joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ab8a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push edi
cmp dword [0x101d08ec], 0xffffd18d
mov bl, bl
cmp dword [0x101d08f0], 0x1cea
mov edi, dword [esp + 0x1c]
push 5
push edi
call fcn.100724c0
add esp, 8
cmp dword [0x101d08e8], 0x76a2
test eax, eax
jne 0x100ab8de
mov eax, edi
pop edi
add esp, 0x14
ret
push ebx
push ebp
push esi
push 0
push eax
call fcn.100724c0
add esp, 8
mov esi, eax
push ebx
pop ebx
mov ah, ah
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
mov cl, cl
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100ab9d8
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x100ab920
mov edi, esi
cmp dword [0x101d08e0], 0xffff917c
test ebx, ebx
jne 0x100ab93b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100ab968
cmp dword [0x101d08f0], 0x1cea
lea eax, [esp + 0x14]
push eax
push esi
call ebp
mov edi, edi
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x100ab9b8
push 2
push esi
call fcn.100724c0
add esp, 8
mov esi, eax
cmp dword [0x101d08f4], 0x78fa
cmp edi, esi
je 0x100ab9d8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101d08fc], 0xfffff233
sub eax, dword [esp + 0x10]
cmp eax, dword [0x101d090c]
jae 0x100ab9d4
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100ab920
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push esi
call fcn.100ab8a0
add esp, 0x10
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret
xor edi, edi
mov cl, cl
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x100ac1e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [esp + 0x28]
jne 0x100ac28e
cmp dword [esi], 0
je 0x100ac28e
mov al, 0x69
mov dl, 0x54
mov cl, 0x6f
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x1a], 0
cmp dword [0x101d08e4], 0x7a3c
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x10], eax
cmp dword [0x101d08e0], 0xffff917c
mov esi, dword [esi + 0x10]
test esi, esi
je 0x100ac2ba
push 1
push edi
call esi
cmp dword [0x101d08f8], 0xffff8d29
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.1012e3ba
add esp, 0x18
ret

Function at 0x100ac2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push edi
xor edi, edi
cmp dword [0x101d08ec], 0xffffd18d
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0x14
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
cmp dword [0x101d08e0], 0x6e83
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x33
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0
cmp dword [0x101d08fc], 0xdcc
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
cmp dword [0x101d0904], 0x301b
test esi, esi
je 0x100ac3f5
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0x57
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x77
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], 0x78
mov byte [esp + 0x35], 0
push edx
pop edx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, eax
test eax, eax
je 0x100ac3ec
lea ecx, [esp + 8]
push ecx
call eax
cmp dword [0x101d08ec], 0xffffd18d
mov edi, 1
push eax
pop eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov bl, bl
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.1012e3ba
add esp, 0x34
ret
Function at 0x100acc30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
mov bl, bl
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
cmp dword [0x101d08fc], 0xfffff233
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
mov edi, edi
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov ebx, ebx
test esi, esi
jne 0x100acd05
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, eax
push eax
pop eax
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08fc], 0xfffff233
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x100acd4d
mov edi, dword [esp + 0x34]
cmp dword [0x101d08e8], 0x76a2
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ch, ch
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1012e3ba
add esp, 0x5c
ret
Function at 0x100ad660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [esp], 0x7a
mov byte [esp + 1], 0x76
mov byte [esp + 2], 0x63
mov byte [esp + 3], 0x56
mov byte [esp + 4], 0x5a
mov byte [esp + 5], 0x62
mov byte [esp + 6], 0x77
mov byte [esp + 7], 0x4c
mov byte [esp + 8], 0x68
mov byte [esp + 9], 0
cmp dword [0x101d0900], 0x4b3e
test eax, eax
je 0x100ad6d3
push eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetPropA]
push ebx
pop ebx
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x10
ret
lea edx, [esp]
push edx
push ecx
call dword [sym.imp.USER32.dll_RemovePropA]
cmp dword [0x101d08e0], 0xffff917c
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x10
ret

Function at 0x100ad700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov byte [esp], 0x7a
mov byte [esp + 1], 0x76
mov byte [esp + 2], 0x63
mov byte [esp + 3], 0x56
mov byte [esp + 4], 0x5a
mov byte [esp + 5], 0x62
mov byte [esp + 6], 0x77
mov byte [esp + 7], 0x4c
mov byte [esp + 8], 0x68
mov byte [esp + 9], 0
cmp dword [0x101d08f8], 0x72d6
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetPropA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x10
ret
Function at 0x100b03d0
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.100b0170
add esp, 4
mov esi, eax
push ecx
pop ecx
test esi, esi
je 0x100b0456
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100b0456
push ebx
push ebp
push edi
cmp dword [0x101d0904], 0xffffcfe4
push 0
push esi
call fcn.10072480
add esp, 8
mov esi, eax
xchg ebx, eax
xchg ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
cmp dword [0x101d08e0], 0x6e83
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
cmp dword [0x101d08f0], 0xffffe315
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
cmp dword [0x101d08e0], 0x6e83
push 0
push esi
push edi
call ebx
mov ch, ch
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100b0980
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x10193bdb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101e5aec]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101e5aec]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x158]
xor ebx, ebx
cmp eax, ebx
jne 0x100b09d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ebp, ebp
jmp 0x100b0b9e
cmp eax, 1
jne 0x100b0b9c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [0x101d0900], 0x4b3e
push 5
push eax
call fcn.100724c0
add esp, 8
cmp dword [0x101d08ec], 0x2e72
push ebx
push eax
call fcn.100724c0
add esp, 8
mov edi, eax
cmp dword [0x101d08e0], 0xffff917c
mov esi, edi
cmp dword [0x101d0904], 0x301b
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
cmp dword [0x101d08f4], 0xffff8705
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
cmp dword [0x101d08e0], 0xffff917c
cmp edi, ebx
je 0x100b0b98
mov edi, esi
push ebx
pop ebx
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x100b0b59
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100b0b59
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.1012ea60
add esp, 0xc
mov ch, ch
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100afff0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
jmp 0x100b0af0
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x100b0af0
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10002070
cmp dword [0x101d08e0], 0xffff917c
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov eax, eax
cmp eax, ebx
jne 0x100b0b59
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100b0b50
cmp dl, bl
je 0x100b0b4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100b0b50
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100b0b30
xor eax, eax
jmp 0x100b0b55
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x100b0b98
push 2
push esi
call fcn.100724c0
add esp, 8
mov esi, eax
cmp dword [0x101d08e0], 0x6e83
call ebp
cmp dword [0x101d08f8], 0x72d6
sub eax, dword [esp + 0x14]
cmp eax, dword [0x101d090c]
jae 0x100b0b94
cmp esi, ebx
jne 0x100b0a92
mov eax, edi
jmp 0x100b0b9e
xor edi, edi
mov dl, dl
mov eax, edi
jmp 0x100b0b9e
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1012e3ba
add esp, 0x13c
ret
Function at 0x100b0f90
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x100b0fac
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push edi
call ebp
test eax, eax
jne 0x100b0fd8
pop edi
xor eax, eax
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call fcn.100b0170
add esp, 4
mov dword [esp + 0x10], eax
cmp dword [0x101d08ec], 0x2e72
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebp
test eax, eax
je 0x100b0fa7
mov edi, dword [esp + 0x10]
push ebx
push esi
push 5
push edi
call fcn.100724c0
add esp, 8
test eax, eax
je 0x100b1087
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov ah, ah
push 0
push edi
call fcn.10072480
add esp, 8
mov edi, eax
cmp dword [0x101d08f4], 0xffff8705
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebx
pop ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
mov edi, edi
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [0x101d08ec], 0x2e72
push ebx
call ebp
test eax, eax
je 0x100b1087
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100b1087
mov esi, ebx
cmp dword [0x101d08f4], 0xffff8705
push ebx
call ebp
test eax, eax
je 0x100b1087
mov edi, dword [sym.imp.USER32.dll_GetParent]
cmp esi, dword [esp + 0x18]
je 0x100b1081
push esi
call edi
mov esi, eax
cmp dword [0x101d0900], 0xffffb4c1
push esi
call ebp
test eax, eax
jne 0x100b1063
jmp 0x100b1087
mov dword [esp + 0x18], ebx
mov cl, cl
mov ebp, dword [esp + 0x1c]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100b1090
sub eax, edx
mov edi, eax
push ecx
pop ecx
lea ebx, [edi + edi + 2]
push ebx
call fcn.1012de1c
add esp, 4
mov esi, eax
cmp dword [0x101d08fc], 0xdcc
test esi, esi
jne 0x100b10c1
pop esi
pop ebx
pop edi
pop ebp
ret
push ebx
push 0
push esi
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d08f8], 0xffff8d29
add edi, 1
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [0x101d08ec], 0x2e72
mov eax, esi
lea edx, [eax + 2]
jmp 0x100b1100
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100b1100
sub eax, edx
sar eax, 1
mov ebx, eax
push ebx
pop ebx
cmp dword [0x101d0900], 0xffffb4c1
xor edi, edi
test ebx, ebx
jle 0x100b116c
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
movzx ecx, word [esi + edi*2]
mov edx, dword [esp + 0x18]
push 0x4000001
push ecx
push 0x102
push edx
call fcn.100724b0
mov dh, dh
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x380c]
test eax, eax
je 0x100b1165
lea ecx, [ebx - 1]
cmp edi, ecx
jge 0x100b1165
push eax
call ebp
mov edi, edi
add edi, 1
cmp edi, ebx
jl 0x100b1130
push esi
call fcn.1012dedf
add esp, 4
mov ah, ah
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
ret
Function at 0x100b1190
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x100b11aa
mov eax, dword [esp + 8]
push eax
call fcn.100b0170
add esp, 4
mov ebx, eax
mov esi, esi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100b11b7
pop ebx
ret
push 5
push ebx
call fcn.100724c0
add esp, 8
test eax, eax
je 0x100b1277
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
cmp dword [0x101d08e4], 0xffff85c3
push 0
push ebx
call fcn.10072480
add esp, 8
mov edi, eax
mov eax, eax
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov bl, bl
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
cmp dword [0x101d08e0], 0x6e83
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [0x101d08f0], 0x1cea
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call edi
test eax, eax
je 0x100b1274
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100b1274
mov esi, ebp
cmp dword [0x101d08e4], 0xffff85c3
push ebp
call edi
test eax, eax
je 0x100b1274
jmp 0x100b1250
cmp esi, ebx
je 0x100b1270
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
cmp dword [0x101d08f8], 0x72d6
push esi
call edi
test eax, eax
jne 0x100b1250
jmp 0x100b1274
mov ebx, ebp
push ebx
pop ebx
pop edi
pop esi
pop ebp
push 0
push 0
push 0x302
push ebx
call fcn.100724b0
cmp dword [0x101d08f0], 0xffffe315
mov eax, 1
pop ebx
ret

Function at 0x100b1920
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push 5
push eax
call fcn.100724c0
add esp, 8
cmp dword [0x101d08f4], 0x78fa
test eax, eax
jne 0x100b1944
add esp, 8
ret
push ebx
push ebp
push esi
push edi
push 0
push eax
call fcn.100724c0
add esp, 8
mov esi, eax
mov cl, cl
mov ah, ah
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
push eax
pop eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100b1a1c
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], esi
mov ecx, ecx
push edi
push ebx
mov ecx, ebp
mov edx, esi
call fcn.100b12a0
add esp, 8
test eax, eax
je 0x100b19b4
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, esi
call fcn.100b12a0
add esp, 8
test eax, eax
jne 0x100b1a26
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push ebx
push ebp
push esi
call fcn.100b1920
add esp, 0x1c
cmp dword [0x101d08e4], 0xffff85c3
test eax, eax
jne 0x100b1a1e
push 2
push esi
call fcn.100724c0
add esp, 8
mov esi, eax
nop
cmp dword [esp + 0x10], esi
je 0x100b1a1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x101d08fc], 0xfffff233
sub eax, dword [esp + 0x14]
cmp eax, dword [0x101d090c]
jae 0x100b1a1c
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100b1980
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100d3cf0
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
cmp dword [0x102fbb94], 0
jne 0x100d3d0f
mov eax, dword [0x101e746c]
push eax
call fcn.10049e50
add esp, 4
mov dword [0x102fbb94], eax
mov cl, cl
mov edx, dword [0x101e746c]
cmp dword [0x101d1710], 0x557f
mov dl, dl
cmp dword [0x101d1700], 0xffffddde
cmp dword [0x101d170c], 0xffffac6a
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov dword [esp], ecx
mov ecx, dword [esp]
add ecx, 0xc
cmp dword [0x101d1708], 0x13f6
mov eax, dword [ecx]
cmp dword [0x101d1704], 0xffffa358
lea ecx, [ecx]
mov dl, dl
cmp edx, dword [eax + 0x18]
je 0x100d3d7c
mov eax, dword [eax]
cmp dword [0x101d1700], 0xffffddde
cmp ecx, eax
jne 0x100d3d60
jmp 0x100d3e67
mov dword [0x102f6f74], eax
cmp dword [0x101d16fc], 0xffffe641
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov dword [0x102f6f78], edx
cmp dword [0x101d16fc], 0xffffe641
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [0x102f6f7c], edx
cmp dword [0x101d1714], 0xffff86e1
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx]
mov dword [0x102f6f80], edx
mov bl, bl
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 4]
mov dword [0x102f6f84], edx
cmp dword [0x101d16f4], 0x7668
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [0x102f6f88], edx
cmp dword [0x101d16f0], 0x4682
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 4]
mov dword [0x102f6f8c], edx
cmp dword [0x101d16f4], 0xffff8997
mov ecx, dword [eax + 4]
mov edx, dword [eax]
mov dword [ecx], edx
cmp dword [0x101d16f0], 0xffffb97d
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
cmp dword [0x101d1710], 0xffffaa80
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x10]
mov dword [ecx], edx
cmp dword [0x101d1708], 0x13f6
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0x14]
mov dword [ecx + 4], edx
cmp dword [0x101d1708], 0xffffec09
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
mov dword [ecx], edx
nop
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [ecx + 4], edx
cmp dword [0x101d1710], 0xffffaa80
push ecx
pop ecx
pop ecx
ret
Function at 0x100d5330
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x101e5aec]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ch, ch
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.1012ea60
add esp, 0xc
cmp dword [0x101d1734], 0x6559
lea ecx, [ebp - 0x810]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [ebp - 0xc], eax
cmp dword [0x101d1728], 0xffffde70
cmp dword [ebp - 0xc], 0
jne 0x100d5391
xor eax, eax
jmp 0x100d543c
mov dword [ebp - 4], 0
cmp dword [0x101d1720], 0xbac
lea edx, [ebp - 0x810]
mov dword [ebp - 8], edx
cmp dword [0x101d1724], 0xffff834a
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100d5439
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [0x101d1724], 0xffff834a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
add ecx, 1
mov dword [ebp - 0x818], ecx
mov edx, dword [ebp - 0x814]
mov al, byte [edx]
mov byte [ebp - 0x819], al
add dword [ebp - 0x814], 1
cmp byte [ebp - 0x819], 0
jne 0x100d53ea
mov ecx, dword [ebp - 0x814]
sub ecx, dword [ebp - 0x818]
mov dword [ebp - 0x820], ecx
mov edx, dword [ebp - 0x820]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 1]
mov dword [ebp - 8], ecx
cmp dword [0x101d1740], 0x3ecc
jmp 0x100d53b5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1012e3ba
mov esp, ebp
pop ebp
ret

Function at 0x100d5710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101e5aec]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x6d
mov byte [ebp - 0x22], 0x6d
mov byte [ebp - 0x21], 0x33
mov byte [ebp - 0x20], 0x32
mov byte [ebp - 0x1f], 0x2e
mov byte [ebp - 0x1e], 0x64
mov byte [ebp - 0x1d], 0x6c
mov byte [ebp - 0x1c], 0x6c
mov byte [ebp - 0x1b], 0
xchg ebx, eax
xchg ebx, eax
mov byte [ebp - 0x14], 0x49
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0x12], 0x6d
mov byte [ebp - 0x11], 0x49
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x61
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x49
mov byte [ebp - 9], 0x4d
mov byte [ebp - 8], 0x45
mov byte [ebp - 7], 0x41
mov byte [ebp - 6], 0
mov ecx, ecx
mov dword [ebp - 0x28], 0
push eax
pop eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x18], eax
mov bl, bl
cmp dword [ebp - 0x18], 0
je 0x100d57ed
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [0x101d1720], 0xbac
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
cmp dword [0x101d1724], 0xffff834a
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x101d171c], 0xffff8348
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1012e3ba
mov esp, ebp
pop ebp
ret 8