joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10097b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
test esi, esi
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
test eax, 0x2fce
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
test dl, dl
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
test esi, esi
jne 0x10097c30
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1010190d
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [fcn.1016432c]
mov ebx, eax
test esi, esi
push ecx
pop ecx
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.10102a00
add esp, 0xc
mov ecx, ecx
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x10097c68
mov edi, dword [esp + 0x34]
mov dh, dh
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010190d
add esp, 0x5c
ret
Function at 0x10098800
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1016066b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
test dh, dh
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov ch, ch
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009887b
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1009887b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1009887b
cmp esi, edi
je 0x1009887b
mov eax, esi
jmp 0x100989f9
push 5
push edi
call fcn.10064ef0
add esp, 8
test dl, dl
xor ebx, ebx
push ebx
push eax
call fcn.10064ef0
add esp, 8
mov edi, eax
test ch, ch
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
mov bh, bh
mov esi, edi
test edx, edx
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
test ch, ch
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100989f7
mov edi, esi
xchg ebx, eax
xchg ebx, eax
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x100989bf
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100989bf
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.10102a00
add esp, 0xc
test eax, 0x787d
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100986a0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x10098960
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10006e20
test ah, ah
push esi
call dword [sym.imp.USER32.dll_GetParent]
nop
cmp eax, ebx
jne 0x100989bf
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100989b6
cmp dl, bl
je 0x100989b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100989b6
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10098996
xor eax, eax
jmp 0x100989bb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100989f7
push 2
push esi
call fcn.10064ef0
add esp, 8
mov esi, eax
mov cl, cl
cmp edi, esi
je 0x100989f7
call ebp
test cl, cl
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019a8b8]
jae 0x100989f3
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10098900
jmp 0x100989f7
xor edi, edi
push ebx
pop ebx
mov eax, edi
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1010190d
add esp, 0x13c
ret
Function at 0x10098a30
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.10098800
add esp, 4
mov esi, eax
mov edi, edi
test esi, esi
je 0x10098a96
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10098a96
push ebx
push ebp
push edi
mov bh, bh
push 0
push esi
call fcn.10064eb0
add esp, 8
mov esi, eax
push eax
pop eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov ebp, ebp
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
mov al, al
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test edx, edx
push 0
push esi
push edi
call ebx
xchg ebx, eax
xchg ebx, eax
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10098fa0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1016066b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x158]
xor ebx, ebx
cmp eax, ebx
jne 0x10098ff4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
nop
jmp 0x10099175
cmp eax, 1
jne 0x10099173
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebx, ebx
push 5
push eax
call fcn.10064ef0
add esp, 8
test esi, esi
push ebx
push eax
call fcn.10064ef0
add esp, 8
mov edi, eax
push ebx
pop ebx
mov esi, edi
nop
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
test ch, ch
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
test eax, 0x5eed
cmp edi, ebx
je 0x1009916f
mov edi, esi
nop
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10099140
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10099140
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.10102a00
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100986a0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
jmp 0x100990e0
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x100990e0
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10006e20
push ebx
pop ebx
push esi
call dword [sym.imp.USER32.dll_GetParent]
push ecx
pop ecx
cmp eax, ebx
jne 0x10099140
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10099137
cmp dl, bl
je 0x10099133
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10099137
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10099117
xor eax, eax
jmp 0x1009913c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1009916f
push 2
push esi
call fcn.10064ef0
add esp, 8
mov esi, eax
test edi, edi
call ebp
test edi, edi
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019a8b8]
jae 0x1009916b
cmp esi, ebx
jne 0x10099083
mov eax, edi
jmp 0x10099175
xor edi, edi
mov edx, edx
mov eax, edi
jmp 0x10099175
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1010190d
add esp, 0x13c
ret
Function at 0x100994b0
Capabilities:
Log keystrokes

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x100994c9
mov eax, dword [esp + 8]
push eax
call fcn.10098800
add esp, 4
mov edi, eax
nop
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100994d6
pop edi
ret
push ebx
push ebp
push esi
push 5
push edi
call fcn.10064ef0
add esp, 8
test eax, eax
je 0x10099561
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
mov ch, ch
push 0
push edi
call fcn.10064eb0
add esp, 8
mov ebx, eax
mov eax, eax
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ch, ch
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
nop
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ah, ah
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call ebx
test eax, eax
je 0x10099561
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10099561
mov esi, ebp
push ecx
pop ecx
push ebp
call ebx
test eax, eax
je 0x10099561
cmp esi, edi
je 0x1009955d
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov eax, eax
push esi
call ebx
test eax, eax
jne 0x10099545
jmp 0x10099561
mov edi, ebp
test ebx, ebx
mov ebp, dword [esp + 0x1c]
mov eax, ebp
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10099570
sub eax, edx
mov ebx, eax
push ecx
pop ecx
mov ch, ch
xor esi, esi
test ebx, ebx
jle 0x100995ae
jmp 0x10099590
movzx ecx, byte [esi + ebp]
push 0x4000001
push ecx
push 0x102
push edi
call fcn.10064ee0
xchg ebx, eax
xchg ebx, eax
add esi, 1
cmp esi, ebx
jl 0x10099590
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
ret

Function at 0x100995c0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x100995dd
mov eax, dword [esp + 8]
push eax
call fcn.10098800
add esp, 4
mov ebx, eax
test eax, 0x5c2e
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100995ea
pop ebx
ret
push 5
push ebx
call fcn.10064ef0
add esp, 8
test eax, eax
je 0x10099680
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
test edx, edx
push 0
push ebx
call fcn.10064eb0
add esp, 8
mov edi, eax
test ecx, ecx
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, 0x739f
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov eax, eax
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebp, ebp
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call edi
test eax, eax
je 0x1009967d
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1009967d
mov esi, ebp
mov cl, cl
push ebp
call edi
test eax, eax
je 0x1009967d
cmp esi, ebx
je 0x10099679
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test bl, bl
push esi
call edi
test eax, eax
jne 0x10099661
jmp 0x1009967d
mov ebx, ebp
mov dl, dl
pop edi
pop esi
pop ebp
push 0
push 0
push 0x302
push ebx
call fcn.10064ee0
test al, al
mov eax, 1
pop ebx
ret
Function at 0x10099cc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push 5
push eax
call fcn.10064ef0
add esp, 8
mov eax, eax
test eax, eax
jne 0x10099cdc
add esp, 8
ret
push ebx
push ebp
push esi
push edi
push 0
push eax
call fcn.10064ef0
add esp, 8
mov esi, eax
mov cl, cl
test eax, 0x4b1f
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x14], eax
push eax
pop eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10099dad
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
jmp 0x10099d20
mov dword [esp + 0x10], esi
mov esi, esi
push edi
push ebx
mov ecx, ebp
mov edx, esi
call fcn.100996a0
add esp, 8
test eax, eax
je 0x10099d54
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, esi
call fcn.100996a0
add esp, 8
test eax, eax
jne 0x10099db7
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push ebx
push ebp
push esi
call fcn.10099cc0
add esp, 0x1c
mov ecx, ecx
test eax, eax
jne 0x10099daf
push 2
push esi
call fcn.10064ef0
add esp, 8
mov esi, eax
mov ah, ah
cmp dword [esp + 0x10], esi
je 0x10099dad
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
test ch, ch
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019a8b8]
jae 0x10099dad
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10099d20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1009a840
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x30
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x44]
push edi
mov edi, dword [esp + 0x54]
push 5
push eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
call fcn.10064ef0
add esp, 8
mov cl, cl
test eax, eax
je 0x1009a9d4
push esi
push 0
push eax
call fcn.10064ef0
add esp, 8
mov esi, eax
test dh, dh
xchg ebx, eax
xchg ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
test eax, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009a9d3
push ebx
mov ebx, dword [esp + 0x4c]
push ebp
nop
push eax
pop eax
mov ebp, esi
push eax
pop eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x10]
push ebx
push eax
mov edx, esi
call fcn.100996a0
add esp, 8
test eax, eax
je 0x1009a975
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, esi
call fcn.100996a0
add esp, 8
test eax, eax
je 0x1009a975
xor eax, eax
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
test dl, dl
push esi
lea eax, [esp + 0x20]
push 0x10165438
push eax
call fcn.10103959
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [edi + 0x10]
sub ecx, dword [edi + 0x14]
je 0x1009a950
push 0x1016573d
push 0x1016573c
mov ecx, edi
call fcn.1000cf60
mov edi, edi
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1009a957
sub eax, edx
lea edx, [esp + eax + 0x1c]
push edx
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.1000cf60
mov ebp, ebp
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
push edi
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x1c]
push eax
push ebx
push ecx
push edx
push esi
call fcn.1009a840
add esp, 0x20
test cl, cl
push 2
push esi
call fcn.10064ef0
add esp, 8
mov esi, eax
test dh, dh
cmp ebp, esi
je 0x1009a9d1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov al, al
sub eax, dword [esp + 0x18]
cmp eax, dword [0x1019a8b8]
jae 0x1009a9d1
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1009a8b0
pop ebp
pop ebx
pop esi
mov ecx, dword [esp + 0x30]
pop edi
xor ecx, esp
call fcn.1010190d
add esp, 0x30
ret
Function at 0x1009c750
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x10160cc3
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101af0fc]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa78]
mov esi, dword [esp + 0xa80]
lea eax, [esp + 0x824]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov ecx, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x834], eax
mov dword [esp + 0x838], ecx
mov dword [esp + 0xa70], 1
mov edx, dword [esp + 0x834]
mov byte [edx], bl
mov dword [esp + 0xa70], 2
mov edx, edx
test ch, ch
push 0x800
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.10102a00
add esp, 0xc
mov cl, cl
mov dword [esp + 0x18], ebx
push ebx
pop ebx
mov dh, dh
push 0x128
lea ecx, [esp + 0x840]
push ebx
push ecx
call fcn.10102a00
add esp, 0xc
push edx
pop edx
mov dword [esp + 0x83c], 0x128
mov edi, edi
push ebx
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
mov edx, edx
cmp edi, 0xffffffff
jne 0x1009c84c
lea edx, [esp + 0x824]
push edx
mov ecx, ebp
call fcn.1000cef0
mov dword [esp + 0x1c], 1
jmp 0x1009c996
lea ecx, [esp + 0x14]
call fcn.1001eea0
mov byte [esp + 0xa70], 3
mov bh, bh
cmp esi, ebx
jne 0x1009c867
xor eax, eax
jmp 0x1009c87b
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1009c870
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.1003ff10
push eax
pop eax
lea ecx, [esp + 0x14]
call fcn.10007340
mov ebp, ebp
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32First
test esi, esi
cmp eax, ebx
je 0x1009c94c
jmp 0x1009c8b0
test dl, dl
xor eax, eax
jmp 0x1009c8c0
mov cl, byte [esp + eax + 0x860]
mov byte [esp + eax + 0x964], cl
add eax, 1
cmp cl, bl
jne 0x1009c8c0
mov ch, ch
lea ecx, [esp + 0x964]
push ecx
call fcn.10053ae0
add esp, 4
nop
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x964]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1009c913
cmp dl, bl
je 0x1009c90f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1009c913
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x1009c8f3
xor eax, eax
jmp 0x1009c918
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1009c934
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x844]
mov dword [esp + eax*4 + 0x24], edx
add eax, 1
mov dword [esp + 0x18], eax
test esi, esi
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32Next
test ebx, ebx
cmp eax, ebx
jne 0x1009c8b0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test ecx, ecx
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x1009c96e
lea ecx, [esp + 0x824]
push ecx
mov ecx, ebp
call fcn.1000cef0
jmp 0x1009c97d
push eax
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.1009b0d0
add esp, 0xc
mov dword [esp + 0x1c], 1
mov byte [esp + 0xa70], 2
lea ecx, [esp + 0x14]
call fcn.10005720
mov byte [esp + 0xa70], bl
lea ecx, [esp + 0x824]
call fcn.10006e20
mov eax, ebp
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.1010190d
add esp, 0xa60
ret
Function at 0x100b4f80
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
cmp dword [0x101c645c], 0
jne 0x100b4f9f
mov eax, dword [0x101b1e60]
push eax
call fcn.10041670
add esp, 4
mov dword [0x101c645c], eax
test bl, bl
mov edx, dword [0x101b1e60]
test esi, esi
push eax
pop eax
test eax, 0xb04
mov al, al
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov dword [esp], ecx
mov ecx, dword [esp]
add ecx, 0xc
test ecx, ecx
mov eax, dword [ecx]
mov ah, ah
mov edx, edx
cmp edx, dword [eax + 0x18]
je 0x100b4fdc
mov eax, dword [eax]
mov dh, dh
cmp ecx, eax
jne 0x100b4fc8
jmp 0x100b5070
mov dword [0x101c17c8], eax
push ecx
pop ecx
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov dword [0x101c17cc], edx
test ebx, ebx
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [0x101c17d0], edx
test al, al
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx]
mov dword [0x101c17d4], edx
mov dl, dl
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 4]
mov dword [0x101c17d8], edx
mov ah, ah
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [0x101c17dc], edx
mov dl, dl
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov dword [0x101c17e0], edx
test al, al
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ecx], edx
test ch, ch
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
test al, al
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
mov dword [ecx], edx
test esi, esi
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov dword [ecx + 4], edx
test esi, esi
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov dword [ecx], edx
push ecx
pop ecx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [ecx + 4], edx
test eax, eax
mov cl, cl
pop ecx
ret

Function at 0x100b6330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x101af0fc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dl, dl
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.10102a00
add esp, 0xc
test edx, edx
lea ecx, [ebp - 0x810]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsA]
mov dword [ebp - 0xc], eax
test bh, bh
cmp dword [ebp - 0xc], 0
jne 0x100b6381
xor eax, eax
jmp 0x100b6409
mov dword [ebp - 4], 0
mov ah, ah
lea edx, [ebp - 0x810]
mov dword [ebp - 8], edx
mov edi, edi
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100b6406
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
test dl, dl
mov eax, dword [ebp - 8]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
add ecx, 1
mov dword [ebp - 0x818], ecx
mov edx, dword [ebp - 0x814]
mov al, byte [edx]
mov byte [ebp - 0x819], al
add dword [ebp - 0x814], 1
cmp byte [ebp - 0x819], 0
jne 0x100b63c2
mov ecx, dword [ebp - 0x814]
sub ecx, dword [ebp - 0x818]
mov dword [ebp - 0x820], ecx
mov edx, dword [ebp - 0x820]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 1]
mov dword [ebp - 8], ecx
test al, al
jmp 0x100b6395
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1010190d
mov esp, ebp
pop ebp
ret