebp - 0x40], 0x420034
mov dword [ebp - 0x3c], 0x460034
mov dword [ebp - 0x38], 0x380037
mov dword [ebp - 0x34], 0x440039
mov dword [ebp - 0x30], 0x410034
mov dword [ebp - 0x2c], 0x450037
mov dword [ebp - 0x28], 0x420033
mov dword [ebp - 0x24], 0x430034
mov dword [ebp - 0x20], 0x360042
mov dword [ebp - 0x1c], 0x450043
mov dword [ebp - 0x18], 0x310039
mov word [ebp - 0x14], ax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100cc75b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001d330
test al, al
jne 0x100cc73b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc720
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10020080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10017a40
int3
Function at 0x100cc770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018b308
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], 0x450038
mov dword [ebp - 0x50], 0x310032
mov dword [ebp - 0x4c], 0x300035
mov dword [ebp - 0x48], 0x450031
mov dword [ebp - 0x44], 0x390033
mov dword [ebp - 0x40], 0x320046
mov dword [ebp - 0x3c], 0x310034
mov dword [ebp - 0x38], 0x380030
mov dword [ebp - 0x34], 0x340039
mov dword [ebp - 0x30], 0x450038
mov dword [ebp - 0x2c], 0x300044
mov dword [ebp - 0x28], 0x420039
mov dword [ebp - 0x24], 0x380041
mov dword [ebp - 0x20], 0x370031
mov dword [ebp - 0x1c], 0x390046
mov dword [ebp - 0x18], 0x360031
mov word [ebp - 0x14], ax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100cc88b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x54]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.1001d330
test al, al
jne 0x100cc86b
lea ecx, [ebp - 0x54]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100cc850
sub ecx, edx
lea eax, [ebp - 0x54]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10020080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10017a40
int3
Function at 0x100cef90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018bfd3
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], 0
test esi, esi
je 0x100cf04b
cmp word [esi], di
je 0x100cf04b
test eax, eax
je 0x100ceffc
cmp word [eax], di
je 0x100ceffc
push edi
push edi
push eax
push esi
push edi
call fcn.1014e390
push eax
call fcn.100cff40
add esp, 4
call eax
test eax, eax
js 0x100cf04b
jmp 0x100cf046
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10150460
add esp, 0xc
lea eax, [ebp - 0x420]
push 0
push 0
push 0x104
push eax
push esi
push 0
call fcn.1014e2f0
push eax
call fcn.100cff40
add esp, 4
call eax
test eax, eax
js 0x100cf04b
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100cf0c2
mov eax, dword [ebx + 0x24]
test eax, eax
js 0x100cf0ad
lea esi, [ebx + 0x34]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
mov dword [ebp - 0x428], esi
test esi, esi
je 0x100cf07b
mov eax, dword [esi]
push esi
call dword [eax]
mov eax, dword [ebx + 0x24]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 1
test eax, eax
js 0x100cf09c
mov dword [ebp - 0x424], edi
test ecx, ecx
je 0x100cf0e2
mov eax, dword [ecx]
lea edx, [ebp - 0x424]
push edx
call dword [eax + 8]
mov ecx, dword [ebp + 0x34]
mov byte [ebp - 4], 2
test esi, esi
je 0x100cf0ad
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x100cf0c2
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 0x30
call fcn.100a272d
int3
Function at 0x100d0410
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018c17a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101dd594]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100d05d4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100d05de
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100d05e8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x100d04f2
xor ecx, ecx
jmp 0x100d0510
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d0500
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10020080
push edi
mov ecx, ebx
call fcn.1001c9f0
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x100d052c
xor ecx, ecx
jmp 0x100d0544
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d0534
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10020080
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.100d0ef0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1001c9f0
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d0585
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x100d05be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x100d05be
cmp dword [esi + 0x10], 0
je 0x100d05b5
push dword [edi]
call fcn.10168086
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
int3
Function at 0x100d0cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018c268
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100d0ec4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d0d45
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x100d0ec4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d0d63
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x100d0ec4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d0d81
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x100d0ec4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d0d9f
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x100d0ec4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100d0ec4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100d0dc4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x100d0df7
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x100d0e0f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x100d0e4d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10018c50
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.1014f960
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x101a1064
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.100d16c0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100d0e7b
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x100d0eb4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100d0eb4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.10021dd0
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.100171c0
lea ecx, [ebp - 0x28]
call fcn.100171c0
lea ecx, [ebp - 0x34]
call fcn.100d06a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 4
Function at 0x100d1260
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018c327
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x100d12aa
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d12b6
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.1001ba50
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x100d1323
push 0x48
call fcn.10127dee
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x100d1317
push 0x48
push 0
push ebx
call fcn.10150460
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.100d0410
jmp 0x100d1319
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d1350
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.1001ba50
push 3
push 0x101a1064
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10036ac0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100d139f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x100d13ee
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100d13ee
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.1001ba50
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.100171c0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x100d1424
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100d141a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100d1461
push edx
push ecx
call fcn.10127e1e
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x100d1443
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret 0x14
call fcn.10153963
int3
Function at 0x100d2c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x101f2b98
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x100d2d60
movzx ecx, word [esi + eax]
test cx, cx
je 0x100d2d60
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x100d2d42
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
Function at 0x100d6812
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x100d6835
or esi, 1
push 2
call edi
test ax, ax
jns 0x100d6841
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x100d684d
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x100d6859
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x100d9b61
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x4b4]
call fcn.100dbb18
mov edi, dword [ebp + 8]
test eax, eax
jle 0x100d9bb9
push ebx
lea ecx, [esi + 0x4b4]
mov byte [ebp + 0xb], 0
call fcn.100dc63b
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
mov ecx, eax
jne 0x100d9c1d
lea ecx, [esi + 0x4b4]
inc ebx
call fcn.100dbb18
cmp ebx, eax
jl 0x100d9b80
sub edi, 0x100
je 0x100d9c92
sub edi, 4
je 0x100d9c29
dec edi
sub edi, 1
jne 0x100d9d4c
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.10163687
pop ecx
mov ecx, dword [esi + 0x104]
lea edx, [ebp + 8]
push 0x80000012
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x100db952
call dword [eax + 0x134]
mov esi, eax
test esi, esi
je 0x100d9d4c
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x128]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
jmp 0x100d9c22
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov al, 1
jmp 0x100d9d4e
cmp dword [esi + 0x108], 0
je 0x100d9d4c
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x120]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x124]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.100d6812
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
jmp 0x100d9d4c
cmp dword [ebp + 0xc], 9
jne 0x100d9d4c
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x100d9cef
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x100d9cef
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x100d9cef
mov ecx, dword [esi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.10150619
pop ecx
pop ecx
test eax, eax
je 0x100d9cef
mov ecx, dword [esi + 0x108]
call fcn.100fd110
test al, al
jne 0x100d9d4c
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x100d9d33
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x100d9d33
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x10c]
test al, al
je 0x100d9d33
mov ecx, dword [esi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.10150619
pop ecx
pop ecx
test eax, eax
jne 0x100d9d4c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.100db262
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10