joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071880
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1015e581
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x48], ebx
mov esi, dword [esp + 0x50]
mov dword [esp + 0xc], ebx
mov dword [esi + 0x10], esi
mov dword [esp + 0x10], esi
mov dword [esi + 0x14], esi
mov ecx, 1
mov dword [esp + 0x48], ecx
mov eax, dword [esi + 0x10]
mov byte [eax], bl
mov dword [esp + 0x48], ebx
mov dword [esp + 0xc], ecx
push eax
pop eax
push eax
pop eax
mov byte [esp + 0x14], 0x25
mov byte [esp + 0x15], 0x49
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x34
mov byte [esp + 0x18], 0x58
mov byte [esp + 0x19], bl
push edx
pop edx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.100fca00
add esp, 0x10
mov ebp, ebp
lea eax, [esp + 0x1c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10071926
sub eax, edx
lea ecx, [esp + eax + 0x1c]
push ecx
lea edx, [esp + 0x20]
push edx
mov ecx, esi
call fcn.1000b340
mov ebx, ebx
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100fb12a
add esp, 0x40
ret
Function at 0x10079540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1015e919
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov esi, dword [esp + 0xa0]
mov edx, dword [esp + 0xa4]
xor ebx, ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x2c], ebx
mov ecx, ecx
push eax
pop eax
xchg ebx, eax
xchg ebx, eax
cmp dword [edx + 0x32a8], ebx
je 0x10079644
mov dh, dh
mov bh, bh
mov dword [esp + 0x20], ebx
mov al, al
mov ebp, dword [esp + 0xac]
mov edi, dword [esp + 0xa8]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x30]
push ecx
lea eax, [esp + 0x40]
push eax
lea ecx, [ebp + 1]
push ecx
lea eax, [edi + 1]
push eax
push ebp
push edi
push edx
call fcn.100418c0
add esp, 0x28
test eax, eax
jne 0x10079604
lea ecx, [esp + 0x1f]
push ecx
push 0x10165918
mov ecx, esi
call fcn.100091f0
mov dword [esp + 0x98], ebx
jmp 0x1007974c
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov eax, eax
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x2b], cl
mov bh, bh
mov ebx, eax
shr ebx, 8
mov edx, edx
mov byte [esp + 0x1f], al
mov ebx, ebx
mov eax, dword [esp + 0x20]
push eax
call fcn.100fac4f
add esp, 4
mov dword [esp + 0x20], 0
nop
mov dl, byte [esp + 0x2b]
mov cl, byte [esp + 0x1f]
jmp 0x10079679
mov ebp, dword [esp + 0xac]
mov edi, dword [esp + 0xa8]
lea ecx, [esp + 0x14]
push ecx
push ebp
push edi
lea ecx, [esp + 0x24]
call fcn.10071a40
add esp, 0xc
mov ch, ch
mov ecx, eax
shr ecx, 0x10
mov cl, cl
mov ebx, eax
shr ebx, 8
push ecx
pop ecx
mov dl, al
mov edx, edx
cmp dword [esp + 0x14], edi
je 0x10079694
cmp dword [esp + 0x18], ebp
je 0x10079694
lea edx, [esp + 0x1f]
push edx
push 0x10165918
jmp 0x1007973a
xor eax, eax
mov byte [esp + 0x6c], 0
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov dword [esp + 0x79], eax
mov dword [esp + 0x7d], eax
mov dword [esp + 0x81], eax
mov dword [esp + 0x85], eax
mov word [esp + 0x89], ax
mov byte [esp + 0x8b], al
mov dl, dl
mov al, 0x78
mov byte [esp + 0x5c], 0x25
mov byte [esp + 0x5d], 0x30
mov byte [esp + 0x5e], 0x32
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], 0x25
mov byte [esp + 0x61], 0x30
mov byte [esp + 0x62], 0x32
mov byte [esp + 0x63], al
mov byte [esp + 0x64], 0x25
mov byte [esp + 0x65], 0x30
mov byte [esp + 0x66], 0x32
mov byte [esp + 0x67], al
mov byte [esp + 0x68], 0
push edx
pop edx
movzx eax, cl
push eax
movzx ecx, bl
push ecx
movzx edx, dl
push edx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.100fca00
add esp, 0x14
mov ecx, ecx
lea edx, [esp + 0x1f]
push edx
lea eax, [esp + 0x70]
push eax
mov ecx, esi
call fcn.100091f0
mov dword [esp + 0x98], 0
mov dword [esp + 0x2c], 1
mov eax, esi
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.100fb12a
add esp, 0x88
ret
Function at 0x10081b90
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015eddd
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x184]
mov edx, dword [esp + 0x180]
mov eax, dword [esp + 0x17c]
mov esi, dword [esp + 0x178]
push ecx
push edx
push eax
lea eax, [esp + 0x3c]
xor ebx, ebx
push eax
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
call fcn.10079540
add esp, 0x10
mov dword [esp + 0x170], 1
nop
push eax
pop eax
push 0xff
lea ecx, [esp + 0x69]
push ebx
push ecx
mov byte [esp + 0x70], bl
call fcn.100fbc20
add esp, 0xc
mov ch, ch
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
mov bh, bh
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], ebx
push ebx
pop ebx
mov dl, 0x30
mov cl, 0x32
mov al, 0x78
mov byte [esp + 0x54], 0x25
mov byte [esp + 0x55], dl
mov byte [esp + 0x56], cl
mov byte [esp + 0x57], al
mov byte [esp + 0x58], 0x25
mov byte [esp + 0x59], dl
mov byte [esp + 0x5a], cl
mov byte [esp + 0x5b], al
mov byte [esp + 0x5c], 0x25
mov byte [esp + 0x5d], dl
mov byte [esp + 0x5e], cl
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], bl
mov al, al
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x60]
push edx
push eax
call fcn.100fd75d
add esp, 0x14
mov ebp, ebp
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.1003b290
add esp, 0x18
xchg ebx, eax
xchg ebx, eax
mov al, 0x64
mov byte [esp + 0x48], 0x25
mov byte [esp + 0x49], al
mov cl, 0x2e
mov byte [esp + 0x4a], cl
mov byte [esp + 0x4b], 0x25
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], cl
mov byte [esp + 0x4e], 0x25
mov byte [esp + 0x4f], al
mov byte [esp + 0x50], bl
mov dh, dh
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x74]
push edx
call fcn.100fca00
add esp, 0x14
mov ah, ah
lea eax, [esp + 0x27]
push eax
lea ecx, [esp + 0x68]
push ecx
mov ecx, esi
call fcn.100091f0
mov dword [esp + 0x28], 1
mov byte [esp + 0x170], bl
lea ecx, [esp + 0x30]
call fcn.100068e0
mov eax, esi
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.100fb12a
add esp, 0x168
ret
Function at 0x10081d70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1015ee31
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
push eax
push ecx
lea edx, [esp + 0x1c]
push edi
push edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0
call fcn.10079540
add esp, 0x10
mov dword [esp + 0x38], 1
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esp + 0x28]
push eax
push edi
push esi
call fcn.10062140
add esp, 0xc
mov dword [esp + 0xc], 1
mov byte [esp + 0x38], 0
lea ecx, [esp + 0x14]
call fcn.100068e0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.100fb12a
add esp, 0x30
ret

Function at 0x10082360
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015eec2
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x140]
mov eax, dword [esp + 0x144]
xor ebx, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
mov eax, eax
xor esi, esi
xor edi, edi
nop
cmp dword [esp + 0x150], ebx
jle 0x100823f2
cmp dword [esp + 0x154], ebx
jle 0x100823f2
call fcn.100fdcbc
cdq
idiv dword [esp + 0x150]
mov edi, edx
mov cl, cl
call fcn.100fdcbc
cdq
idiv dword [esp + 0x154]
mov esi, edx
push ebx
pop ebx
push 0xff
lea ecx, [esp + 0x31]
push ebx
push ecx
mov byte [esp + 0x38], bl
call fcn.100fbc20
add esp, 0xc
push edx
pop edx
mov cl, 0x25
mov al, 0x64
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], al
mov byte [esp + 0x26], 0x2c
mov byte [esp + 0x27], cl
mov byte [esp + 0x28], al
mov byte [esp + 0x29], bl
mov cl, cl
mov edx, dword [esp + 0x14c]
mov eax, dword [esp + 0x148]
add esi, edx
push esi
add edi, eax
push edi
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.100fca00
add esp, 0x10
mov bh, bh
mov eax, dword [esp + 0x1c]
push esi
push edi
push eax
call fcn.10081e20
add esp, 0xc
mov ch, ch
lea ecx, [esp + 0x17]
push ecx
lea edx, [esp + 0x30]
push edx
mov ecx, ebp
call fcn.100091f0
mov dword [esp + 0x138], ebx
mov dword [esp + 0x18], 1
mov eax, ebp
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.100fb12a
add esp, 0x128
ret
Function at 0x10082a30
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015ef7b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe0]
mov esi, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
mov edi, dword [esp + 0xd0]
push ecx
push edx
push esi
push eax
mov eax, dword [esp + 0xe4]
push eax
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], 0
call fcn.1007cb20
add esp, 0x18
mov dword [esp + 0xc8], 1
mov ch, ch
lea ecx, [esp + 0x1c]
call fcn.100ece68
mov byte [esp + 0xc8], 2
mov ecx, ecx
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call fcn.100564f0
add esp, 0xc
mov esi, esi
lea ecx, [esp + 0x38]
mov edx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov byte [esp + 0xc8], 3
mov eax, dword [esp + 0x48]
mov byte [eax], 0
mov byte [esp + 0xc8], 4
push ecx
pop ecx
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x10082b23
push ecx
mov ecx, edi
call fcn.10009270
jmp 0x10082c36
test esi, esi
je 0x10082bf9
cmp esi, 2
je 0x10082bf9
cmp esi, 3
je 0x10082bf9
cmp esi, 1
jne 0x10082c2a
nop
mov bl, 0x64
mov byte [esp + 0x70], 0x25
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x2c
mov byte [esp + 0x73], 0x25
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], 0x2c
mov byte [esp + 0x76], 0x25
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0
mov ebx, ebx
cmp dword [esp + 0x24], 0
jg 0x10082b81
jmp fcn.100e9bf9
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x7c]
push edx
push eax
call fcn.100fd75d
add esp, 0x14
mov eax, eax
mov ch, ch
mov byte [esp + 0x68], 0x25
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], 0x2c
mov byte [esp + 0x6b], 0x25
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], 0
mov edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.100fca00
add esp, 0x10
push ecx
pop ecx
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x3c]
call fcn.1000f580
mov eax, eax
jmp 0x10082c2a
test eax, eax
jg 0x10082c02
jmp fcn.100e9bf9
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10082c10
sub eax, esi
add eax, edx
push eax
push edx
lea ecx, [esp + 0x40]
call fcn.1000b340
mov bl, bl
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.10009270
mov dword [esp + 0x30], 1
mov byte [esp + 0xc8], 2
lea ecx, [esp + 0x38]
call fcn.100068e0
mov byte [esp + 0xc8], 1
lea ecx, [esp + 0x1c]
call fcn.100ed1b0
mov byte [esp + 0xc8], 0
lea ecx, [esp + 0x50]
call fcn.100068e0
mov eax, edi
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.100fb12a
add esp, 0xbc
ret
Function at 0x100855b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push edi
push ebx
pop ebx
mov dh, dh
push eax
pop eax
mov edi, dword [esp + 0x1c]
push 5
push edi
call fcn.100522e0
add esp, 8
mov al, al
test eax, eax
jne 0x100855d6
mov eax, edi
pop edi
add esp, 0x14
ret
push ebx
push ebp
push esi
push 0
push eax
call fcn.100522e0
add esp, 8
mov esi, eax
push edx
pop edx
mov eax, eax
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
mov ah, ah
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100856a4
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
nop
mov edi, esi
push eax
pop eax
test ebx, ebx
jne 0x10085623
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10085648
mov esi, esi
lea eax, [esp + 0x14]
push eax
push esi
call ebp
push ebx
pop ebx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x10085684
push 2
push esi
call fcn.100522e0
add esp, 8
mov esi, eax
mov ch, ch
cmp edi, esi
je 0x100856a4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ch, ch
sub eax, dword [esp + 0x10]
cmp eax, dword [0x1019b8c4]
jae 0x100856a0
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10085610
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push esi
call fcn.100855b0
add esp, 0x10
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret
xor edi, edi
mov bh, bh
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x10085dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [esp + 0x28]
jne 0x10085e66
cmp dword [esi], 0
je 0x10085e66
mov al, 0x69
mov dl, 0x54
mov cl, 0x6f
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x1a], 0
push edx
pop edx
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esi + 0x10], eax
mov ecx, ecx
mov esi, dword [esi + 0x10]
test esi, esi
je 0x10085e8a
push 1
push edi
call esi
mov dh, dh
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100fb12a
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100fb12a
add esp, 0x18
ret

Function at 0x10085ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push edi
xor edi, edi
mov esi, esi
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0x14
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov ebp, ebp
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x33
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0
xchg ebx, eax
xchg ebx, eax
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov dl, dl
test esi, esi
je 0x10085f9d
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0x57
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x77
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], 0x78
mov byte [esp + 0x35], 0
mov dh, dh
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov eax, eax
test eax, eax
je 0x10085f94
lea ecx, [esp + 8]
push ecx
call eax
push ecx
pop ecx
mov edi, 1
mov edx, edx
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push eax
pop eax
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100fb12a
add esp, 0x34
ret
Function at 0x10086650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, esi
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
push ebx
pop ebx
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
mov dl, dl
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
mov edi, edi
test esi, esi
jne 0x1008671d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100fb12a
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
mov dl, dl
mov bh, bh
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.100fbc20
add esp, 0xc
mov esi, esi
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x10086755
mov edi, dword [esp + 0x34]
mov ebp, ebp
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ah, ah
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100fb12a
add esp, 0x5c
ret
Function at 0x10089450
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1015f41b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101b03d4]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b03d4]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
mov ah, ah
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov ch, ch
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100894cb
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x100894cb
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100894cb
cmp esi, edi
je 0x100894cb
mov eax, esi
jmp 0x10089649
push 5
push edi
call fcn.100522e0
add esp, 8
nop
xor ebx, ebx
push ebx
push eax
call fcn.100522e0
add esp, 8
mov edi, eax
mov dl, dl
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
mov ah, ah
mov esi, edi
push ebx
pop ebx
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
mov edi, edi
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10089647
nop
mov edi, esi
mov ebx, ebx
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1008960f
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008960f
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.100fbc20
add esp, 0xc
mov bl, bl
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100892f0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x100895b0
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.100068e0
mov al, al
push esi
call dword [sym.imp.USER32.dll_GetParent]
nop
cmp eax, ebx
jne 0x1008960f
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10089606
cmp dl, bl
je 0x10089602
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10089606
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100895e6
xor eax, eax
jmp 0x1008960b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10089647
push 2
push esi
call fcn.100522e0
add esp, 8
mov esi, eax
mov ecx, ecx
cmp edi, esi
je 0x10089647
call ebp
push ebx
pop ebx
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019b8c4]
jae 0x10089643
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10089550
jmp 0x10089647
xor edi, edi
push ebx
pop ebx
mov eax, edi
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100fb12a
add esp, 0x13c
ret
Function at 0x10089680
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.10089450
add esp, 4
mov esi, eax
mov dh, dh
test esi, esi
je 0x100896e6
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100896e6
push ebx
push ebp
push edi
xchg ebx, eax
xchg ebx, eax
push 0
push esi
call fcn.100522a0
add esp, 8
mov esi, eax
mov bl, bl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov dh, dh
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
push ecx
pop ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov bl, bl
push 0
push esi
push edi
call ebx
mov ah, ah
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret