joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086430
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ac50
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x423c
push 0x101af170
call fcn.10084b20
add esp, 8
push 0x10270598
lea eax, [ebp - 0x18]
push eax
call fcn.10077b2d
add esp, 8
mov dword [ebp - 4], 0
push 0x102705a0
lea ecx, [ebp - 0x18]
call fcn.10008dd0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10083250
movzx ecx, al
test ecx, ecx
jne 0x100864e5
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x1d]
jmp 0x100865aa
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
push 0
push 1
push 1
push 0
push 0x4e20
push 0
push 0x102705d8
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x102705d4
call fcn.10002e70
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push str._data_local_tmp_.psneuter_n
call fcn.10002e70
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.10083730
mov byte [ebp - 0x39], al
movzx eax, byte [ebp - 0x39]
test eax, eax
jne 0x10086587
push 0x10270668
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x29], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x29]
jmp 0x100865aa
push 0x1027069c
call fcn.100d6a20
add esp, 4
mov byte [ebp - 0x2a], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x2a]
push edx
mov ecx, ebp
push eax
lea edx, [0x100865d8]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x10086600
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010ad00
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push esi
push edi
push ecx
lea edi, [ebp - 0x44]
mov ecx, 0xe
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
push 0x11a74
push 0x101b33b8
call fcn.10084b20
add esp, 8
push 0x102706d0
lea eax, [ebp - 0x18]
push eax
call fcn.10077b2d
add esp, 8
mov dword [ebp - 4], 0
push 0x102706d8
lea ecx, [ebp - 0x18]
call fcn.10008dd0
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10083250
movzx ecx, al
test ecx, ecx
jne 0x100866b5
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
mov byte [ebp - 0x1e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x1e]
jmp 0x10086796
push ecx
mov ecx, esp
mov dword [ebp - 0x24], esp
push 0x1027070c
call fcn.10002e70
mov dword [ebp - 0x34], eax
push 1
mov ecx, dword [ebp - 0x10]
call fcn.10086ac0
lea ecx, [ebp - 0x18]
call fcn.10008dd0
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp esi, esp
call fcn.100b4c28
push 0
push 1
push 1
push 0
push 0x4e20
push 0
push str.shell_chmod_777__data_local_tmp_.psneuter_n_data_local_tmp_.psneuter
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x10270798
call fcn.10002e70
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], edx
mov byte [ebp - 4], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x1027079c
call fcn.10002e70
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
call fcn.10083730
mov byte [ebp - 0x41], al
mov al, byte [ebp - 0x41]
mov byte [ebp - 0x1d], al
push 0
push 1
push 1
push 0
push 0x4e20
push 0
push str.shell_chmod_777__data_local_tmp
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push 0x102707e0
call fcn.100d6a20
add esp, 4
mov ecx, dword [ebp - 0x10]
call fcn.10087010
mov cl, byte [ebp - 0x1d]
mov byte [ebp - 0x2d], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x2d]
push edx
mov ecx, ebp
push eax
lea edx, [0x100867c4]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x44
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x1008a210
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b4c0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x34
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x44]
mov ecx, 0xd
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
call fcn.10087010
cmp dword [ebp + 8], 0
jle 0x1008a275
mov ecx, dword [ebp - 0x14]
call fcn.1008b130
mov ecx, dword [ebp - 0x14]
call fcn.1008b820
jmp 0x1008a2e0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 8], 0xffffffff
je 0x1008a2ff
cmp dword [ebp + 8], 0
je 0x1008a2ff
push 0x64
mov ecx, 0x102b0400
call fcn.100693d1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x1d4], ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0x102b084c
call fcn.1008a3d0
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x44], edx
mov dword [ebp - 4], 3
call fcn.1008a3c0
mov dword [ebp - 4], 0xffffffff
mov ecx, eax
call fcn.100aa1a0
mov ecx, 0x102b0850
call fcn.1008c6a0
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x102b03e0
call fcn.1008c2e0
mov ecx, dword [ebp - 0x14]
add ecx, 0x30
call fcn.1008c920
push edx
mov ecx, ebp
push eax
lea edx, [0x1008a394]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x44
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret 4

Function at 0x1008bca0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
cmp dword [0x102abc28], 0xffffffff
je 0x1008bcf2
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1008bcda
mov esi, esp
push 1
mov ecx, dword [0x102abc28]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp esi, esp
call fcn.100b4c28
jmp 0x1008bcf2
mov esi, esp
push 2
mov edx, dword [0x102abc28]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp esi, esp
call fcn.100b4c28
pop esi
add esp, 4
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret 4

Function at 0x1008bd10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
cmp dword [0x102abc28], 0xffffffff
je 0x1008bd46
mov esi, esp
mov eax, dword [0x102abc28]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp esi, esp
call fcn.100b4c28
cmp eax, 2
jne 0x1008bd46
xor al, al
jmp 0x1008bd48
mov al, 1
pop esi
add esp, 4
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x1008bd60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010b818
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x102ac760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x18]
call fcn.10002e50
mov dword [ebp - 4], 0
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.100b4c28
mov dword [ebp - 0x20], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp esi, esp
call fcn.100b4c28
sub eax, dword [ebp - 0x20]
cmp eax, 0x2bf20
jae 0x1008be87
push 0
push 1
push 1
push 0
push 0x1388
lea eax, [ebp - 0x18]
push eax
push str.shell_dumpsys_activity
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push 0
push str.com.google
lea ecx, [ebp - 0x18]
call fcn.10031080
cmp eax, 0xffffffff
jne 0x1008be24
push 0
push str.com.android
lea ecx, [ebp - 0x18]
call fcn.10031080
cmp eax, 0xffffffff
je 0x1008be82
push 0
push 1
push 1
push 0
push 0x1388
lea ecx, [ebp - 0x18]
push ecx
push str.shell_pm_list_packages
mov ecx, dword [ebp - 0x10]
call fcn.100835d0
push 0
push str.package:android
lea ecx, [ebp - 0x18]
call fcn.10031080
cmp eax, 0xffffffff
jne 0x1008be6a
push 0
push str.package:com
lea ecx, [ebp - 0x18]
call fcn.10031080
cmp eax, 0xffffffff
je 0x1008be82
mov byte [ebp - 0x21], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x21]
jmp 0x1008be9d
jmp 0x1008bdc1
mov byte [ebp - 0x22], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.10003610
mov al, byte [ebp - 0x22]
push edx
mov ecx, ebp
push eax
lea edx, [0x1008bec8]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x100aad40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.100b40c6
add esp, 0x18
mov dword [ebp - 4], eax
mov esi, esp
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100b4c28
pop esi
add esp, 4
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret

Function at 0x100ab4e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010dbb5
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
push esi
push edi
lea edi, [ebp - 0x228]
mov ecx, 0x87
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 1
mov eax, dword [0x102b0aa8]
and eax, 1
jne 0x100ab568
mov ecx, dword [0x102b0aa8]
or ecx, 1
mov dword [0x102b0aa8], ecx
mov byte [ebp - 4], 2
mov ecx, 0x102b0a8c
call fcn.100032c0
push 0x10112be0
call fcn.100b3915
add esp, 4
mov byte [ebp - 4], 1
mov ecx, 0x102b0a8c
call fcn.10008d50
movzx edx, al
test edx, edx
je 0x100ab5d1
mov esi, esp
push 1
push 0x2e
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp esi, esp
call fcn.100b4c28
lea ecx, [ebp - 0x220]
push ecx
mov ecx, 0x102b0a8c
call fcn.10003310
push str.RootGenuis_
mov ecx, 0x102b0a8c
call fcn.10018a00
mov esi, esp
push 0
mov ecx, 0x102b0a8c
call fcn.10003b00
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.100b4c28
lea edx, [ebp + 0xc]
push edx
push 0x102b0a8c
mov eax, dword [ebp + 8]
push eax
call fcn.10034d30
add esp, 0xc
mov ecx, dword [ebp - 0x228]
or ecx, 1
mov dword [ebp - 0x228], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.100032e0
mov eax, dword [ebp + 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x100ab640]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2738
add esp, 0x228
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x100ab8c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
push edi
lea edi, [ebp - 0x830]
mov ecx, 0x20c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
je 0x100ab8f2
cmp dword [ebp + 0xc], 0
jne 0x100ab8f7
jmp 0x100ab9ce
mov dword [ebp - 0xc], 0
push 0x10275a68
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.100b81c5
add esp, 0xc
mov dword [ebp - 0x18], 0
push 0x10275a6c
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.100b81c5
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x100ab93b
cmp dword [ebp - 0xc], 0
jne 0x100ab94d
push str.cannot_open_file_n
call fcn.100b8895
add esp, 4
jmp 0x100ab9ce
call fcn.100ab790
mov ecx, dword [ebp - 0xc]
push ecx
push 0x400
push 1
lea edx, [ebp - 0x420]
push edx
call fcn.100b84b8
add esp, 0x10
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x830], 0
je 0x100ab9b6
mov eax, dword [ebp - 0x830]
push eax
lea ecx, [ebp - 0x828]
push ecx
lea edx, [ebp - 0x420]
push edx
call fcn.100ab7b0
add esp, 0xc
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x830]
push ecx
push 1
lea edx, [ebp - 0x828]
push edx
call fcn.100b521a
add esp, 0x10
jmp 0x100ab952
mov eax, dword [ebp - 0xc]
push eax
call fcn.100b503c
add esp, 4
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100b503c
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x100ab9fc]
call fcn.100b4c4b
pop eax
pop edx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100b2738
add esp, 0x830
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret
Function at 0x100adda0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010dfae
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
push esi
push edi
push ecx
lea edi, [ebp - 0x268]
mov ecx, 0x97
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x102ac760]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str.id__d
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call fcn.100b3a84
add esp, 0x10
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24c], esp
lea edx, [ebp - 0x220]
push edx
call fcn.10008d10
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x244]
push eax
call fcn.100ab4e0
add esp, 0x20
mov dword [ebp - 0x25c], eax
mov byte [ebp - 4], 1
mov esi, esp
push 0
lea ecx, [ebp - 0x244]
call fcn.10003b00
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, esp
call fcn.100b4c28
lea ecx, [ebp - 0x244]
call fcn.10003b00
push ecx
mov ecx, esp
mov dword [ebp - 0x250], esp
push eax
call fcn.10002e70
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x264], ecx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x254], esp
lea edx, [ebp + 0xc]
push edx
call fcn.100035f0
mov dword [ebp - 0x268], eax
mov byte [ebp - 4], 1
call fcn.100fef90
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x244]
call fcn.100032e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.10003610
push edx
mov ecx, ebp
push eax
lea edx, [0x100adf08]
call fcn.100b4c4b
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b2738
add esp, 0x268
cmp ebp, esp
call fcn.100b4c28
mov esp, ebp
pop ebp
ret 8

Function at 0x100b07fa
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x102b0bb8], 0
push esi
jne 0x100b076d
call fcn.100b0693
test eax, eax
je 0x100b07b0
mov eax, dword [0x102b0bb8]
cmp eax, 1
jne 0x100b078e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100b07b0
pop esi
ret
push eax
call dword [0x102b0bc0]
test eax, eax
jne 0x100b07f8
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100b07b4
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x102b0bb8]
call dword [0x102b0bc0]
mov edi, eax
test edi, edi
je 0x100b07d9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x100b07f5
mov edi, esi
add esi, 0xff0
push edi
push dword [0x102b0bb8]
call dword [0x102b0bbc]
add edi, 0x10
cmp edi, esi
jb 0x100b07e1
mov eax, edi
pop edi
pop esi
ret
jmp 0x100b075a

Function at 0x100b2738
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102ac760]
jne 0x100b2742
repz ret
jmp fcn.100bcfdc
Function at 0x100cbf65
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100bc74b
and dword [ebp - 4], 0
cmp dword [0x102b1824], 0
mov ebx, eax
jne 0x100cc016
push 0x1027c66c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100cc0c7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1027c660
push edi
call esi
test eax, eax
je 0x100cc0c7
push eax
call fcn.100bc6d9
mov dword [esp], 0x1027c650
push edi
mov dword [0x102b1824], eax
call esi
push eax
call fcn.100bc6d9
mov dword [esp], 0x1027c63c
push edi
mov dword [0x102b1828], eax
call esi
push eax
call fcn.100bc6d9
mov dword [esp], 0x1027c620
push edi
mov dword [0x102b182c], eax
call esi
push eax
call fcn.100bc6d9
pop ecx
mov dword [0x102b1834], eax
test eax, eax
je 0x100cc016
push 0x1027c608
push edi
call esi
push eax
call fcn.100bc6d9
pop ecx
mov dword [0x102b1830], eax
mov eax, dword [0x102b1830]
cmp eax, ebx
je 0x100cc06e
cmp dword [0x102b1834], ebx
je 0x100cc06e
push eax
call fcn.100bc754
push dword [0x102b1834]
mov esi, eax
call fcn.100bc754
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100cc06e
test edi, edi
je 0x100cc06e
call esi
test eax, eax
je 0x100cc065
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100cc065
test byte [ebp - 0xc], 1
jne 0x100cc06e
or dword [ebp + 0x10], 0x200000
jmp 0x100cc0a7
mov eax, dword [0x102b1828]
cmp eax, ebx
je 0x100cc0a7
push eax
call fcn.100bc754
pop ecx
test eax, eax
je 0x100cc0a7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100cc0a7
mov eax, dword [0x102b182c]
cmp eax, ebx
je 0x100cc0a7
push eax
call fcn.100bc754
pop ecx
test eax, eax
je 0x100cc0a7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102b1824]
call fcn.100bc754
pop ecx
test eax, eax
je 0x100cc0c7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100cc0c9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100d5120
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x48], 8
jb 0x100d5135
mov eax, dword [esi + 0x34]
push eax
call fcn.100b1e2a
add esp, 4
xor ecx, ecx
mov dword [esi + 0x48], 7
mov dword [esi + 0x44], 0
mov word [esi + 0x34], cx
mov ecx, esi
pop esi
jmp fcn.100de9f0
Function at 0x100d8a10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
push esi
push edi
call ebx
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ebp, eax
mov ecx, dword [0x102b19bc]
test ecx, ecx
je 0x100d8a36
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
test esi, esi
je 0x100d8a3f
cmp byte [esi], 1
je 0x100d8a47
call ebx
sub eax, ebp
cmp eax, edi
jb 0x100d8a26
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100db6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [0x102ac760]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x6c]
push 4
call fcn.100b2134
xor ebx, ebx
add esp, 4
cmp eax, ebx
je 0x100db6fa
mov dword [eax], edi
jmp 0x100db6fc
xor eax, eax
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x78]
mov dword [edi], eax
xor eax, eax
push ecx
mov ebp, 7
lea ecx, [esp + 0x38]
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], ax
call fcn.10004580
cmp dword [esp + 0xa4], 8
mov eax, dword [esp + 0x90]
jae 0x100db744
lea eax, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ebx
push eax
lea ecx, [esp + 0x38]
call fcn.10008ee0
mov esi, eax
cmp esi, ebx
jl 0x100db83c
push esi
push ebx
lea ecx, [esp + 0x34]
xor eax, eax
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x68], ebx
mov word [esp + 0x58], ax
call fcn.10004580
cmp byte [esp + 0xa8], bl
je 0x100db78f
cmp dword [esp + 0x5c], ebx
je 0x100db79b
lea edx, [esp + 0x48]
push edx
mov ecx, edi
call fcn.10034180
mov ecx, dword [esp + 0x40]
xor eax, eax
mov word [esp + 0x14], ax
mov eax, dword [esp + 0xa0]
sub ecx, eax
sub ecx, esi
push ecx
add eax, esi
push eax
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
call fcn.10004580
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
call fcn.10004580
mov esi, 8
cmp dword [esp + 0x28], esi
jb 0x100db7f4
mov ecx, dword [esp + 0x14]
push ecx
call fcn.100b1e2a
add esp, 4
mov eax, dword [esp + 0x90]
cmp dword [esp + 0xa4], esi
jae 0x100db80b
lea eax, [esp + 0x90]
mov edx, dword [esp + 0xa0]
push edx
push ebx
push eax
lea ecx, [esp + 0x38]
call fcn.10008ee0
cmp dword [esp + 0x60], 8
mov esi, eax
jb 0x100db834
mov eax, dword [esp + 0x4c]
push eax
call fcn.100b1e2a
add esp, 4
cmp esi, ebx
jge 0x100db761
cmp byte [esp + 0xa8], bl
je 0x100db84b
cmp dword [esp + 0x40], ebx
je 0x100db857
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
call fcn.10034180
mov esi, 8
cmp dword [esp + 0x44], esi
jb 0x100db86f
mov edx, dword [esp + 0x30]
push edx
call fcn.100b1e2a
add esp, 4
xor eax, eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], ebx
mov word [esp + 0x30], ax
cmp dword [esp + 0x88], esi
jb 0x100db894
mov ecx, dword [esp + 0x74]
push ecx
call fcn.100b1e2a
add esp, 4
xor edx, edx
mov dword [esp + 0x88], ebp
mov dword [esp + 0x84], ebx
mov word [esp + 0x74], dx
cmp dword [esp + 0xa4], esi
jb 0x100db8c2
mov eax, dword [esp + 0x90]
push eax
call fcn.100b1e2a
add esp, 4
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b2738
add esp, 0x58
ret