joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004173
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083658]
cmp eax, dword [ecx + 4]
jg 0x100041b4
jmp 0x100041ad
pop ebx
mov eax, 0x1008364c
leave
ret
push ebx
mov ebx, 0x10083658
push ebx
call fcn.10066acf
cmp dword [0x10083658], 0xffffffff
pop ecx
jne 0x100041ac
push esi
push edi
mov edi, 0x1008364c
lea esi, [ebp - 0xc]
push 0x1006b3e4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100041ac

Function at 0x100041ed
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100836a8]
cmp eax, dword [ecx + 4]
jg 0x1000422e
jmp 0x10004227
pop ebx
mov eax, 0x1008369c
leave
ret
push ebx
mov ebx, 0x100836a8
push ebx
call fcn.10066acf
cmp dword [0x100836a8], 0xffffffff
pop ecx
jne 0x10004226
push esi
push edi
mov edi, 0x1008369c
lea esi, [ebp - 0xc]
push 0x1006b3f1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004226

Function at 0x10004267
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100836fc]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x100042ae
jmp 0x100042a7
pop ebx
mov eax, 0x100836ec
leave
ret
push ebx
mov ebx, 0x100836fc
push ebx
call fcn.10066acf
cmp dword [0x100836fc], 0xffffffff
pop ecx
jne 0x100042a6
push esi
push edi
mov edi, 0x100836ec
lea esi, [ebp - 0x10]
push 0x1006b3fe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100042a6
Function at 0x100042e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083684]
cmp eax, dword [ecx + 4]
jg 0x1000432a
jmp 0x10004323
pop ebx
mov eax, 0x10083678
leave
ret
push ebx
mov ebx, 0x10083684
push ebx
call fcn.10066acf
cmp dword [0x10083684], 0xffffffff
pop ecx
jne 0x10004322
push esi
push edi
mov edi, 0x10083678
lea esi, [ebp - 0xc]
push 0x1006b40d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004322

Function at 0x100043d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e546250
mov dword [ebp - 8], 0xc4d5451
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083644]
cmp eax, dword [ecx + 4]
jg 0x10004411
jmp 0x1000440a
pop ebx
mov eax, 0x10083638
leave
ret
push ebx
mov ebx, 0x10083644
push ebx
call fcn.10066acf
cmp dword [0x10083644], 0xffffffff
pop ecx
jne 0x10004409
push esi
push edi
mov edi, 0x10083638
lea esi, [ebp - 0xc]
push 0x1006b428
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10004409

Function at 0x100044c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x75546250
mov dword [ebp - 8], 0x49515c58
mov word [ebp - 4], 0x3d55
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100836b8]
cmp eax, dword [ecx + 4]
jg 0x10004504
jmp 0x100044fd
pop ebx
mov eax, 0x100836ac
leave
ret
push ebx
mov ebx, 0x100836b8
push ebx
call fcn.10066acf
cmp dword [0x100836b8], 0xffffffff
pop ecx
jne 0x100044fc
push esi
push edi
mov edi, 0x100836ac
lea esi, [ebp - 0xc]
push 0x1006b446
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100044fc
Function at 0x1000453e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x75536250
mov dword [ebp - 0xc], 0x525f4954
mov dword [ebp - 8], 0x49586e45
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083710]
mov byte [ebp - 4], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10004583
jmp 0x1000457c
pop ebx
mov eax, 0x10083700
leave
ret
push ebx
mov ebx, 0x10083710
push ebx
call fcn.10066acf
cmp dword [0x10083710], 0xffffffff
pop ecx
jne 0x1000457b
push esi
push edi
mov edi, 0x10083700
lea esi, [ebp - 0x10]
push 0x1006b454
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000457b

Function at 0x100045bd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x745f6250
mov dword [ebp - 8], 0x525e6e4e
mov dword [ebp - 4], 0x3d59584d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083694]
cmp eax, dword [ecx + 4]
jg 0x100045fe
jmp 0x100045f7
pop ebx
mov eax, 0x10083688
leave
ret
push ebx
mov ebx, 0x10083694
push ebx
call fcn.10066acf
cmp dword [0x10083694], 0xffffffff
pop ecx
jne 0x100045f6
push esi
push edi
mov edi, 0x10083688
lea esi, [ebp - 0xc]
push 0x1006b462
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100045f6
Function at 0x10004e2a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068595
mov eax, dword fs:[0]
push eax
mov eax, 0x1844
call fcn.10066ca0
mov eax, dword [0x10082940]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x10083614]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1838], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, dword [0x10082ef0]
push eax
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
mov ecx, esi
call edx
mov dword [ebp - 0x1834], eax
test eax, eax
je 0x10005073
movss xmm0, dword [0x1006d628]
movss dword [ebp - 0x1830], xmm0
test edi, edi
je 0x10005070
push ecx
and dword [esp], 0
lea esi, [edi + 4]
mov eax, dword [esi]
lea ecx, [ebp - 0x1810]
push pe_nt_image_headers32
push 0x80
push ecx
mov eax, dword [eax + 0x34]
mov ecx, esi
call eax
test al, al
je 0x10005070
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x20]
call eax
mov ecx, dword [0x10083618]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x80]
call edx
mov esi, eax
test esi, esi
je 0x10005070
mov ecx, edi
call fcn.100051d9
mov ecx, esi
push dword [eax]
call fcn.1000527f
mov ebx, eax
test ebx, ebx
je 0x10005070
mov esi, dword [ebp - 0x182c]
xor eax, eax
mov dword [ebp - 0x1824], eax
cmp dword [ebx + 4], eax
jle 0x1000506c
xor ecx, ecx
mov dword [ebp - 0x1820], esi
mov dword [ebp - 0x1828], ecx
cmp eax, 0x13
jge 0x1000504d
mov edi, dword [ebx + 8]
add edi, ecx
add edi, ebx
je 0x1000504d
imul eax, dword [edi], 0x30
lea ecx, [ebp - 0x1850]
sub esp, 0xc
movss xmm0, dword [ebp + eax - 0x17e4]
movss xmm1, dword [ebp + eax - 0x17f4]
movss xmm2, dword [ebp + eax - 0x1804]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm1
movss dword [esp], xmm2
call fcn.1006595e
mov esi, eax
mov ecx, dword [ebp - 0x1834]
lea eax, [ebp - 0x1844]
and dword [ebp - 4], 0
push eax
call fcn.10002afd
mov ecx, dword [ebp - 0x1838]
add ecx, 0xc
mov byte [ebp - 4], 1
push ecx
push esi
push eax
lea eax, [ebp - 0x181c]
push eax
call fcn.1005eea2
add esp, 0x10
lea ecx, [ebp - 0x1844]
call fcn.10017f29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1850]
call fcn.10017f29
fld dword [ebp - 0x1818]
push ecx
push ecx
fstp dword [esp + 4]
fld dword [ebp - 0x181c]
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
movss xmm0, dword [ebp - 0x1830]
fstp dword [ebp - 0x182c]
movss xmm1, dword [ebp - 0x182c]
comiss xmm0, xmm1
pop ecx
pop ecx
lea ecx, [ebp - 0x181c]
jbe 0x1000503c
mov esi, dword [edi]
movss dword [ebp - 0x1830], xmm1
mov dword [ebp - 0x1820], esi
call fcn.10017f29
mov eax, dword [ebp - 0x1824]
mov ecx, dword [ebp - 0x1828]
jmp 0x10005053
call fcn.10017f29
mov eax, dword [ebp - 0x1824]
mov ecx, dword [ebp - 0x1828]
mov esi, dword [ebp - 0x1820]
inc eax
add ecx, 0x44
mov dword [ebp - 0x1824], eax
mov dword [ebp - 0x1828], ecx
cmp eax, dword [ebx + 4]
jl 0x10004f38
mov eax, esi
jmp 0x10005073
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10066b33
leave
ret
Function at 0x10005355
Capabilities:
Access peb ldr_data

Disassembly:
push 0x1c
mov eax, 0x10068606
call fcn.10066b64
mov edi, ecx
mov ecx, dword [0x10083614]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x10082ef0]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword fs:[0x2c]
mov esi, eax
mov edx, dword [0x105d2308]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x10083738]
cmp ecx, dword [edx + 4]
jg 0x100053d0
mov ecx, dword [0x10083734]
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
call eax
test eax, eax
je 0x100053b3
cmp edi, esi
jmp 0x100053c7
mov ecx, esi
call fcn.10003908
mov ecx, edi
mov esi, eax
call fcn.10003908
mov ecx, dword [eax]
cmp ecx, dword [esi]
setne al
call fcn.10066b41
ret
push 0x10083738
call fcn.10066acf
cmp dword [0x10083738], 0xffffffff
pop ecx
jne 0x1000539e
mov eax, dword [0x10082ef8]
lea ecx, [ebp - 0xd]
and dword [ebp - 4], 0
mov eax, dword [eax]
mov ebx, dword [eax + 0x44]
call fcn.10003ff8
mov ecx, eax
call fcn.10003fe2
push eax
lea ecx, [ebp - 0x28]
call fcn.100013ff
cmp dword [eax + 0x14], 0xf
mov byte [ebp - 4], 1
jbe 0x10005418
mov eax, dword [eax]
jmp 0x10005418
mov ecx, dword [0x10082ef8]
push eax
call ebx
lea ecx, [ebp - 0x28]
mov dword [0x10083734], eax
call fcn.100023cf
or dword [ebp - 4], 0xffffffff
push 0x10083738
call fcn.10066a7e
pop ecx
jmp 0x1000539e
Function at 0x10006274
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100837e4]
cmp eax, dword [ecx + 4]
jg 0x100062b5
jmp 0x100062ae
pop ebx
mov eax, 0x100837d8
leave
ret
push ebx
mov ebx, 0x100837e4
push ebx
call fcn.10066acf
cmp dword [0x100837e4], 0xffffffff
pop ecx
jne 0x100062ad
push esi
push edi
mov edi, 0x100837d8
lea esi, [ebp - 0xc]
push 0x1006b4d9
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100062ad

Function at 0x10006b9d
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x2c], 0
je 0x10006baf
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x2d
jb 0x10006ba5
mov eax, ecx
ret

Function at 0x10006bb2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cdc1c]
cmp eax, dword [ecx + 4]
jg 0x10006bf3
jmp 0x10006bec
pop ebx
mov eax, 0x105cdc10
leave
ret
push ebx
mov ebx, 0x105cdc1c
push ebx
call fcn.10066acf
cmp dword [0x105cdc1c], 0xffffffff
pop ecx
jne 0x10006beb
push esi
push edi
mov edi, 0x105cdc10
lea esi, [ebp - 0xc]
push 0x1006b518
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x10006beb

Function at 0x1000723f
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1a], 0
je 0x10007251
xor eax, eax
xor byte [ecx + eax], 0x3d
inc eax
cmp eax, 0x1b
jb 0x10007247
mov eax, ecx
ret

Function at 0x100072d3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7e626979
mov dword [ebp - 8], 0x5c516d6e
mov dword [ebp - 4], 0x3d4f5844
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cf990]
cmp eax, dword [ecx + 4]
jg 0x10007314
jmp 0x1000730d
pop ebx
mov eax, 0x105cf984
leave
ret
push ebx
mov ebx, 0x105cf990
push ebx
call fcn.10066acf
cmp dword [0x105cf990], 0xffffffff
pop ecx
jne 0x1000730c
push esi
push edi
mov edi, 0x105cf984
lea esi, [ebp - 0xc]
push 0x1006b562
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000730c
Function at 0x1000734d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cf96c]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x10007394
jmp 0x1000738d
pop ebx
mov eax, 0x105cf95c
leave
ret
push ebx
mov ebx, 0x105cf96c
push ebx
call fcn.10066acf
cmp dword [0x105cf96c], 0xffffffff
pop ecx
jne 0x1000738c
push esi
push edi
mov edi, 0x105cf95c
lea esi, [ebp - 0x10]
push 0x1006b56f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000738c

Function at 0x100073cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x7f626979
mov dword [ebp - 0xc], 0x6d584e5c
mov dword [ebp - 8], 0x58445c51
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cf9b8]
mov word [ebp - 4], 0x3d4f
cmp eax, dword [ecx + 4]
jg 0x10007416
jmp 0x1000740f
pop ebx
mov eax, 0x105cf9a8
leave
ret
push ebx
mov ebx, 0x105cf9b8
push ebx
call fcn.10066acf
cmp dword [0x105cf9b8], 0xffffffff
pop ecx
jne 0x1000740e
push esi
push edi
mov edi, 0x105cf9a8
lea esi, [ebp - 0x10]
push 0x1006b57e
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000740e

Function at 0x100074d9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x7b5b6250
mov dword [ebp - 8], 0x4e5a5c51
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cf9a0]
cmp eax, dword [ecx + 4]
jg 0x10007517
jmp 0x10007510
pop ebx
mov eax, 0x105cf994
leave
ret
push ebx
mov ebx, 0x105cf9a0
push ebx
call fcn.10066acf
cmp dword [0x105cf9a0], 0xffffffff
pop ecx
jne 0x1000750f
push esi
push edi
mov edi, 0x105cf994
lea esi, [ebp - 0xc]
push 0x1006b59f
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000750f
Function at 0x10007550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x6e5f6250
mov dword [ebp - 8], 0x4949524d
mov word [ebp - 4], 0x5958
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cf97c]
mov byte [ebp - 2], 0x3d
cmp eax, dword [ecx + 4]
jg 0x10007594
jmp 0x1000758d
pop ebx
mov eax, 0x105cf970
leave
ret
push ebx
mov ebx, 0x105cf97c
push ebx
call fcn.10066acf
cmp dword [0x105cf97c], 0xffffffff
pop ecx
jne 0x1000758c
push esi
push edi
mov edi, 0x105cf970
lea esi, [ebp - 0xc]
push 0x1006b5ac
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000758c

Function at 0x100079e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x105d2100]
push ebx
push esi
call fcn.10007c83
mov ecx, dword [0x10083614]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x6c]
call edx
xor ebx, ebx
test al, al
je 0x10007af8
mov ecx, dword [0x10083614]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10007af8
mov ecx, dword [0x105d2100]
test ecx, ecx
je 0x10007af8
call fcn.10005133
cmp dword [eax], ebx
jle 0x10007af8
cmp dword [0x105d2100], ebx
je 0x10007af8
cmp esi, 9
je 0x10007afe
cmp esi, 8
je 0x10007afe
cmp esi, 0xa
je 0x10007afe
cmp byte [0x105cf94f], bl
je 0x10007a7a
mov dword [0x105cf9e4], ebx
mov dword [0x105cf9dc], ebx
mov byte [0x105cf94e], bl
cmp byte [0x10082718], bl
je 0x10007afe
push dword [0x1008271c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10007afe
mov eax, dword [0x10082ef4]
cmp byte [0x105cf94e], bl
je 0x10007aab
mov ecx, dword [eax + 0x1c]
mov dword [0x105cf9e4], ecx
jmp 0x10007ab1
mov ecx, dword [0x105cf9e4]
mov eax, dword [eax + 0x1c]
sub eax, ecx
cmp eax, dword [0x105cf9e0]
jg 0x10007ae5
cmp dword [0x105cf9dc], ebx
jle 0x10007add
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x30]
and dword [ecx + 0x28], ebx
and eax, 0xfffff9e7
and dword [ecx + 0x24], ebx
or eax, 4
mov dword [ecx + 0x30], eax
mov byte [0x105cf94e], bl
jmp 0x10007afe
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
mov dword [0x105cf9e8], eax
mov dword [0x105cf9dc], ebx
jmp 0x10007afe
mov dword [0x105cf9e4], ebx
pop esi
pop ebx
pop ebp
ret
Function at 0x10007ba8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x105d2100], 0
je 0x10007c81
cmp byte [0x10082722], 0
je 0x10007c81
push dword [0x10082724]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10007c81
cmp dword [0x105d2100], 0
je 0x10007c81
mov ecx, dword [0x10083614]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10007c81
mov ecx, dword [0x10083614]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10007c81
mov ecx, dword [0x105d2100]
call fcn.10007c83
cmp eax, 9
je 0x10007c81
cmp eax, 8
je 0x10007c81
cmp eax, 0xa
je 0x10007c81
mov ecx, dword [0x105d2100]
call fcn.10007b02
test byte [eax], 1
mov eax, dword [0x10082ef4]
je 0x10007c47
mov ecx, dword [eax + 0x1c]
mov dword [0x105cf950], ecx
jmp 0x10007c4d
mov ecx, dword [0x105cf950]
mov eax, dword [eax + 0x1c]
sub eax, ecx
cmp eax, dword [0x10082770]
jle 0x10007c63
mov byte [0x105cf94d], 0
pop ebp
ret
mov ecx, dword [0x105d2100]
mov byte [0x105cf94d], 1
call fcn.10007b02
test byte [eax], 1
jne 0x10007c81
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 4
pop ebp
ret

Function at 0x1000861f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0x10], 0x70536250
mov dword [ebp - 0xc], 0x51585952
mov dword [ebp - 8], 0x58595374
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfa7c]
mov word [ebp - 4], 0x3d45
cmp eax, dword [ecx + 4]
jg 0x10008666
jmp 0x1000865f
pop ebx
mov eax, 0x105cfa6c
leave
ret
push ebx
mov ebx, 0x105cfa7c
push ebx
call fcn.10066acf
cmp dword [0x105cfa7c], 0xffffffff
pop ecx
jne 0x1000865e
push esi
push edi
mov edi, 0x105cfa6c
lea esi, [ebp - 0x10]
push 0x1006b5fc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x1000865e

Function at 0x100086a1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x105d2308]
mov dword [ebp - 0xc], 0x72556250
mov dword [ebp - 8], 0x4f58534a
mov byte [ebp - 4], 0x3d
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x105cfaa8]
cmp eax, dword [ecx + 4]
jg 0x100086df
jmp 0x100086d8
pop ebx
mov eax, 0x105cfa9c
leave
ret
push ebx
mov ebx, 0x105cfaa8
push ebx
call fcn.10066acf
cmp dword [0x105cfaa8], 0xffffffff
pop ecx
jne 0x100086d7
push esi
push edi
mov edi, 0x105cfa9c
lea esi, [ebp - 0xc]
push 0x1006b60b
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.10066a3e
push ebx
call fcn.10066a7e
pop ecx
pop ecx
pop edi
pop esi
jmp 0x100086d7

Function at 0x10008862
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x10008885
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x10008873
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1000a098
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10082940]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x1000a0f0
cmp byte [esi + 0x3d], bl
je 0x1000a0f0
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1000a12a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, ebx
je 0x1000a101
sub eax, 1
je 0x1000a104
dec eax
sub eax, 1
jne 0x1000a12a
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066b33
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000a122
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1000a12a
cmp byte [esi + 0x3d], bl
sete al
jmp 0x1000a0f2
xor al, al
jmp 0x1000a0f2

Function at 0x1000a40e
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1f], 0
je 0x1000a42d
xor eax, eax
movups xmm0, xmmword [eax + ecx]
xorps xmm0, xmmword [0x1006d700]
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x1000a416
ret