joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x10182014]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov edi, edx
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x100d2e4e
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x100d2e56
mov esi, dword [esi]
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100d2eb6
xor eax, eax
lea edx, [esp + 0xc]
mov word [esp + 0x216], ax
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100d2e80
sub edx, esi
lea eax, [esp + 0xc]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.100044e0
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.1011730d
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011730d
add esp, 0x210
ret

Function at 0x100d3350
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10137c96
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x10182014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x81c], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call edi
mov ebx, eax
test ebx, ebx
je 0x100d342b
lea edx, [ebp - 0x810]
mov dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x818], edx
call fcn.10028240
mov dword [ebp - 4], 0
cmp ebx, 0x3fe
jbe 0x100d3449
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10117d14
add esp, 4
lea ecx, [ebp - 0x814]
mov esi, eax
mov dword [ebp - 0x818], esi
push esi
call fcn.10028250
push esi
push ebx
call edi
test eax, eax
je 0x100d3419
cmp eax, ebx
ja 0x100d3419
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [edx + eax*2], ecx
jmp 0x100d3473
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.10028230
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011730d
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x100d34ea
xor ecx, ecx
mov word [ebp + eax - 0x810], cx
add eax, 2
cmp eax, 0x800
jae 0x100d34ea
mov word [ebp + eax - 0x810], cx
xor eax, eax
xor esi, esi
test ebx, ebx
je 0x100d34d1
mov edi, 2
cmp word [edx + edi - 2], 0
jne 0x100d34c9
cmp eax, esi
je 0x100d34c9
lea eax, [edx + eax*2]
push eax
lea ecx, [ebp - 0x834]
call fcn.10004430
mov byte [ebp - 4], 1
lea eax, [ebp - 0x834]
mov ecx, dword [ebp - 0x81c]
push eax
call fcn.10007160
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x834]
call fcn.10004480
mov edx, dword [ebp - 0x818]
lea eax, [esi + 1]
inc esi
add edi, 2
cmp esi, ebx
jb 0x100d3480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x814]
call fcn.10028230
mov al, 1
jmp 0x100d342d
call fcn.10117c3a
int3
Function at 0x100d6170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10138498
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10182014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov esi, dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
push 2
push 0xffffffffffffffff
push 0xffff8000
movlpd qword [ebp - 0x3c], xmm0
call fcn.100c18c0
test al, al
jne 0x100d61d0
mov eax, 1
jmp 0x100d634d
push 0x10000
call fcn.10117d14
mov ebx, eax
mov dword [ebp - 0x18], 0
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
push 0x10000
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x100d6326
test ebx, ebx
je 0x100d6326
cmp dword [eax], 0xffffffff
je 0x100d6326
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100d6326
mov esi, dword [ebp - 0x20]
mov ecx, 0x8000
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], ecx
add esi, ecx
nop word [eax + eax]
cmp byte [edi + 0x9c], 0
jne 0x100d631c
lea edx, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push edx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push edx
push ecx
mov ecx, dword [ebp - 0x34]
lea eax, [esi + ebx]
push eax
call fcn.10115190
test al, al
je 0x100d630f
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x100d62c2
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x100d62b1
push 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [edi + 0x9c], 0
jne 0x100d631c
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
jmp 0x100d62cc
add ebx, eax
cmp ebx, 0x8000
je 0x100d62dc
cmp dword [ebp - 0x28], 0xf
ja 0x100d6305
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
jne 0x100d6260
mov ebx, dword [ebp - 0x20]
mov edx, 0x7ffc
mov ecx, ebx
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x100d62fe
add ecx, 4
add esi, 4
sub edx, 4
jae 0x100d62e6
mov esi, 4
jmp 0x100d6337
mov esi, 5
jmp 0x100d6337
mov ebx, dword [ebp - 0x20]
mov esi, 3
jmp 0x100d6337
mov eax, dword [ebp - 0x30]
mov esi, 3
mov ebx, dword [ebp - 0x20]
jmp 0x100d6331
mov ebx, dword [ebp - 0x20]
mov esi, 2
jmp 0x100d6337
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
mov dword [edi + 0xb0], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100d634b
push ebx
call fcn.10117b14
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1011730d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100da800
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10135f2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10182014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.10007920
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.10007920
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10007920
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10007920
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10007920
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10007920
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100dc3e0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10139268
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10182014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x100dc429
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x100dc57b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x100dc546
test eax, eax
je 0x100dc546
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x100dc549
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100dc4cb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100dc4bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100dc4cb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100dc4d9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10007920
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x100dc546
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x100dc484
jmp 0x100dc549
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x100dc572
test edx, edx
je 0x100dc56e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x100dc440
mov al, 1
jmp 0x100dc57d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100dc57b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011730d
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100ebca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013b340
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10182014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp eax, 2
jne 0x100ebd56
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
mov esi, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x100ebd2e
push ecx
mov ecx, esi
call fcn.1002c1d0
mov dword [esi], vtable.Gdiplus::Image.0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
movzx eax, word [ebp + 0xc]
push eax
push edi
mov dword [esi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 0x14], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromResource]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov byte [ebp - 4], 0
jmp 0x100ebd30
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
mov ecx, ebx
call fcn.100ebe40
mov ecx, dword [ebx]
mov eax, dword [ecx + 8]
test eax, eax
mov dword [ecx + 8], 0
sete al
jmp 0x100ebe1d
push eax
movzx eax, word [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x100ebe1b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100ebe1b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x100ebe1b
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100ebe14
push dword [ebp - 0x18]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x100ebe14
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x100ebe0d
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 1
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x100ebe0d
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100ebe0d
call fcn.1003cf40
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x100ebd39
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1011730d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ec460
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013b536
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x10182014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.RC::ICoolPopupMenu.0
mov dword [ebp - 4], 0
mov dword [edi], vtable.RC::RCCoolPopupMenu.1.0
mov dword [edi + 4], vtable.RC::RCCoolPopupMenu.0
mov dword [edi + 8], vtable.RC::RCCoolPopupMenu.2.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0xffffffff
mov dword [edi + 0x50], 0xffffffff
mov dword [edi + 0x54], 0x16
mov dword [edi + 0x58], 0xffffffff
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0xffffffff
mov dword [edi + 0x74], 0xffffffff
mov dword [edi + 0x78], 0
mov word [edi + 0x7c], 0x100
mov byte [edi + 0x7e], 0
mov dword [edi + 0x80], 0xffffffff
mov dword [edi + 0x84], 0xffffffff
mov dword [edi + 0x88], 0xffffffff
mov dword [edi + 0x8c], 0x1000000
mov byte [edi + 0x90], 0
mov dword [edi + 0x94], 0xffffffff
mov dword [edi + 0x98], 0xffffffff
mov dword [edi + 0x9c], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xb4], 0
mov byte [edi + 0xb8], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xf4], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 0
mov byte [ebp - 4], 1
cmp word [0x10185b7c], 0
movsd xmm0, qword [0x10154580]
movsd qword [edi + 0x130], xmm0
jne 0x100ec663
call fcn.100ee9f0
mov word [0x10185b7c], ax
lea eax, [edi + 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0xc4]
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
lea eax, [edi + 0x120]
mov dword [edi + 0xf0], 0
push eax
mov dword [edi + 0xec], 0
mov word [edi + 0x8c], 0
mov byte [edi + 0x8e], 0
mov dword [edi + 0x100], 0
mov dword [edi + 0x104], 0
mov dword [edi + 0x108], 0
mov dword [edi + 0x10c], 0
mov dword [edi + 0x110], 0
mov dword [edi + 0x114], 0
mov dword [edi + 0x118], 0
mov dword [edi + 0x11c], 0
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100f4760
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0xa8
mov eax, dword [0x10182014]
xor eax, esp
mov dword [esp + 0xa4], eax
push edi
mov edi, edx
mov byte [esp + 7], cl
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x100f47a0
xor eax, eax
pop edi
mov ecx, dword [esp + 0xa4]
xor ecx, esp
call fcn.1011730d
add esp, 0xa8
ret
mov cl, byte [esp + 7]
push ebx
push ebp
xor ebp, ebp
lea eax, [ecx - 0x70]
push esi
movzx esi, cl
lea ebx, [ebp + 8]
cmp al, 0xb
ja 0x100f47ce
lea eax, [esi - 0x6f]
push eax
push 0x10153b34
push ebx
push edi
call fcn.1002c100
add esp, 0x10
jmp 0x100f48ce
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x100f47eb
push esi
push 0x10153b3c
push 8
push edi
call fcn.1002c100
add esp, 0x10
jmp 0x100f48ce
lea eax, [ecx - 0x60]
cmp al, 9
ja 0x100f480b
lea eax, [esi - 0x60]
push eax
push str.Num_d
push 8
push edi
call fcn.1002c100
add esp, 0x10
jmp 0x100f48ce
sub cl, 0x30
cmp cl, 9
ja 0x100f482c
lea eax, [esi - 0x30]
push eax
push 0x101427e4
push 8
push edi
call fcn.1002c100
add esp, 0x10
jmp 0x100f48ce
lea eax, [esi - 0x25]
cmp eax, 0x98
ja case.0x100f483d.41
movzx eax, byte [eax + 0x100f4948]
jmp dword [eax*4 + 0x100f4920]
push 0x10153b50
jmp 0x100f48c5
push 0x1014a740
jmp 0x100f48c5
push 0x1014a76c
jmp 0x100f48c5
push 0x1014bbe4
jmp 0x100f48c5
push 0x10153b54
jmp 0x100f48c5
push 0x10153b5c
jmp 0x100f48c5
push 0x10153b60
jmp 0x100f48c5
push 0x10153b64
jmp 0x100f48c5
push 0x10153b68
jmp 0x100f48c5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
push 0xa0
mov esi, eax
lea eax, [esp + 0x18]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
shl esi, 0x10
lea eax, [esp + 0x14]
push 0x50
push eax
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jle 0x100f48fd
lea eax, [esp + 0x14]
push eax
mov edx, ebx
mov ecx, edi
call fcn.10007d90
test eax, eax
je 0x100f48d9
cmp eax, 0x8007007a
jne 0x100f48fd
test edi, edi
je 0x100f48fb
mov eax, ebx
nop
cmp word [edi], bp
je 0x100f48ed
add edi, 2
sub eax, 1
jne 0x100f48e0
sub ebx, eax
mov ebp, eax
neg ebp
sbb ebp, ebp
and ebp, ebx
test eax, eax
jne 0x100f48fd
xor ebp, ebp
mov ecx, dword [esp + 0xb4]
xor eax, eax
cmp eax, ebp
pop esi
sbb eax, eax
and eax, ebp
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.1011730d
add esp, 0xa8
ret
Function at 0x100f7f00
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x100f7f5c
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindowVisible]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
nop
push dword [esi + 0x14]
call ebx
test eax, eax
je 0x100f7f39
push dword [esi + 0x14]
call ebp
test eax, eax
je 0x100f7f39
push 0
push dword [esi + 0x14]
call edi
push dword [esi + 0x10]
call ebx
test eax, eax
je 0x100f7f52
push dword [esi + 0x10]
call ebp
test eax, eax
je 0x100f7f52
push 0
push dword [esi + 0x10]
call edi
mov esi, dword [esi + 0x2c]
test esi, esi
jne 0x100f7f20
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x100fffc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013cfc0
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x10182014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
mov dword [ebp - 4], eax
cmp byte [esi + 0x120], al
je 0x10100052
mov eax, dword [esi + 0xcc]
cmp eax, 5
je 0x10100032
cmp eax, 6
je 0x10100032
cmp eax, 7
jne 0x10100052
lea eax, [esi + 0x58]
lea ecx, [ebp - 0x44]
cmp ecx, eax
je 0x10100052
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x10100046
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x44]
call fcn.100044e0
lea eax, [edi + 0x70]
push eax
lea ecx, [ebp - 0x74]
call fcn.10007920
mov byte [ebp - 4], 1
lea edx, [ebp - 0x74]
push dword [esi]
lea ecx, [ebp - 0x5c]
call fcn.10101960
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x4c], 0
je 0x1010011b
lea ecx, [ebp - 0x5c]
call fcn.100b2870
test al, al
je 0x1010011b
lea ecx, [esi + 0x70]
mov bl, 1
call fcn.100b2780
test al, al
je 0x101000ac
lea ecx, [esi + 0x70]
call fcn.100d2c00
neg al
sbb al, al
and bl, al
cmp dword [ebp - 0x34], 0
je 0x101000c0
lea ecx, [ebp - 0x44]
call fcn.100d2c00
neg al
sbb al, al
and bl, al
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmovae eax, dword [ebp - 0x5c]
push eax
call esi
test eax, eax
jne 0x1010011d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x5c]
call fcn.100d3120
test al, al
je 0x1010010d
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.10004480
jmp 0x1010011d
mov bl, 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.10004480
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x74]
call fcn.10004480
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.10004480
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1011730d
mov esp, ebp
pop ebp
ret 4
Function at 0x1010ce80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013ee76
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10182014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0x18
mov dword [edi], 0xbb8
mov dword [edi + 4], 0x3e80
mov dword [edi + 8], 0xafc8
mov dword [edi + 0xc], 0x3e8
mov word [edi + 0x10], 0
call fcn.1011732c
mov dword [edi + 0x14], eax
add esp, 4
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [edi + 0x14]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
push 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [ebp - 0x14], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10101620
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1010d030
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ecx
push ebx
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
mov word [edi + 0x10], 0
mov eax, dword [ecx]
or eax, dword [ecx + 4]
je 0x1010d056
lea ecx, [edi + 0x14]
call fcn.1010d580
add dword [edi + 0x18], eax
mov ecx, dword [edi + 0x14]
adc dword [edi + 0x1c], edx
lea eax, [ecx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov word [edi + 0x10], 1
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [edi + 0x14]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi + 0x14]
mov ecx, edi
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call fcn.1010d0b0
pop edi
pop ebx
pop ecx
ret
Function at 0x10111f90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x10111f9b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10111fb0