joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fef20
Capabilities:
Generate random numbers via rtlgenrandom
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x10411920]
test eax, eax
jne 0x100fef3d
mov ecx, 0x10411920
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100fef5a
mov ecx, dword [eax]
xor ecx, 1
or ecx, dword [eax + 4]
jne 0x100fef5a
add eax, 8
jmp 0x100feffe
mov eax, dword [0x10411920]
test eax, eax
jne 0x100fef6d
mov ecx, 0x10411920
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x100feffc
mov esi, eax
test eax, eax
jne 0x100fefc9
call sub.KERNEL32.dll_GetProcessHeap
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff05a
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x10411920
mov esi, eax
mov eax, dword [0x10411920]
test eax, eax
jne 0x100fefc2
mov ecx, 0x10411920
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
xorps xmm0, xmm0
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
push 0x10
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x100ff004
movaps xmm0, xmmword [esp + 0x30]
lea eax, [esi + 8]
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
jmp 0x100feffe
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret
call sub.KERNEL32.dll_GetLastError
lea edx, [esp + 0x10]
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0x103a1b04
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 8], edx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov edx, 0x103a1b0c
mov dword [esp + 0xc], fcn.100f9290
mov dword [esp + 0x2c], 1
call fcn.100f94f0
ud2
mov ecx, 0x20
mov edx, 8
call fcn.100067d0
ud2

Function at 0x100ff1b0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov ebx, edx
mov esi, ecx
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff264
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ebx, 0xfffe
and ebx, 0xffff0001
mov dword [edi], ecx
mov dword [edi + 4], eax
push 0
push 0x10000
push edi
push 0x100ff280
push ebx
push 0
call sub.KERNEL32.dll_CreateThread
test eax, eax
je 0x100ff209
mov dword [esi + 4], eax
xor eax, eax
jmp 0x100ff25e
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov eax, dword [edi + 4]
cmp dword [eax + 4], 0
je 0x100ff23c
mov ebx, dword [edi]
cmp dword [eax + 8], 9
jae 0x100ff22c
call sub.KERNEL32.dll_GetProcessHeap
push ebx
jmp 0x100ff234
call sub.KERNEL32.dll_GetProcessHeap
push dword [ebx - 4]
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetProcessHeap
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapFree
call sub.KERNEL32.dll_GetLastError
mov dword [esi + 8], eax
mov eax, 1
mov dword [esi + 4], 0
mov dword [esi], eax
pop esi
pop edi
pop ebx
ret
mov ecx, 8
mov edx, 4
call fcn.100067d0
ud2
Function at 0x100ff440
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10411928]
test eax, eax
jne 0x100ff454
mov ecx, 0x10411928
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ff466
cmp dword [eax], 1
mov esi, eax
je 0x100ff4d7
mov eax, dword [0x10411928]
test eax, eax
jne 0x100ff479
mov ecx, 0x10411928
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ff48e
xor esi, esi
cmp eax, 1
je 0x100ff4da
mov esi, eax
jmp 0x100ff4ca
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff4de
mov dword [eax], 0
mov dword [eax + 8], 0x10411928
mov esi, eax
mov eax, dword [0x10411928]
test eax, eax
jne 0x100ff4c3
mov ecx, 0x10411928
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.100067d0
ud2

Function at 0x100ff4f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10411930]
test eax, eax
jne 0x100ff504
mov ecx, 0x10411930
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ff516
cmp dword [eax], 1
mov esi, eax
je 0x100ff587
mov eax, dword [0x10411930]
test eax, eax
jne 0x100ff529
mov ecx, 0x10411930
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ff53e
xor esi, esi
cmp eax, 1
je 0x100ff58a
mov esi, eax
jmp 0x100ff57a
call sub.KERNEL32.dll_GetProcessHeap
push 0xc
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100ff58e
mov dword [eax], 0
mov dword [eax + 8], 0x10411930
mov esi, eax
mov eax, dword [0x10411930]
test eax, eax
jne 0x100ff573
mov ecx, 0x10411930
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov dword [esi], 1
mov dword [esi + 4], 0
add esi, 4
mov eax, esi
pop esi
ret
mov ecx, 0xc
mov edx, 4
call fcn.100067d0
ud2
Function at 0x100ffe10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x10411938]
test eax, eax
jne 0x100ffe28
mov ecx, 0x10411938
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x100ffe42
cmp dword [eax], 1
mov edi, eax
jne 0x100ffe42
add edi, 4
jmp 0x100fff00
mov eax, dword [0x10411938]
test eax, eax
jne 0x100ffe55
mov ecx, 0x10411938
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
test eax, eax
je 0x100ffe6e
xor edi, edi
mov esi, eax
cmp eax, 1
je 0x100fff00
jmp 0x100ffeae
call sub.KERNEL32.dll_GetProcessHeap
push 0x20
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x100fff08
mov dword [eax], 0
mov dword [eax + 0x1c], 0x10411938
mov esi, eax
mov eax, dword [0x10411938]
test eax, eax
jne 0x100ffea7
mov ecx, 0x10411938
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [esi + 8], 3
lea edi, [esi + 4]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
test ecx, ecx
movsd xmm0, qword [esi + 0xc]
movsd xmm1, qword [esi + 0x14]
movsd qword [esp + 0xc], xmm0
movsd qword [esp + 0x14], xmm1
je 0x100fff00
cmp eax, 3
je 0x100fff00
lea ecx, [esp + 8]
call fcn.100fff20
mov eax, edi
add esp, 0x1c
pop esi
pop edi
ret
mov ecx, 0x20
mov edx, 4
call fcn.100067d0
ud2
Function at 0x10103fe0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10411948]
test eax, eax
jne 0x10103ff4
mov ecx, 0x10411948
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10104007
cmp byte [eax + 4], 2
mov esi, eax
jne 0x1010406a
mov eax, dword [0x10411948]
test eax, eax
jne 0x1010401a
mov ecx, 0x10411948
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x1010406f
mov esi, eax
test eax, eax
jne 0x10104064
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10104075
mov byte [eax + 4], 2
mov dword [eax], 0x10411948
mov esi, eax
mov eax, dword [0x10411948]
test eax, eax
jne 0x1010405d
mov ecx, 0x10411948
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov word [esi + 4], 0
add esi, 4
jmp 0x10104071
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 8
mov edx, 4
call fcn.100067d0
ud2

Function at 0x10104090
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x10411940]
test eax, eax
jne 0x101040a4
mov ecx, 0x10411940
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x101040b7
cmp byte [eax + 4], 3
mov esi, eax
jne 0x10104118
mov eax, dword [0x10411940]
test eax, eax
jne 0x101040ca
mov ecx, 0x10411940
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x1010411d
mov esi, eax
test eax, eax
jne 0x10104114
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10104123
mov byte [eax + 4], 3
mov dword [eax], 0x10411940
mov esi, eax
mov eax, dword [0x10411940]
test eax, eax
jne 0x1010410d
mov ecx, 0x10411940
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
mov byte [esi + 4], 2
add esi, 4
jmp 0x1010411f
xor esi, esi
mov eax, esi
pop esi
ret
mov ecx, 8
mov edx, 4
call fcn.100067d0
ud2
Function at 0x10105d00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push edi
push esi
push eax
mov eax, dword [0x10411950]
test eax, eax
jne 0x10105d17
mov ecx, 0x10411950
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x10105d33
mov esi, eax
mov eax, dword [eax]
test eax, eax
cmove esi, eax
test esi, esi
jne 0x10105e2b
mov eax, dword [0x10411950]
test eax, eax
jne 0x10105d46
mov ecx, 0x10411950
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x10105e29
mov esi, eax
test eax, eax
jne 0x10105d9b
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10105e42
mov dword [eax], 0
mov dword [eax + 4], 0x10411950
mov esi, eax
mov eax, dword [0x10411950]
test eax, eax
jne 0x10105d94
mov ecx, 0x10411950
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
call sub.KERNEL32.dll_GetProcessHeap
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10105e34
mov edi, eax
mov dword [eax], 0
call sub.KERNEL32.dll_GetProcessHeap
push 4
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10105e34
mov ebx, eax
mov dword [eax], 0
call sub.KERNEL32.dll_GetProcessHeap
push 0x1c
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x10105e3b
mov dword [eax], 1
mov dword [eax + 4], 1
mov dword [eax + 8], 0
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], 0
mov ecx, dword [esi]
mov dword [esi], eax
test ecx, ecx
mov dword [esp], ecx
je 0x10105e2b
lock dec dword [ecx]
jne 0x10105e2b
mov ecx, esp
call fcn.1006db60
jmp 0x10105e2b
xor esi, esi
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
ret
mov ecx, 4
jmp 0x10105e47
mov ecx, 0x1c
jmp 0x10105e47
mov ecx, 8
mov edx, 4
call fcn.100067d0
ud2
Function at 0x1010a640
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1041195c]
test eax, eax
jne 0x1010a65a
mov ecx, 0x1041195c
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 2
jb 0x1010a676
xor esi, esi
cmp byte [eax + 0xc], 2
cmovne esi, eax
test esi, esi
jne 0x1010a778
mov eax, dword [0x1041195c]
test eax, eax
jne 0x1010a689
mov ecx, 0x1041195c
call fcn.100f2930
push eax
call sub.KERNEL32.dll_TlsGetValue
cmp eax, 1
je 0x1010a776
mov esi, eax
test eax, eax
jne 0x1010a6dc
call sub.KERNEL32.dll_GetProcessHeap
push 0x14
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1010a789
mov byte [eax + 0xc], 2
mov dword [eax + 0x10], 0x1041195c
mov esi, eax
mov eax, dword [0x1041195c]
test eax, eax
jne 0x1010a6d5
mov ecx, 0x1041195c
call fcn.100f2930
push esi
push eax
call sub.KERNEL32.dll_TlsSetValue
call sub.KERNEL32.dll_GetProcessHeap
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x1010a782
mov dword [eax], 1
mov dword [eax + 4], 1
mov bh, byte [esi + 0xf]
mov bl, byte [esi + 0xc]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov edi, dword [esi + 8]
mov byte [esp + 4], bh
cmp bl, 2
movzx ebp, word [esi + 0xd]
mov word [esp + 2], bp
mov dword [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 8], 0x103a4744
mov byte [esi + 0xc], 1
movzx eax, word [esp + 5]
mov word [esi + 0xd], ax
mov al, byte [esp + 7]
mov byte [esi + 0xf], al
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edi
mov byte [esp + 0x14], bl
movzx eax, word [esp + 2]
mov dl, byte [esp + 4]
mov word [esp + 0x15], ax
mov byte [esp + 0x17], dl
je 0x1010a778
lock dec dword [ecx]
jne 0x1010a778
lea ecx, [esp + 0xc]
call fcn.10116ed0
jmp 0x1010a778
xor esi, esi
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 8
jmp 0x1010a78e
mov ecx, 0x14
mov edx, 4
call fcn.100067d0
ud2

Function at 0x1010ada0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x16c
call fcn.1010adaf
Function at 0x10117140
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x101171b1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
je 0x101171b1
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
jne 0x1011719a
jmp 0x101171b1
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1016fd70
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], 0x10
movzx eax, byte [ebp - 1]
mov dword [ebp - 8], eax
mov cl, byte [ebp - 1]
sub cl, 1
mov byte [ebp - 1], cl
cmp dword [ebp - 8], 0
je 0x1016fdb0
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
mov cl, byte [ecx + str.cw]
mov byte [eax + edx], cl
jmp 0x1016fd7d
mov esp, ebp
pop ebp
ret 4

Function at 0x1016fdc0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 1], 0x10
movzx eax, byte [ebp - 1]
mov dword [ebp - 8], eax
mov cl, byte [ebp - 1]
sub cl, 1
mov byte [ebp - 1], cl
cmp dword [ebp - 8], 0
je 0x1016fe00
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
mov cl, byte [ecx + 0x10332ac0]
mov byte [eax + edx], cl
jmp 0x1016fdcd
mov esp, ebp
pop ebp
ret 4

Function at 0x1016fed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], 0x10
movzx eax, byte [ebp - 1]
mov dword [ebp - 0xc], eax
mov cl, byte [ebp - 1]
sub cl, 1
mov byte [ebp - 1], cl
cmp dword [ebp - 0xc], 0
je 0x1016ff4a
mov edx, dword [ebp - 0x10]
add edx, 0x18
mov dword [ebp - 0x14], edx
movzx eax, byte [ebp + 0xc]
and eax, 1
je 0x1016ff11
movzx ecx, byte [ebp - 1]
add ecx, 0x10
mov dword [ebp - 8], ecx
jmp 0x1016ff18
movzx edx, byte [ebp - 1]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.10171850
movzx ecx, byte [eax]
mov dword [ebp - 0x18], ecx
movzx edx, byte [ebp - 1]
mov eax, dword [ebp + 8]
mov cl, byte [eax + edx]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 2]
xor edx, dword [ebp - 0x18]
movzx eax, byte [ebp - 1]
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], dl
jmp 0x1016fedd
mov esp, ebp
pop ebp
ret 8

Function at 0x10184000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0x811c9dc5
mov dword [ebp - 8], 0
jmp 0x10184031
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jae 0x10184060
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
imul ecx, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], ecx
jmp 0x10184028
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1018e090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x1018e0bb
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x1018e118
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
mov dl, byte [ecx]
mov byte [ebp - 2], dl
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + edx]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x1018e0f3
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 2]
cmp eax, ecx
je 0x1018e116
movzx ecx, byte [ebp - 2]
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
movzx ebx, byte [eax + edx]
xor ebx, ecx
mov eax, dword [ebp - 8]
xor edx, edx
div dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + edx], bl
jmp 0x1018e0b2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10191980
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x101919ac
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0x1018f690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10549a44]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x64], edx
mov eax, 1
pop ebp
ret 0xc

Function at 0x1019a4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.10170740
add esp, 4
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.1019a590
add esp, 8
mov dword [ebp - 0xc], 0x1019a490
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
lea ecx, [ebp - 8]
call fcn.10171870
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x1019a553
lea ecx, [ebp - 8]
call fcn.1019a7b0
jmp 0x1019a564
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
push 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
lea ecx, [ebp - 8]
call fcn.1019a5f0
mov esp, ebp
pop ebp
ret 4
Function at 0x1019ec30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10411968]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x1c]
call fcn.10178840
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1019ec88
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.1019ed10
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
call fcn.101787d0
lea ecx, [ebp - 0x1c]
call fcn.10179000
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102d9498
mov esp, ebp
pop ebp
ret

Function at 0x101a9210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0x100
mov eax, dword [ebp - 0xc]
add eax, 0x70
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x170
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x101a9249
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0xff
jge 0x101a9279
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x101a9267
mov byte [ebp - 1], 1
jmp 0x101a926b
mov byte [ebp - 1], 0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x70], dl
jmp 0x101a9240
mov esp, ebp
pop ebp
ret
Function at 0x101cad90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x101cadb0
jl 0x101cada7
cmp dword [ebp + 0xc], 0
ja 0x101cadb0
xor eax, eax
xor edx, edx
jmp 0x101caef7
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x101cadd3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x101caef7
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x101cae45
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.101714b0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.1017c8e0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call dword [sym.imp.MSVCP140.dll_protected:_void___thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int_]
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x101caee8
mov ecx, dword [ebp - 8]
call fcn.101c6f80
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x101caeb6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x101caeb4
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x101caef7
jmp 0x101cae61
cmp dword [ebp - 4], 0
jbe 0x101caee8
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc