joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a92e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x103ac154], 2
jne 0x100a935b
mov edx, dword [0x103a7108]
mov eax, dword [0x103a7104]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x103a710c]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.100a8170
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x103ac150], 1
mov dword [0x103ac154], 3
call esi
mov dword [0x103ac158], eax
call esi
mov dword [0x103ac15c], eax
mov eax, 0x7530
mov dword [0x103ac160], eax
mov dword [0x103ac164], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a9360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x103ac154], 3
push esi
jne 0x100a9394
cmp dword [0x103ac16c], ebx
je 0x100a9394
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.100a8170
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x103ac150], ebx
mov dword [0x103ac154], ebx
call esi
mov dword [0x103ac158], eax
call esi
pop esi
mov dword [0x103ac160], ebx
mov dword [0x103ac164], ebx
mov dword [0x103ac168], ebx
mov dword [0x103ac16c], ebx
mov dword [0x103ac15c], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a96e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
fld dword [ebp + 0xc]
push ebx
push esi
fld st(0)
push edi
call fcn.100c10b0
fld dword [ebp + 8]
fld st(0)
movzx ebx, ax
call fcn.100c10b0
mov edi, dword [0x879340c]
fld dword [ebp + 0x14]
movzx eax, ax
fld dword [ebp + 0x10]
movsx esi, ax
cmp edi, esi
jl 0x100a9871
fld st(0)
fdiv dword [0xe7c3d4]
call fcn.100c10b0
cwde
add eax, esi
cmp edi, eax
jg 0x100a9871
mov edi, dword [0x8793410]
movsx esi, bx
cmp edi, esi
jl 0x100a9871
fild dword [0xe61e58]
fild dword [0xe61e5c]
fmul qword [0x100d1d90]
fdivp st(1)
fstp dword [ebp - 4]
fld dword [ebp - 4]
fld st(2)
fdiv dword [0xe7c3d4]
fmulp st(1)
call fcn.100c10b0
movsx ecx, ax
add ecx, esi
cmp edi, ecx
jg 0x100a9871
fstp st(1)
push 1
fstp st(0)
fstp st(1)
fstp st(0)
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
push ecx
test dx, ax
je 0x100a97f3
fld dword [ebp + 0x14]
mov eax, 0x637c60
fld st(0)
fdiv dword [ebp + 0x1c]
fstp dword [ebp - 4]
fldz
fst dword [esp]
fld dword [ebp - 4]
push 1
push 0
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 0x18]
fxch st(1)
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7abb
call eax
jmp 0x100a9854
fld dword [0x100d1ee8]
mov ecx, 0x637c60
fstp dword [esp]
push 1
fld dword [ebp + 0x14]
push 0
fld st(0)
sub esp, 0x20
fdiv dword [ebp + 0x1c]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fstp dword [esp + 0x18]
fldz
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7abb
call ecx
add esp, 0x30
push 1
mov edx, 0x791050
call edx
add esp, 4
test al, al
pop edi
setne al
pop esi
inc al
pop ebx
mov esp, ebp
pop ebp
ret
fldz
push ecx
fst dword [esp]
mov eax, 0x637c60
fld st(2)
push 1
fdiv dword [ebp + 0x1c]
push 0
sub esp, 0x20
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp dword [esp + 0x1c]
fld st(1)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0xc]
fld dword [ebp + 0xc]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
push 0x7abb
call eax
add esp, 0x30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100aa690
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 0x14]
push ebx
push esi
fld st(0)
push edi
call fcn.100c10b0
fld dword [ebp + 0x10]
fld st(0)
movzx ebx, ax
call fcn.100c10b0
mov edi, dword [0x879340c]
fld dword [ebp + 0x1c]
movzx eax, ax
fld dword [ebp + 0x18]
movsx esi, ax
cmp edi, esi
jl 0x100aa804
fld st(0)
call fcn.100c10b0
cwde
add eax, esi
cmp edi, eax
jg 0x100aa804
mov edi, dword [0x8793410]
movsx esi, bx
cmp edi, esi
jl 0x100aa804
fld st(1)
call fcn.100c10b0
movsx ecx, ax
add ecx, esi
cmp edi, ecx
jg 0x100aa804
fstp st(3)
push 1
fstp st(1)
fstp st(0)
fstp st(0)
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x24]
mov edx, 0x8000
fdiv dword [ebp + 0x2c]
push ecx
test dx, ax
je 0x100aa77f
fldz
mov eax, dword [ebp + 0xc]
fst dword [esp]
mov ecx, 0x637c60
push 1
fxch st(1)
fst dword [ebp + 0x24]
push 0
fld dword [ebp + 0x24]
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x20]
fdiv dword [ebp + 0x28]
fstp dword [ebp + 0x24]
fld dword [ebp + 0x24]
fstp dword [esp + 0x18]
fadd st(0), st(0)
fstp dword [ebp + 0x24]
fld dword [ebp + 0x24]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x1c]
fstp dword [esp + 0xc]
fld dword [ebp + 0x18]
fstp dword [esp + 8]
fld dword [ebp + 0x14]
fstp dword [esp + 4]
fld dword [ebp + 0x10]
fstp dword [esp]
push eax
call ecx
jmp 0x100aa7d3
fstp dword [ebp + 0x24]
mov edx, dword [ebp + 0xc]
fldz
mov eax, 0x637c60
fst dword [esp]
fld dword [ebp + 0x24]
push 1
push 0
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x20]
fdiv dword [ebp + 0x28]
fstp dword [ebp + 0x24]
fld dword [ebp + 0x24]
fstp dword [esp + 0x18]
fstp dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [ebp + 0x1c]
fstp dword [esp + 0xc]
fld dword [ebp + 0x18]
fstp dword [esp + 8]
fld dword [ebp + 0x14]
fstp dword [esp + 4]
fld dword [ebp + 0x10]
fstp dword [esp]
push edx
call eax
add esp, 0x30
push 1
mov ecx, 0x791050
call ecx
add esp, 4
test al, al
je 0x100aa85a
push 0
push 0
push 0x19
mov edx, 0x6d6c20
call edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp + 0x30]
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 0x2c
fldz
push ecx
fst dword [esp]
mov ecx, dword [ebp + 0xc]
fld dword [ebp + 0x24]
push 1
fdiv dword [ebp + 0x2c]
push 0
sub esp, 0x20
mov edx, 0x637c60
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x20]
fdiv dword [ebp + 0x28]
fstp dword [ebp + 0x1c]
fld dword [ebp + 0x1c]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fxch st(1)
fstp dword [esp + 4]
fstp dword [esp]
push ecx
call edx
add esp, 0x30
pop edi
pop esi
pop ebx
pop ebp
ret 0x2c
Function at 0x100ab1f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, 7
mov ebx, 0x608cac
call fcn.100b6570
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100ab0f0
push 5
sub eax, 0x608cb1
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100ab254
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100ab25a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 7
mov ebx, 0x60f04c
call fcn.100b6570
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100ab170
push 5
sub ecx, 0x60f051
xor esi, esi
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], esi
call edi
test eax, eax
je 0x100ab2b0
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push ebx
mov dword [ebp - 8], esi
call edi
test eax, eax
jne 0x100ab2b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100ac710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 8
push esi
call edi
fld qword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp qword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 8
push esi
call edi
pop edi
pop esi
pop ebp
ret
Function at 0x100b1080
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x103676f0]
cmp eax, 0x927c0
jb 0x100b10a3
call esi
mov dword [0x103676f0], eax
cmp dword [0x103676ac], 0
je 0x100b116e
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
mov eax, dword [0x103676bc]
mov ecx, dword [0x103676c0]
mov esi, eax
cmp eax, ecx
je 0x100b1100
push 0
push ecx
push eax
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov dword [0x103676c0], esi
push 0
mov dword [0x103a99f0], 0xffffffff
call dword [sym.imp.USER32.dll_GetDC]
push 0
push 0x100b0da0
push 0
push eax
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
test eax, eax
je 0x100b1150
mov edx, dword [0x103676bc]
cmp edx, dword [0x103676c0]
je 0x100b1150
push 0x103676bc
call fcn.100b1180
mov eax, dword [ebp - 4]
add esp, 4
push eax
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop esi
mov esp, ebp
pop ebp
ret
push str.SOMETHING_WENT_WRONG._Terrible_sorry...
push 0
mov ecx, 0x1027c400
call fcn.10090540
mov eax, dword [ebp - 4]
add esp, 8
push eax
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100b2550
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x100b2360
push 0x4d763b
mov bl, 0xe9
call fcn.100b6700
push 0x100b2460
push 0x4d7765
call fcn.100b6700
push 0x100b2520
push 0x50382d
call fcn.100b6700
push 0x100b2350
push 0x4d7eb1
mov bl, 0xe8
call fcn.100b6700
push 0x100b1620
push 0x4d76fb
call fcn.100b6700
push 0x100b1620
push 0x4d79c3
call fcn.100b6700
push 0x100b1620
push 0x4d712a
call fcn.100b6700
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x38
lea eax, [ebp - 4]
push eax
push 0x40
push 4
xor ebx, ebx
push 0x4d75f0
mov esi, 0x37
mov dword [ebp - 4], ebx
call edi
test eax, eax
je 0x100b2607
mov ecx, 0x4d75f0
mov dword [ecx], esi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x100b260d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b3650
Capabilities:
Encode data using xor
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x100d9018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.____________________________________________________________________________________________________
push 0
mov ecx, 0x1027c400
call fcn.10090540
push 0x94
lea eax, [ebp - 0xe0]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0x14
lea ecx, [ebp - 0xe0]
push ecx
mov dword [ebp - 0xe0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea edx, [ebp - 0x48]
push edx
mov dword [ebp - 0x48], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0x100
push 0
push 0x103e4c78
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x100c5b30]
sub cl, 0x1b
xor cl, 0xc
mov byte [eax + 0x103e4c78], cl
inc eax
cmp eax, 0x100
jb 0x100b36d0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov esi, ecx
mov edx, eax
shrd edx, esi, 0x14
shr esi, 0x14
sub eax, dword [ebp - 0x38]
push edx
sbb ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0xdc]
shrd eax, ecx, 0x14
push eax
mov eax, dword [ebp - 0xd4]
push eax
shr ecx, 0x14
mov ecx, dword [ebp - 0xd8]
push ecx
push edx
push str.PREMIUM
push 0x103e4c78
push 0
mov ecx, 0x1027c400
call fcn.10090540
mov ecx, dword [ebp - 4]
add esp, 0x20
xor ecx, ebp
pop esi
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x100b3750
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100d50a8
push 0x100c0b76
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x100d9018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
push ecx
push str..PhysicalDrive_d
lea edx, [ebp - 0x12c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 3
push esi
push 3
push esi
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x148], edi
cmp edi, 0xffffffff
je 0x100b3902
xor eax, eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x134], esi
push esi
lea ecx, [ebp - 0x150]
push ecx
push 8
lea edx, [ebp - 0x140]
push edx
push 0xc
lea eax, [ebp - 0x138]
push eax
push 0x2d1400
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call ebx
test eax, eax
jne 0x100b3834
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100b3902
mov ecx, dword [ebp - 0x13c]
push ecx
call fcn.100c05e0
mov esi, eax
mov dword [ebp - 0x144], esi
mov edx, dword [ebp - 0x13c]
push edx
push 0
push esi
call sub.MSVCR100.dll_memset
add esp, 0x10
push 0
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
push esi
push 0xc
lea edx, [ebp - 0x138]
push edx
push 0x2d1400
push edi
call ebx
test eax, eax
jne 0x100b3893
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
jmp 0x100b3902
mov eax, dword [esi + 0x18]
test eax, eax
je 0x100b3880
mov dword [ebp - 4], 0
add eax, esi
push eax
push 0x100
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x100b3904
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.100c06a6
mov esp, ebp
pop ebp
ret
Function at 0x100b3ba0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c19c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x100d9018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword fs:[0x30]
movzx ecx, byte ds:[eax + 2]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ebx
je 0x100b3bff
push ebx
push 0xa
xor ecx, ecx
call fcn.100422d0
add esp, 8
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], vtable.CProcessQuery.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push 2
push 0x23
lea esi, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.100a6e80
test al, al
mov eax, dword [ebp - 0x1c]
je 0x100b3c59
cmp eax, ebx
je 0x100b3c6c
cmp byte [eax], bl
je 0x100b3c59
cmp byte [eax + 1], bl
jne 0x100b3c59
push ebx
push 0xa
xor ecx, ecx
call fcn.100422d0
add esp, 8
mov ecx, esi
call fcn.100a6e40
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, ebx
je 0x100b3c6c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b5470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, 0x1d
mov ebx, 0x598c7d
call fcn.100b6570
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100b53e0
push 5
sub eax, 0x598c82
push ebx
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call esi
test eax, eax
je 0x100b54d9
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, ebx
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push ebx
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x100b54df
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b6140
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [0x103e4878]
push esi
test eax, eax
jne 0x100b616d
mov eax, dword [0xe8c578]
push 0x100b6290
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x103e4878], eax
test eax, eax
je 0x100b61b8
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x100b619e
mov edx, dword [0xe8c578]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov esi, 0x103e4874
call fcn.100b61c0
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe8c578]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov esi, 0x103e4874
call fcn.100b61c0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b63d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x100b63fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x100b63f3
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b6430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x100b645e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x100b6453
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b6490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
sub eax, esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub eax, 6
mov dword [ebp - 0xe], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push esi
mov word [ebp - 0x10], 0x8f0f
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x100b64cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dx, word [ebp - 0xc]
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 6
push esi
mov word [esi + 4], dx
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x100b64c1
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b6500
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x100b6539
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x100b652e
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100b6570
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx esi, si
push edi
push esi
call fcn.100c05e0
push esi
mov edi, eax
push 0x90
push edi
call sub.MSVCR100.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100b65b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push esi
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100b65aa
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b65f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x100b661e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
fld qword [ebp + 8]
lea ecx, [ebp - 8]
fstp qword [esi]
push ecx
push edx
push 8
push esi
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x100b6613
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b6670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
call edi
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 1
push esi
mov byte [esi], cl
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b66a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push esi
call edi
mov eax, dword [ebp - 4]
mov cx, word [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 2
push esi
mov word [esi], cx
call edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x100b66d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 4]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
call edi
pop edi
mov esp, ebp
pop ebp
ret