joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10089110
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
push 0
push eax
mov dword [ebp - 0x130], 0x128
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x130]
mov edi, eax
push ecx
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100891a0
jmp 0x10089170
lea edx, [ebp - 0x10c]
push str.main.exe
push edx
call dword [sym.imp.MSVCR100.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x1008918e
inc esi
cmp esi, ebx
jg 0x100891b9
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x10089170
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov al, 1
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret

Function at 0x100891e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x258], 0
push esi
push edi
je 0x100892da
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0xf4]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10089255
lea ecx, [ebp - 0x38]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x258]
cmp eax, dword [ebp - 0x43c]
je 0x10089290
lea ecx, [ebp - 0x38]
push str.AntiHack__s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100892c8
push edi
lea eax, [ebp - 0x38]
push str.AntiHack__s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Antihack
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100892da
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x100892f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x260], 0
push esi
push edi
je 0x100893ea
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0x134]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10089365
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x260]
cmp eax, dword [ebp - 0x43c]
je 0x100893a0
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100893d8
push edi
lea eax, [ebp - 0x38]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin1
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100893ea
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x10089400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x264], 0
push esi
push edi
je 0x100894fa
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0x154]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10089475
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x264]
cmp eax, dword [ebp - 0x43c]
je 0x100894b0
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100894e8
push edi
lea eax, [ebp - 0x38]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin2
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100894fa
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x10089510
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x268], 0
push esi
push edi
je 0x1008960a
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0x174]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10089585
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x268]
cmp eax, dword [ebp - 0x43c]
je 0x100895c0
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100895f8
push edi
lea eax, [ebp - 0x38]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008960a
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x10089620
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x26c], 0
push esi
push edi
je 0x1008971a
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0x194]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x10089695
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x26c]
cmp eax, dword [ebp - 0x43c]
je 0x100896d0
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10089708
push edi
lea eax, [ebp - 0x38]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008971a
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x10089730
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebx + 0x25c], 0
push esi
push edi
je 0x1008982a
lea esi, [ebp - 0x438]
call section..text
mov eax, esi
lea edi, [ebx + 0x114]
push eax
lea esi, [ebp - 0x43c]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100897a5
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x25c]
cmp eax, dword [ebp - 0x43c]
je 0x100897e0
lea ecx, [ebp - 0x38]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [ebp - 0x38]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x10089818
push edi
lea eax, [ebp - 0x38]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea ecx, [ebp - 0x38]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1008982a
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret

Function at 0x10089840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x100bc018]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x270], 0
push ebx
push esi
je 0x100898f1
lea esi, [ebp - 0x408]
call section..text
mov eax, esi
lea ebx, [edi + 0x1b4]
push eax
lea esi, [ebp - 0x40c]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x100898a3
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x270]
cmp ecx, dword [ebp - 0x40c]
je 0x100898cd
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100898df
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100b6038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100898f1
call eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ab6d6
mov esp, ebp
pop ebp
ret
Function at 0x1008c950
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10124550]
cmp eax, 0x12c
jbe 0x1008c97e
call esi
xor byte [0x10124555], 1
mov dword [0x10124550], eax
mov al, byte [edi + 5]
mov byte [0x1068957a], al
pop esi
ret
mov cl, byte [edi + 5]
mov byte [0x1068957a], cl
pop esi
ret
Function at 0x10091f10
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0xe609e8], 5
jne 0x10091fca
cmp dword [0x10689778], 1
jne 0x10091fca
push esi
call fcn.10091fd0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10689784]
cmp eax, dword [0x1068978c]
jbe 0x10091f92
cmp byte [0x10610cbe], 0
jne 0x10091f85
mov dword [0x10689778], 2
mov dword [0x1068977c], 0
call esi
mov dword [0x10689780], eax
call esi
mov dword [0x10689784], eax
mov dword [0x10689788], 0
mov dword [0x1068978c], 0
mov eax, 0x63a180
mov ecx, 0x8793750
pop esi
jmp eax
call esi
sub eax, dword [0x10689780]
cmp eax, dword [0x10689788]
jb 0x10091fc9
mov eax, dword [0x1068977c]
sub eax, 0
je 0x10091fbd
dec eax
jne 0x10091fc2
call fcn.10092220
call esi
mov dword [0x10689780], eax
pop esi
ret
call fcn.100921b0
call esi
mov dword [0x10689780], eax
pop esi
ret

Function at 0x10092730
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1068977c], 2
jne 0x100927b4
mov edx, dword [0x10684800]
mov eax, dword [0x106847fc]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x10684804]
lea edx, [ebp - 0x10]
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.1008c360
add esp, 4
cmp byte [0x10610cbe], 0
jne 0x100927b4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10689778], 1
mov dword [0x1068977c], 3
call esi
mov dword [0x10689780], eax
call esi
mov dword [0x10689784], eax
mov eax, 0xbb8
mov dword [0x10689788], eax
mov dword [0x1068978c], eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100927c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x1068977c], 3
jne 0x100927f3
cmp dword [0x10689794], ebx
je 0x100927f3
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.1008c360
add esp, 4
cmp byte [0x10610cbe], bl
jne 0x10092835
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10689778], ebx
mov dword [0x1068977c], ebx
call esi
mov dword [0x10689780], eax
call esi
mov dword [0x10689784], eax
mov dword [0x10689788], ebx
mov dword [0x1068978c], ebx
mov dword [0x10689790], ebx
mov dword [0x10689794], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10093990
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor ebx, ebx
mov edx, eax
cmp byte [0x10126715], bl
je 0x100939ff
mov eax, 0xac
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x100939ff
cmp dword [ebp + 8], 0x201
jne 0x100939d2
mov al, 1
pop esi
mov byte [0x101268d4], al
pop ebx
pop ebp
ret 4
sub edx, dword [0x101268d0]
mov byte [0x101268d4], bl
cmp edx, 0x1f4
jb 0x100939ff
call esi
mov dword [0x101268d0], eax
mov byte [0x10126715], bl
mov dword [0xe8cb3c], ebx
mov byte [0x10126731], bl
pop esi
xor al, al
pop ebx
pop ebp
ret 4
Function at 0x10093a10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x10126715], 0
mov edx, eax
je 0x10093a8c
mov eax, 0xad
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10093a8c
cmp byte [0x10126916], 0
je 0x10093a8c
cmp dword [ebp + 8], 0x201
jne 0x10093a58
mov al, 1
mov byte [0x10126914], al
pop esi
pop ebp
ret 4
sub edx, dword [0x10126910]
mov byte [0x10126914], 0
cmp edx, 0x1f4
jb 0x10093a8c
call esi
mov dword [0x10126910], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x1ff04c1
call fcn.1008c360
add esp, 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x10093c40
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
mov edi, eax
mov eax, dword [esi + 0x3c]
push eax
mov eax, dword [esi + 0x30]
push ecx
push edx
push eax
mov ecx, 0x790b10
call ecx
add esp, 0x10
cmp al, 1
jne 0x10093c93
cmp dword [ebp + 8], 0x201
jne 0x10093c7f
pop edi
mov byte [esi + 0x40], al
pop ebx
pop ebp
ret 4
sub edi, dword [esi + 0x44]
mov byte [esi + 0x40], 0
cmp edi, 0x1f4
jb 0x10093c93
call ebx
mov dword [esi + 0x44], eax
pop edi
pop ebx
pop ebp
ret 4

Function at 0x100942a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10094342
mov eax, dword [0x879340c]
mov edx, dword [0x8793410]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
sub eax, 0xf
push 0x6b
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
call fcn.100a9705
mov ecx, 0x1a
lea esi, [ebx + 2]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x1c00
add esp, 4
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
cmp word [ebx + 2], cx
jae 0x1009433f
movzx edx, byte [ebx + 0x1a]
movzx ecx, byte [ebx + 0x19]
push edx
movzx edx, byte [ebx + 4]
push ecx
push edx
push eax
mov eax, 0x7e22a0
call eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push 0
push 0
push 0
push ecx
push edx
push eax
mov ecx, 0x861110
call ecx
mov edx, 0x861aa0
mov ecx, eax
call edx
mov edx, 0x7e3e30
mov ecx, eax
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10097e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x10097e4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10097e43
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10097e80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x10097eb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10097eae
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10097ef0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x10097f1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
fld qword [ebp + 8]
lea ecx, [ebp - 8]
fstp qword [esi]
push ecx
push edx
push 8
push esi
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x10097f13
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10097f80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [0xe8c578]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10097fde
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x10098000
mov ecx, dword [0xe8c578]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0xe8c578]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov bl, 1
call fcn.10098010
mov edi, 0x10149e31
call fcn.10098150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0xe8c578]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0xe8c578]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor bl, bl
call fcn.10098010
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10098250
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor eax, eax
push ebx
push esi
push edi
or ecx, 0xffffffff
push 0x10098930
push 0x520ecf
or bl, 0xff
mov dword [0x1068684c], eax
mov dword [0x10686850], eax
mov dword [0x10686854], eax
mov dword [0x10686858], eax
mov dword [0x106868c0], eax
mov byte [0x106868ac], al
mov dword [0x106868b4], ecx
mov dword [0x106868bc], ecx
mov dword [0x106868b0], ecx
mov dword [0x10687ba4], eax
mov dword [0x10687ba8], eax
mov dword [0x10687bac], eax
mov byte [0x10687bb0], al
mov dword [0x106868c4], eax
mov dword [0x106868c8], eax
mov byte [0x106868cc], al
call fcn.10098b80
push 0x10098930
push 0x520f1f
or bl, 0xff
call fcn.10098b80
push 0x10098930
push 0x63e743
or bl, 0xff
call fcn.10098b80
push 0x10098930
push 0x640eb2
or bl, 0xff
call fcn.10098b80
push 0x10098930
push 0x7d2dd9
or bl, 0xff
call fcn.10098b80
push 0x10098930
push 0x7e6c0f
or bl, 0xff
call fcn.10098b80
push 0x10098930
push 0x84aef7
or bl, 0xff
call fcn.10098b80
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x38
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x100983f0
push 5
sub eax, 0x57d518
mov bl, 0xe8
xor edi, edi
push 0x57d513
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x1009838a
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x57d513
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x57d513
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10098390
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x100983f0
push 5
sub ecx, 0x57d504
push 0x57d4ff
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x100983df
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x57d4ff
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x57d4ff
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x100983e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret