joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x102c
call fcn.1007fc60
mov eax, dword [0x101da820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075b40
add esp, 0xc
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1018], 0
jmp 0x10089cdf
mov ecx, dword [ebp - 0x1018]
add ecx, 1
mov dword [ebp - 0x1018], ecx
cmp dword [ebp - 0x1018], 0xa
jge 0x10089d96
mov edx, dword [ebp - 0x1018]
imul edx, edx, 0x16
add edx, dword [ebp - 0x1020]
mov dword [ebp - 0x1010], edx
mov eax, dword [ebp - 0x1010]
add eax, 1
mov dword [ebp - 0x102c], eax
mov ecx, dword [ebp - 0x1010]
mov dl, byte [ecx]
mov byte [ebp - 0x1009], dl
add dword [ebp - 0x1010], 1
cmp byte [ebp - 0x1009], 0
jne 0x10089d10
mov eax, dword [ebp - 0x1010]
sub eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1024], eax
je 0x10089d91
mov ecx, dword [ebp - 0x1018]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1020]
mov edx, dword [ebp - 0x1014]
lea eax, [ebp + edx - 0x1004]
mov edx, dword [ecx]
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
mov cx, word [ecx + 0x14]
mov word [eax + 0x14], cx
mov edx, dword [ebp - 0x1014]
add edx, 0x16
mov dword [ebp - 0x1014], edx
jmp 0x10089cd0
mov dword [ebp - 0x1008], 0
jmp 0x10089db1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1014]
jge 0x10089e2f
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
sub eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10089da2
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x101c], eax
cmp dword [ebp - 0x101c], 0xffffffff
jne 0x10089e59
jmp 0x10089ea7
mov dword [ebp - 0x1028], 0
push 0
lea eax, [ebp - 0x1028]
push eax
mov ecx, dword [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10089e9a
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10089ea7
mov edx, dword [ebp - 0x101c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d4d0
mov esp, ebp
pop ebp
ret 4
Function at 0x10089ec0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1034
call fcn.1007fc60
mov eax, dword [0x101da820]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1024], ecx
mov byte [ebp - 0x1004], 0
push 0xfff
push 0
lea eax, [ebp - 0x1003]
push eax
call fcn.10075b40
add esp, 0xc
push 0x1000
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.10075b40
add esp, 0xc
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1018], eax
cmp dword [ebp - 0x1018], 0xffffffff
jne 0x10089f3d
jmp 0x1008a133
push 0
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x102c], 0
push 0
lea ecx, [ebp - 0x102c]
push ecx
mov edx, dword [ebp - 0x1020]
push edx
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10089f96
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008a133
mov dword [ebp - 0x1008], 0
jmp 0x10089fb1
mov eax, dword [ebp - 0x1008]
add eax, 1
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
cmp ecx, dword [ebp - 0x1020]
jge 0x1008a02f
mov edx, dword [ebp - 0x1008]
shr edx, 8
and edx, 0xff
movzx eax, dl
xor eax, 0x95
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
add eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
mov edx, dword [ebp - 0x1008]
and edx, 0xff
movzx eax, dl
xor eax, 0xda
movzx ecx, al
mov edx, dword [ebp - 0x1008]
movzx eax, byte [ebp + edx - 0x1004]
xor eax, ecx
mov ecx, dword [ebp - 0x1008]
mov byte [ebp + ecx - 0x1004], al
jmp 0x10089fa2
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1004]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x1020]
xor edx, edx
mov ecx, 0x16
div ecx
mov dword [ebp - 0x1034], eax
mov dword [ebp - 0x100c], 0
jmp 0x1008a078
mov edx, dword [ebp - 0x100c]
add edx, 1
mov dword [ebp - 0x100c], edx
cmp dword [ebp - 0x100c], 0xa
jge 0x1008a133
mov eax, dword [ebp - 0x100c]
imul eax, eax, 0x16
add eax, dword [ebp - 0x101c]
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
add ecx, 1
mov dword [ebp - 0x1028], ecx
mov edx, dword [ebp - 0x1014]
mov al, byte [edx]
mov byte [ebp - 0x100d], al
add dword [ebp - 0x1014], 1
cmp byte [ebp - 0x100d], 0
jne 0x1008a0a9
mov ecx, dword [ebp - 0x1014]
sub ecx, dword [ebp - 0x1028]
mov dword [ebp - 0x1030], ecx
je 0x1008a0f6
mov edx, dword [ebp - 0x1024]
mov eax, dword [edx + 0xec]
add eax, 1
mov ecx, dword [ebp - 0x1024]
mov dword [ecx + 0xec], eax
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
mov eax, dword [ebp - 0x101c]
lea ecx, [eax + edx + 0xb]
push ecx
mov edx, dword [ebp - 0x100c]
imul edx, edx, 0x16
add edx, dword [ebp - 0x101c]
push edx
mov ecx, dword [ebp - 0x100c]
imul ecx, ecx, 0x16
add ecx, dword [ebp - 0x1024]
call fcn.10001d90
jmp 0x1008a069
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006d4d0
mov esp, ebp
pop ebp
ret 4
Function at 0x10096900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
push str.discord_rpc.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x101de648], eax
cmp dword [0x101de648], 0
je 0x10096957
call fcn.10096990
movzx ecx, al
test ecx, ecx
je 0x10096957
mov ecx, dword [ebp - 4]
call fcn.100968c0
push 0
push 0
push 0
push 0x100963d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov byte [edx + 8], 1
mov esp, ebp
pop ebp
ret
Function at 0x100a5790
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000caa0
cmp eax, 1
jae 0x100a57ae
jmp 0x100a590d
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000caa0
cmp eax, 1
jbe 0x100a581c
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x20]
test ecx, ecx
jne 0x100a581c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
cmp eax, 0x1388
jbe 0x100a581c
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.1000caa0
sub eax, 1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x1c], eax
jne 0x100a57fb
mov dword [ebp - 8], 0
jmp 0x100a5807
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24], eax
mov edx, dword [0x7bc4f04]
movzx eax, byte [edx + 0x13]
push eax
mov ecx, 0x405230
call ecx
add esp, 4
cmp eax, 2
jne 0x100a58fd
mov ecx, 0x102610ac
call fcn.1011aa00
movzx edx, al
test edx, edx
je 0x100a58fd
mov eax, dword [0x8128ac4]
movzx ecx, word [eax + 0x1240]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x8128ac4]
movzx eax, word [edx + 0x12ab]
mov dword [ebp - 0x20], eax
mov ecx, 0x861110
call ecx
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 0xc], eax
push 0x80f
mov eax, 0x83be60
mov ecx, dword [ebp - 0xc]
call eax
mov dword [ebp - 0x14], eax
push 0x807
mov edx, 0x83be60
mov ecx, dword [ebp - 0xc]
call edx
mov dword [ebp - 0x1c], eax
mov eax, 0x5879e0
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x100a58c4
cmp dword [ebp - 0x14], 0
jg 0x100a58d9
cmp dword [ebp - 0x18], 0x80f
je 0x100a58d9
cmp dword [ebp - 0x10], 2
jne 0x100a58eb
cmp dword [ebp - 0x1c], 0
jg 0x100a58d9
cmp dword [ebp - 0x20], 0x807
jne 0x100a58eb
mov ecx, dword [ebp - 4]
movss xmm0, dword [0x101c5460]
movss dword [ecx + 0x10], xmm0
jmp 0x100a58fb
mov edx, dword [ebp - 4]
movss xmm0, dword [0x101c5438]
movss dword [edx + 0x10], xmm0
jmp 0x100a590d
mov eax, dword [ebp - 4]
movss xmm0, dword [0x101c5438]
movss dword [eax + 0x10], xmm0
mov esp, ebp
pop ebp
ret
Function at 0x100a62a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movss xmm0, dword [0x101c4ea8]
movss dword [eax + 0xc], xmm0
mov ecx, dword [ebp - 8]
movss xmm0, dword [0x101c5438]
movss dword [ecx + 0x10], xmm0
mov edx, dword [ebp - 8]
movss xmm0, dword [0x101c53d0]
movss dword [edx + 0x14], xmm0
mov eax, dword [ebp - 8]
movss xmm0, dword [0x101c5358]
movss dword [eax + 0x18], xmm0
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 8]
mov byte [edx + 0x21], 0
push 0x101a41f8
push 0
push 0x101a4208
push 0x101a4210
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x100a631b
mov byte [ebp - 1], 1
jmp 0x100a631f
mov byte [ebp - 1], 0
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x20], cl
movzx edx, byte [0x1027234d]
cmp edx, 1
jne 0x100a634a
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.100261e0
movzx ecx, byte [0x10272353]
cmp ecx, 1
jne 0x100a636c
mov dword [ebp - 0x10], 1
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.100261e0
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.1000caa0
test eax, eax
jbe 0x100a63ad
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x28
call fcn.1000c1e0
mov ecx, dword [ebp - 8]
mov edx, dword [eax]
mov dword [ecx + 0x1c], edx
mov eax, dword [ebp - 8]
push eax
push 0x8d
mov ecx, 0x10207be4
call fcn.1011ca40
push 1
mov ecx, dword [ebp - 8]
call fcn.100261a0
mov esp, ebp
pop ebp
ret

Function at 0x100ae780
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
cmp dword [0x10272668], 1
jne 0x100ae8b9
push 2
push 0x90
push 0x66842d
call fcn.101701e0
add esp, 0xc
push 0x100adfe0
push 0x6684a3
push 0xe8
call fcn.10170370
add esp, 0xc
push 2
push 0x90
push 0x6684cd
call fcn.101701e0
add esp, 0xc
push 0x100adf90
push 0x668512
push 0xe8
call fcn.10170370
add esp, 0xc
push 0x101dc3a8
push 0x777d6c
call fcn.101702c0
add esp, 8
push 0x101dc3a8
push 0x777dac
call fcn.101702c0
add esp, 8
push 0x101dc3a8
push 0x777dea
call fcn.101702c0
add esp, 8
push 0x101dc3a8
push 0x777e17
call fcn.101702c0
add esp, 8
push 0x101dc3a8
push 0x777e2c
call fcn.101702c0
add esp, 8
push 0x101dc3a4
push 0x777d88
call fcn.101702c0
add esp, 8
push 0x101dc3a4
push 0x777da2
call fcn.101702c0
add esp, 8
push 0x101dc3a4
push 0x777dde
call fcn.101702c0
add esp, 8
push 0x100ae060
push 0x777dc8
push 0xe8
call fcn.10170370
add esp, 0xc
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10012fc0
push 0
push 0
push 0
push 0x100ae570
push 0
push 0
call fcn.1006f1c0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x100b2c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10191f3b
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x101da820]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x518], ecx
lea ecx, [ebp - 0x510]
call fcn.10087ac0
mov dword [ebp - 4], 0
mov byte [ebp - 0x110], 0
push 0xff
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.10075b40
add esp, 0xc
lea ecx, [ebp - 0x514]
push ecx
mov ecx, dword [ebp - 0x518]
call fcn.10001110
jmp 0x100b2d18
push 0
lea edx, [ebp - 0x520]
push edx
lea ecx, [ebp - 0x514]
call fcn.1002f170
lea eax, [ebp - 0x524]
push eax
mov ecx, dword [ebp - 0x518]
call fcn.10001140
push eax
lea ecx, [ebp - 0x514]
call fcn.10001350
movzx ecx, al
test ecx, ecx
je 0x100b2ea3
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
mov ecx, dword [ebp - 0x518]
call fcn.100b2f70
movzx edx, al
test edx, edx
jne 0x100b2db4
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_File_is_Missing
lea eax, [ebp - 0x110]
push eax
call fcn.1006e91a
add esp, 0xc
push 0x10
push 0x101a5ca0
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x400
lea edx, [ebp - 0x51c]
push edx
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
lea ecx, [ebp - 0x510]
call fcn.10087860
movzx eax, al
test eax, eax
jne 0x100b2e33
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_File_Check_Error
lea ecx, [ebp - 0x110]
push ecx
call fcn.1006e91a
add esp, 0xc
push 0x10
push 0x101a5cb8
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x514]
call fcn.100012e0
mov eax, dword [eax + 0x104]
cmp eax, dword [ebp - 0x51c]
je 0x100b2e9e
lea ecx, [ebp - 0x514]
call fcn.100012e0
push eax
push str._s_has_been_modified..._n_nReinstall_Client_or_contact_server_Administrator
lea ecx, [ebp - 0x110]
push ecx
call fcn.1006e91a
add esp, 0xc
push 0x10
push 0x101a5cbc
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x100b2d04
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.10087ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d4d0
mov esp, ebp
pop ebp
ret
Function at 0x100b3a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2e3]
test ecx, ecx
jne 0x100b3a7a
jmp 0x100b3b03
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x2dc]
cmp eax, 0x46
jbe 0x100b3b03
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x2d4]
test ecx, ecx
jne 0x100b3ac9
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x2d8]
add eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2d8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x2d8], 0xa
jne 0x100b3ac7
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d4], 1
jmp 0x100b3af4
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x2d8]
sub edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x2d8], edx
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x2d8], 1
jne 0x100b3af4
mov edx, dword [ebp - 4]
mov byte [edx + 0x2d4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2dc], eax
mov esp, ebp
pop ebp
ret
Function at 0x100b6ea0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
sub eax, dword [ecx + 0xcc]
cmp eax, 0x3e8
jae 0x100b6ec5
jmp 0x100b6f67
lea ecx, [ebp - 4]
call fcn.1000f220
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x80
call fcn.10001110
mov eax, dword [eax]
mov dword [ebp - 4], eax
jmp 0x100b6ef4
push 0
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
call fcn.10034710
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x80
call fcn.10001140
push eax
lea ecx, [ebp - 4]
call fcn.10001350
movzx eax, al
test eax, eax
je 0x100b6f58
lea ecx, [ebp - 4]
call fcn.100012e0
movzx esi, byte [eax]
mov ecx, dword [0x10271e70]
push ecx
mov ecx, 0x10205f28
call fcn.100dbf50
movzx edx, al
cmp esi, edx
jne 0x100b6f56
lea ecx, [ebp - 4]
call fcn.100012e0
add eax, 0x78
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
sub ecx, 1
mov edx, dword [ebp - 0xc]
mov dword [edx], ecx
jmp 0x100b6f58
jmp 0x100b6ee6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xcc], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bb4f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 7
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 5]
imul edx, edx, 0xc
mov eax, dword [ebp - 0x14]
lea ecx, [eax + edx + 0x94]
call fcn.1002dd50
mov dword [ebp - 8], 0
jmp 0x100bb531
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
movzx eax, byte [edx + 6]
cmp dword [ebp - 8], eax
jge 0x100bb57d
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 5]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.100bb590
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x10], edx
jmp 0x100bb528
mov esp, ebp
pop ebp
ret 4
Function at 0x100c5470
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x100c54ae
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, dword [0x101de844]
push ecx
push 0x100c4f70
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x100c54ae
xor al, al
jmp 0x100c54f7
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x100c54e5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov edx, dword [0x101de844]
push edx
push 0x100c5210
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x100c54e5
xor al, al
jmp 0x100c54f7
mov eax, dword [0x101de844]
push eax
mov ecx, 0x10261794
call fcn.1016f690
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x100c8f10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
mov eax, 0x861110
call eax
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
jmp 0x100c8f4d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xcc
jge 0x100c9083
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c3c0
mov ecx, dword [ebp - 0x14]
call edx
mov dword [ebp - 0x20], eax
mov eax, 0x83cbe0
mov ecx, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x28]
jne 0x100c8f85
jmp 0x100c9083
mov edx, dword [ebp - 0x20]
push edx
mov eax, 0x835720
mov ecx, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x30], eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c4b0
mov ecx, dword [ebp - 0x14]
call edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov edx, 0x7da660
mov ecx, dword [ebp - 0x30]
call edx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100c907e
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax]
mov edx, dword [ebp + 8]
movsx eax, word [edx]
cmp ecx, eax
jne 0x100c907e
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [edx + 2]
cmp ecx, dword [eax + 2]
je 0x100c8ff1
jmp 0x100c8f44
mov edx, dword [ebp - 8]
movsx eax, byte [edx + 0x17]
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0x17]
cmp eax, edx
je 0x100c9008
jmp 0x100c8f44
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x18]
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x18]
cmp ecx, eax
je 0x100c901f
jmp 0x100c8f44
cmp dword [ebp + 0xc], 0xffffffff
jle 0x100c904f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx*4 + 0x9c], 0xffffffff
jne 0x100c9040
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c904d
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x16]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jmp 0x100c907e
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x16]
cmp ecx, 0xff
je 0x100c9075
mov edx, dword [ebp - 8]
movzx eax, byte [edx + 0x16]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 0x16]
cmp eax, edx
je 0x100c9075
jmp 0x100c8f44
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c8f44
cmp dword [ebp + 0xc], 0xffffffff
jle 0x100c90d7
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx*4 + 0x9c], 0xffffffff
je 0x100c90d7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + eax*4 + 0x4c], 0
jle 0x100c90d7
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + edx*4 + 0x9c]
cmp ecx, dword [ebp - 0x18]
jle 0x100c90c1
mov dword [ebp - 0x24], 0
jmp 0x100c90d2
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
cdq
idiv dword [esi + ecx*4 + 0x4c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
jmp 0x100c90da
mov eax, dword [ebp - 0x10]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x100c90f0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x10], 0
mov eax, 0x861110
call eax
mov edx, 0x861260
mov ecx, eax
call edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x100c9125
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xcc
jge 0x100c91d2
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c3c0
mov ecx, dword [ebp - 8]
call edx
mov dword [ebp - 0x14], eax
mov eax, 0x83cbe0
mov ecx, dword [ebp - 8]
call eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jne 0x100c915a
jmp 0x100c91d2
mov edx, dword [ebp - 0x14]
push edx
mov eax, 0x835720
mov ecx, dword [ebp - 8]
call eax
mov dword [ebp - 0x20], eax
push 0x40
mov ecx, dword [ebp - 4]
push ecx
mov edx, 0x83c4b0
mov ecx, dword [ebp - 8]
call edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov edx, 0x7da660
mov ecx, dword [ebp - 0x20]
call edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100c91cd
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
cmp ecx, dword [ebp + 8]
jne 0x100c91cd
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 2]
shr eax, 3
and eax, 0xf
mov dword [ebp - 0x24], eax
movzx ecx, byte [ebp + 0xc]
cmp ecx, 0xff
je 0x100c91c4
movzx edx, byte [ebp + 0xc]
cmp edx, dword [ebp - 0x24]
jne 0x100c91cd
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x100c911c
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 8