joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001340
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049f16
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x244], eax
xor eax, eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
xor edi, edi
mov ecx, 0x3d6d3a34
lea eax, [ebp - 0x224]
mov dword [ebp - 0x250], edi
call fcn.100143f0
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.100190d0
test eax, eax
sete al
or esi, 0xffffffff
mov dword [ebp - 4], esi
test al, al
je 0x1000140e
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x1005c888
sub edi, 0x7e80af00
lea esi, [ebp - 0x23c]
call fcn.10014470
lea edx, [ebp - 0x114]
push edx
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x240], eax
jmp 0x1000144a
mov ecx, 0x3d6d3a34
lea eax, [ebp - 0x224]
call fcn.100143f0
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.100190d0
mov dword [ebp - 0x240], eax
xor eax, eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
mov word [ebp - 0x21c], ax
cmp dword [ebp - 0x240], 0
jne 0x10001472
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x248]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov dword [ebx + 8], ecx
jmp 0x100014fe
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, 0x4be156d1
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x244], eax
call fcn.100144b0
push eax
mov eax, dword [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x244]
push 0xc
lea ecx, [ebp - 0x250]
mov esi, eax
xor eax, eax
push ecx
push edx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov byte [ebp - 0x228], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ebp - 0x248]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret 8
Function at 0x10002220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebx + 5]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
add esp, 4
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
lea eax, [ebx + 5]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
push edi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
add edi, ebx
push 0x40
mov ecx, esi
sub ecx, edi
push ebx
lea edx, [ecx + ebx - 5]
push esi
mov byte [edi], 0xe9
mov dword [edi + 1], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
push ecx
push edx
sub eax, esi
push ebx
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, edi
pop edi
sub eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100022b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
push 0xb
call dword [sym.imp.MSVCR100.dll_malloc]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov edi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 0xb
push edi
call ebx
mov ecx, dword [esi]
mov dword [edi], ecx
mov dx, word [esi + 4]
mov word [edi + 4], dx
lea ecx, [ebp - 4]
push ecx
add edi, 6
push 0x40
mov eax, esi
sub eax, edi
push 6
inc eax
push esi
mov byte [edi], 0xe9
mov dword [edi + 1], eax
call ebx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
mov edx, 0x1000f0a0
sub edx, esi
push 6
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call ebx
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [edi - 6]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002340
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push esi
call ebx
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push edi
push esi
call ebx
push 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002390
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100023d6
push str.Error:_Unable_to_create_toolhelp_snapshot_
call dword [sym.imp.MSVCR100.dll_printf]
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100023c4
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x10002400
mov ecx, edi
lea eax, [ebp - 0x10c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10002428
test dl, dl
je 0x10002424
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10002428
add eax, 2
add ecx, 2
test dl, dl
jne 0x10002408
xor eax, eax
jmp 0x1000242d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000244f
lea ecx, [ebp - 0x130]
push ecx
push esi
call ebx
test eax, eax
jne 0x10002400
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x128]
pop esi
xor ecx, ebp
pop ebx
call fcn.100197a5
mov esp, ebp
pop ebp
ret

Function at 0x10002560
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049e7e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x10075484], 1
jne 0x100025fb
or dword [0x10075484], 1
mov edi, 0x1026d93d
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.10014830
mov esi, eax
mov ecx, 0x1026d951
lea eax, [ebp - 0x1c]
call fcn.100147b0
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.100190d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10075480], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
push 0
push 0xffffffffffffffff
call dword [0x10075480]
test eax, eax
jne 0x10002610
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x10007f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10048cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x1f
xor eax, eax
mov bl, byte [eax + str.Vfira_nuINF_OY]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], bl
jns 0x10007f8f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x10007f72
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret 4

Function at 0x10008280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049368
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x33
xor eax, eax
mov dl, byte [eax + str.zrfu]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x100082d0
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x100082b3
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 0x30]
push edx
call eax
lea esi, [edi + eax]
call fcn.10007b80
mov edi, eax
test esi, esi
je 0x1000835b
cmp dword [esi + 8], 0
jne 0x10008330
mov dword [esi + 8], 1
test edi, edi
je 0x10008316
mov eax, dword [edi + 0x24]
jmp 0x10008318
xor eax, eax
push 0x44
lea ecx, [esi + 0x40]
push ecx
lea edx, [esi + 0x10]
push edx
push 0
push 3
push 4
call eax
add esp, 0x18
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [esi + 0xc]
test edi, edi
je 0x10008345
mov edi, dword [edi + 0x30]
jmp 0x10008347
xor edi, edi
push 0x44
push eax
push ecx
push 0
push 3
push 4
lea eax, [ebp - 0x34]
push esi
push eax
call edi
add esp, 0x20
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x100085c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049368
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x31
xor eax, eax
mov dl, byte [eax + 0x1005e268]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x10008610
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x100085f3
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 0x30]
push edx
call eax
lea esi, [edi + eax]
call fcn.10007b80
mov edi, eax
test esi, esi
je 0x1000869b
cmp dword [esi + 8], 0
jne 0x10008670
mov dword [esi + 8], 1
test edi, edi
je 0x10008656
mov eax, dword [edi + 0x24]
jmp 0x10008658
xor eax, eax
push 0xe
lea ecx, [esi + 0x40]
push ecx
lea edx, [esi + 0x10]
push edx
push 2
push 3
push 4
call eax
add esp, 0x18
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ebp - 0x34], esi
mov esi, dword [esi + 0xc]
test edi, edi
je 0x10008685
mov eax, dword [edi + 0x30]
jmp 0x10008687
xor eax, eax
push 0xe
push ecx
push edx
push 2
push 3
push 4
lea ecx, [ebp - 0x34]
push esi
push ecx
call eax
add esp, 0x20
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret

Function at 0x100086c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049338
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x31
xor eax, eax
mov dl, byte [eax + str.xtdw]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x10008710
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x100086f3
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 0x2c]
push edx
call eax
lea esi, [edi + eax]
call fcn.10007b80
mov edi, eax
test esi, esi
je 0x1000879b
cmp dword [esi + 8], 0
jne 0x10008770
mov dword [esi + 8], 1
test edi, edi
je 0x10008756
mov eax, dword [edi + 0x24]
jmp 0x10008758
xor eax, eax
push 0x13
lea ecx, [esi + 0x40]
push ecx
lea edx, [esi + 0x10]
push edx
push 2
push 3
push 4
call eax
add esp, 0x18
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 4]
mov dword [ebp - 0x30], esi
mov esi, dword [esi + 0xc]
test edi, edi
je 0x10008785
mov eax, dword [edi + 0x30]
jmp 0x10008787
xor eax, eax
push 0x13
push ecx
push edx
push 2
push 3
push 4
lea ecx, [ebp - 0x30]
push esi
push ecx
call eax
add esp, 0x20
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x100097e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100488f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x87
xor eax, eax
mov dl, byte [eax + 0x1005e39c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000982e
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10009811
mov byte [ebp - 0x16], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
lea edx, [ebp - 0x24]
push edx
call eax
mov eax, dword [eax]
dec eax
mov dword [ebp - 4], 0xffffffff
je 0x100098a9
dec eax
je 0x100098a2
sub eax, 3
je 0x10009868
xor eax, eax
jmp 0x100098ae
mov edi, str._DOIUoYQESA
sub edi, 0x1e7b41dd
lea esi, [ebp - 0x24]
call fcn.10015110
mov dword [ebp - 4], 1
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
call eax
cmp dword [eax], 0
seta al
xor ecx, ecx
test al, al
setne cl
lea eax, [ecx + 3]
jmp 0x100098ae
mov eax, 2
jmp 0x100098ae
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x1000d3b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049268
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [0x10075070]
mov ecx, 0x1005f60b
lea eax, [ebp - 0x48]
call fcn.10016750
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, 0x6c
xor ecx, ecx
lea esp, [esp]
mov al, byte [ecx + str.__t_n9]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 0x3c], al
jns 0x1000d41d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x1b
jl 0x1000d400
mov byte [ebp - 0x21], bl
mov edx, 0x29
xor ecx, ecx
lea ecx, [ecx]
mov al, byte [ecx + str.bOYBHB]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ebp + ecx - 0x20], al
jns 0x1000d44d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1000d430
mov byte [ebp - 0x14], 0
mov byte [ebp - 4], 2
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
mov eax, dword [edx + 0x3c]
push 0x1000d340
push 1
push esi
call eax
push eax
push 2
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call fcn.100167d0
mov esi, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add esp, 0x14
add eax, edx
je 0x1000d4fb
mov dword [ebp - 0x4c], 0
add esi, dword [ebp - 0x4c]
je 0x1000d4db
mov esi, dword [esi]
lea edx, [ebp - 0x50]
push edx
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x50]
push eax
push ecx
push 1
push esi
mov byte [esi], 0xcc
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [edi]
mov ecx, dword [edi + 4]
add dword [ebp - 0x4c], 0xc
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
jb 0x1000d4b1
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x1000f440
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100488b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [0x10074730]
mov ecx, 0x1005eb40
sub ecx, 0x7f162a67
lea eax, [ebp - 0x1c]
call fcn.10016a00
push 0
push 2
mov dword [ebp - 4], 0
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0x74
push eax
mov eax, dword [edx + 0x3c]
call eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 4
push str.keybd_event
push 0x1005d98c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push eax
call fcn.100167d0
add esp, 0x1c
mov ecx, 0x63d2b536
lea eax, [ebp - 0x1c]
call fcn.10016a80
push 0
push 2
mov dword [ebp - 4], 1
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0xd
push eax
mov eax, dword [edx + 0x3c]
call eax
push eax
push 4
push str.keybd_event
push 0x1005d98c
call esi
push eax
call edi
push eax
call fcn.100167d0
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100750a4], eax
ja 0x1000f5cf
mov ecx, 0x24c5c1bf
lea eax, [ebp - 0x1c]
call fcn.10016b00
push 0
push 0
mov dword [ebp - 4], 2
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0xd
push eax
mov eax, dword [edx + 0x3c]
call eax
push eax
push 4
push str.keybd_event
push 0x1005d98c
call esi
push eax
call edi
push eax
call fcn.100167d0
mov ecx, 0x1005eb64
add esp, 0x1c
sub ecx, 0x7123d282
lea eax, [ebp - 0x1c]
call fcn.10016b80
push 0
push 0
mov dword [ebp - 4], 3
mov ecx, dword [0x10074d84]
mov edx, dword [ecx]
push 0x9c
push 0x74
push eax
mov eax, dword [edx + 0x3c]
call eax
push eax
push 4
push str.keybd_event
push 0x1005d98c
call esi
push eax
call edi
push eax
call fcn.100167d0
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, ebx
mov dword [0x100750a4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x10010570
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049158
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10074f10], 0
je 0x100105bf
push str.Pastikan_Layar_PB_FullScreen_Bukan_Windows_Mode_nSetting_Sensitive_Mouse_Jadi_0.3_300
push 0xffffff00
push 0x15e
mov ecx, 0x2b2
call fcn.1000d520
add esp, 0xc
cmp dword [0x10074f48], 0
je 0x1001068b
test byte [0x10075450], 1
jne 0x100105e6
or dword [0x10075450], 1
mov dword [0x1007544c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [0x1007544c], eax
ja 0x1001063b
call esi
add eax, 0x1f4
push 0
push 0x501
mov dword [0x1007544c], eax
call fcn.10008fc0
push eax
call fcn.10008f00
xor edi, edi
push edi
call fcn.100092b0
mov esi, eax
call fcn.100091f0
inc edi
cmp edi, 8
jl 0x10010616
push 0
push 0x502
call fcn.10008fc0
push eax
call fcn.10008f00
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + str.zOOMCI]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1001065f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x10010642
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
push eax
push 0xffffff00
push 0xdc
mov ecx, 0x122
mov dword [ebp - 4], 0
call fcn.1000d520
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret
Function at 0x100115d0
Capabilities:
Get disk information
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004a21b
mov eax, dword fs:[0]
push eax
sub esp, 0x610
mov eax, dword [0x10063018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0xff
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1001176d
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x610]
push edx
push 0
push 0
lea eax, [ebp - 0x60c]
push eax
mov dword [ebp - 0x60c], 0x5c3a43
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
setne al
test al, al
je 0x1001176d
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1001176d
lea edi, [ebp - 0x110]
call fcn.10011550
lea edi, [ebp - 0x210]
mov esi, eax
call fcn.10011550
add eax, esi
add eax, dword [ebp - 0x610]
lea ecx, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x60c]
push eax
push ecx
mov word [ebp - 0x60c], 0x6425
mov byte [ebp - 0x60a], 0
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
mov edi, 0x446bb5bf
lea esi, [ebp - 0x608]
call fcn.10017240
mov esi, eax
mov dword [ebp - 4], 0
call fcn.100113d0
push 0
push 0
push 0
push 0
add eax, 5
push esi
mov dword [0x100744e4], eax
mov dword [0x10074848], 0x100113b0
call fcn.100113b0
mov dword [ebp - 4], 0xffffffff
mov edi, dword [0x1006d8d4]
xor ecx, ecx
cmp dword [0x1006d8e8], 0x10
mov dword [0x100743a4], eax
mov dword [ebp - 0x608], ecx
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x600], ecx
mov dword [ebp - 0x5fc], ecx
jae 0x1001173d
mov edi, 0x1006d8d4
mov esi, eax
call fcn.10011490
push 0
push 0x80000000
push 0
push 0
push edi
add eax, 5
push esi
mov dword [0x10074d5c], eax
mov dword [0x100744e8], 0x100113c0
call fcn.100113c0
mov dword [0x10074d74], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100197a5
mov esp, ebp
pop ebp
ret