joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007c4c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10140ecd], 0
push esi
je 0x1007c546
mov eax, dword [0x10140d58]
xor edx, edx
mov esi, dword [ebp + 8]
add eax, 0x8d0
nop dword [eax]
cmp byte [eax - 0x18], 0
je 0x1007c53d
movups xmm1, xmmword [esi]
movups xmm0, xmmword [esi + 0x10]
movd ecx, xmm1
movups xmmword [ebp - 0x24], xmm1
movups xmmword [ebp - 0x14], xmm0
cmp dword [eax - 0x10], ecx
jne 0x1007c53d
mov ecx, dword [eax - 8]
cmp ecx, dword [ebp - 0x1c]
jne 0x1007c53d
mov ecx, dword [eax - 4]
cmp ecx, dword [ebp - 0x18]
jne 0x1007c53d
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x14]
jne 0x1007c53d
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp - 0x10]
jne 0x1007c53d
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0xc]
jne 0x1007c53d
mov ecx, dword [eax + 0xc]
cmp ecx, dword [ebp - 8]
je 0x1007c557
inc edx
add eax, 0x28
cmp edx, 0x20
jb 0x1007c4f0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test al, 0xf0
jne 0x1007c575
push 0x10
call esi
test al, 0xf0
je 0x1007c583
push 0xd
call esi
test al, 0xf0
jne 0x1007c583
mov eax, dword [0x10140d58]
cmp byte [eax + 0x8b0], 0
jne 0x1007c546
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100d2719
mov esp, ebp
pop ebp
ret
Function at 0x1007cb40
Capabilities:
Hash data using djb2
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x10]
add eax, eax
cmp dword [edi + 0x14], 8
jb 0x1007cb66
mov edi, dword [edi]
xor ebx, ebx
mov esi, 0x1505
test eax, eax
je 0x1007cb9d
dec eax
lea edi, [edi + 1]
mov dword [ebp - 0x410], eax
mov ecx, ebx
mov eax, esi
shld ebx, esi, 5
shl esi, 5
add esi, eax
movzx eax, byte [edi - 1]
cdq
adc ebx, ecx
add esi, eax
mov eax, dword [ebp - 0x410]
adc ebx, edx
test eax, eax
jne 0x1007cb71
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebx
push esi
push eax
lea eax, [ebp - 0x3ec]
push str.LUNA_NOTIFY._d._llu
push eax
call fcn.10026bb0
add esp, 0x14
lea eax, [ebp - 0x3ec]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x410], eax
test ebx, ebx
je 0x1007cc6e
mov edi, dword [ebp + 0xc]
cmp byte [0x10140ecd], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x1007cc6e
mov eax, dword [0x10140d58]
xor edx, edx
add eax, 0x8d0
nop dword [eax]
cmp byte [eax - 0x18], 0
je 0x1007cc65
movups xmm1, xmmword [edi]
movups xmm0, xmmword [edi + 0x10]
movd ecx, xmm1
movups xmmword [ebp - 0x40c], xmm1
movups xmmword [ebp - 0x3fc], xmm0
cmp dword [eax - 0x10], ecx
jne 0x1007cc65
mov ecx, dword [eax - 8]
cmp ecx, dword [ebp - 0x404]
jne 0x1007cc65
mov ecx, dword [eax - 4]
cmp ecx, dword [ebp - 0x400]
jne 0x1007cc65
mov ecx, dword [eax]
cmp ecx, dword [ebp - 0x3fc]
jne 0x1007cc65
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp - 0x3f8]
jne 0x1007cc65
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x3f4]
jne 0x1007cc65
mov ecx, dword [eax + 0xc]
cmp ecx, dword [ebp - 0x3f0]
je 0x1007cc8f
inc edx
add eax, 0x28
cmp edx, 0x20
jb 0x1007cc00
xor bl, bl
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d2719
mov esp, ebp
pop ebp
ret
push 0x11
call esi
test al, 0xf0
jne 0x1007cca7
push 0x10
call esi
test al, 0xf0
je 0x1007ccb5
push 0xd
call esi
test al, 0xf0
jne 0x1007ccb5
mov eax, dword [0x10140d58]
cmp byte [eax + 0x8b0], 0
jne 0x1007cc6e
cmp ebx, 0x64
mov eax, 0x64
mov esi, ebx
cmova esi, eax
push esi
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1007ccdc
sub ebx, esi
je 0x1007cc6e
jmp 0x1007cbe1
mov bl, 1
jmp 0x1007cc70
Function at 0x1007fee0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ffb38
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x10cb851c
mov dword [ebp - 0x18], 0x10cb851c
call fcn.100a62c0
add esp, 4
test eax, eax
je 0x1007ff29
push eax
call fcn.100a64e0
add esp, 4
mov eax, dword [0x10cb854c]
xor edi, edi
mov edx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [eax + 4]
nop dword [eax]
mov esi, eax
mov dword [ebp - 0x14], edi
mov eax, ecx
mov bl, byte [eax + 0xd]
mov byte [ebp - 0xd], bl
test bl, bl
mov ebx, dword [ebp + 8]
jne 0x1007ff8a
cmp dword [eax + 0x10], edx
jae 0x1007ff5e
mov eax, dword [eax + 8]
jmp 0x1007ff62
mov esi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1007ff54
mov eax, dword [0x10cb854c]
cmp esi, eax
je 0x1007ff8f
cmp edx, dword [esi + 0x10]
jb 0x1007ff8f
cmp byte [ebp - 0xd], 0
jne 0x100800b4
cmp dword [ecx + 0x10], edx
jae 0x1007ffce
mov ecx, dword [ecx + 8]
jmp 0x1007ffd2
mov eax, dword [0x10cb854c]
inc edi
dec edx
cmp dword [ebp - 0x14], 0
jl 0x1007ff40
xor bl, bl
push 0x10cb851c
mov dword [ebp - 4], 1
call fcn.100a62e5
add esp, 4
test eax, eax
je 0x1007ffba
push eax
call fcn.100a64e0
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x1007ff80
cmp eax, dword [0x10cb854c]
je 0x100800b4
cmp edx, dword [eax + 0x10]
jb 0x100800b4
lea esi, [eax + 0x18]
test esi, esi
je 0x1007ff97
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push dword [esi]
call edi
test eax, eax
je 0x1008001e
mov ecx, dword [esi]
mov al, byte [esi + 0x3c]
mov byte [ecx], al
lea eax, [ebp + 8]
push eax
push dword [esi + 0x40]
push 4
push dword [esi]
call edi
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
mov edi, dword [0x10cb854c]
mov esi, edi
mov eax, dword [edi + 4]
lea edx, [edi + 4]
cmp byte [eax + 0xd], 0
jne 0x10080061
nop dword [eax + eax]
mov ecx, dword [eax + 0x10]
cmp ecx, ebx
jae 0x1008004c
mov eax, dword [eax + 8]
jmp 0x1008005b
cmp byte [esi + 0xd], 0
je 0x10080057
cmp ebx, ecx
cmovb esi, eax
mov edi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10080040
cmp byte [esi + 0xd], 0
cmove edx, esi
mov eax, dword [edx]
cmp byte [eax + 0xd], 0
jne 0x10080084
cmp ebx, dword [eax + 0x10]
jae 0x1008007b
mov esi, eax
mov eax, dword [eax]
jmp 0x1008007e
mov eax, dword [eax + 8]
cmp byte [eax + 0xd], 0
je 0x10080070
mov dword [ebp + 8], edi
cmp edi, esi
je 0x1008009d
nop dword [eax + eax]
lea ecx, [ebp + 8]
call fcn.10006730
cmp dword [ebp + 8], esi
jne 0x10080090
push esi
push edi
lea eax, [ebp + 8]
mov ecx, 0x10cb854c
push eax
call fcn.1007fd40
mov bl, 1
jmp 0x1007ff99
push str.invalid_map_K__T__key
call fcn.100a5e67
int3
Function at 0x100800c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100800f4
mov ecx, dword [esi]
mov al, byte [esi + 0x3c]
mov byte [ecx], al
lea eax, [ebp - 4]
push eax
push dword [esi + 0x40]
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10083e40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
imul esi, dword [ebp + 8], 0x2c
push edi
add esi, dword [0x10cba080]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp + 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10083e88
pop edi
mov eax, 0xa
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10083ead
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10083ece
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10083ece
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10083ec8
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10083ece
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, byte [esi + 0x14]
and bl, 1
mov cl, bl
and al, 0xfd
add cl, cl
shl bl, 2
or cl, al
and cl, 0xfb
or cl, bl
xor eax, eax
pop ebx
pop edi
mov byte [esi + 0x14], cl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10083fb0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push ebx
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x1008414d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100840c5
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x10084089
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x10084089
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x10084089
mov edx, dword [esi]
test edx, edx
jne 0x10084055
push 0x200
push edx
mov dword [esi + 4], 0x80
push dword [0x10cb8570]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x100840ad
jmp 0x1008407d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1008407d
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x10cb8570]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x100840ad
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x10084010
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100840c5
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x100840c5
push eax
push ebx
push dword [0x10cb8570]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1008414d
cmp dword [esi], 0
je 0x1008413a
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1008413a
nop dword [eax]
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
mov dword [ebp - 0x24], 0
test ebx, ebx
je 0x1008412b
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1008411e
push dword [ebp + 0x10]
mov dword [ebp - 0x24], 1
push dword [ebp + 0xc]
push ebx
call fcn.10084800
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x24], 0
jne 0x10084134
mov ecx, dword [esi]
mov dword [ecx + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jb 0x100840e0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 9
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d2719
mov esp, ebp
pop ebp
ret
Function at 0x10084a70
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x10084ac7
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x10084ab7
push edi
mov eax, dword [ebx]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x10084aae
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10084aae
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x10084a86
mov eax, dword [ebx]
pop edi
push eax
push 0
push dword [0x10cb8570]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
pop ebp
ret

Function at 0x10084ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x10cba074]
test eax, eax
je 0x10084aec
nop dword [eax]
cmp dword [eax + 4], 0
jne 0x10084b44
mov eax, dword [eax]
test eax, eax
jne 0x10084ae0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10084b56
push esi
lea edx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov esi, 0x20
nop dword [eax + eax]
mov ecx, dword [eax + 4]
add esi, 0x20
mov dword [edx], ecx
mov dword [eax + 4], edx
add edx, 0x20
cmp esi, 0xfe0
jbe 0x10084b20
mov ecx, dword [0x10cba074]
mov dword [eax], ecx
mov dword [0x10cba074], eax
pop esi
test eax, eax
je 0x10084b56
mov edx, dword [eax + 4]
mov ecx, dword [edx]
inc dword [eax + 8]
mov dword [eax + 4], ecx
mov eax, edx
ret
xor eax, eax
ret
Function at 0x1008cc00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 0xa]
xor edx, 0x811c9dc5
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
imul edx, esi, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
imul ecx, edx, 0x1000193
mov edx, dword [edi + 0x18]
and edx, ecx
lea esi, [edx*8]
mov edx, dword [edi + 0xc]
add edx, esi
mov ecx, dword [edx]
cmp dword [edx + 4], eax
jne 0x1008cc73
cmp ecx, eax
jne 0x1008cc6b
mov ecx, dword [edi + 4]
mov dword [edx], ecx
mov edx, dword [edi + 0xc]
mov ecx, dword [edi + 4]
mov dword [esi + edx + 4], ecx
jmp 0x1008cc7b
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x1008cc7b
cmp ecx, eax
jne 0x1008cc7b
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov esi, dword [eax]
push 0x30
push eax
mov dword [ecx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
dec dword [edi + 8]
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebp
ret 8
Function at 0x1009e990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101016b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013a098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x1009e9d7
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add eax, eax
je 0x1009e9f8
mov edi, eax
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1009e9e4
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 4]
and eax, edx
lea ecx, [eax*8]
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp + 0xc], eax
cmp dword [eax], esi
je 0x1009ea1b
mov esi, dword [eax + 4]
mov esi, dword [esi]
mov edx, dword [edi + 0x10]
jmp 0x1009ea23
mov eax, dword [ebp + 0xc]
cmp esi, dword [eax]
je 0x1009eaa4
mov esi, dword [esi + 4]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
jb 0x1009ea3b
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x1009ea45
mov ecx, dword [edi]
cmp edx, dword [ebp - 0x14]
jne 0x1009ea20
push edx
push eax
push ecx
call fcn.10034060
mov edx, dword [edi + 0x10]
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 0xc]
jne 0x1009ea23
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 8]
dec dword [ebx + 8]
call fcn.1009f440
push 0x38
push edi
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0xc], edi
mov eax, dword [edi]
cmp esi, eax
je 0x1009ead1
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebp - 0x18]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x1009eaeb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x1009eb0d
cmp eax, esi
jne 0x1009eaf3
mov dword [ecx], edi
jmp 0x1009eb0d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x1009eb0d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1009fb30
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1009ed60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1009ed7c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x1009ed98
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1009ed87
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1009edd1
cmp eax, edi
jne 0x1009edc9
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1009edd9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1009edd9
cmp eax, edi
jne 0x1009edd9
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1009f440
push 0x38
push edi
call fcn.100d26ef
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a12b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edi
mov dword [ebp - 8], ecx
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
mov dword [ebp - 4], eax
jb 0x100a12cf
mov esi, dword [edi]
lea ebx, [eax + eax]
xor ecx, ecx
mov edx, 0x811c9dc5
test ebx, ebx
je 0x100a12f1
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x100a12e0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov ebx, dword [ebx + 4]
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0xc], eax
cmp edx, ebx
jne 0x100a131b
mov eax, ebx
jmp 0x100a131f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x100a139e
cmp dword [edi + 0x14], 8
lea eax, [esi + 8]
mov ecx, edi
jb 0x100a1330
mov ecx, dword [edi]
mov edi, dword [eax + 0x14]
cmp edi, 8
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
jb 0x100a1346
mov eax, dword [eax]
cmp edx, dword [ebp - 4]
jne 0x100a135a
push edx
push ecx
push eax
call fcn.10034060
add esp, 0xc
test eax, eax
je 0x100a1364
mov esi, dword [esi]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
jmp 0x100a1313
cmp dword [ebp - 0x10], 8
lea eax, [esi + 8]
jb 0x100a136f
mov eax, dword [eax]
cmp dword [edi + 0x14], 8
jb 0x100a1377
mov edi, dword [edi]
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x14]
jne 0x100a138e
push ecx
push eax
push edi
call fcn.10034060
add esp, 0xc
test eax, eax
je 0x100a1390
mov esi, ebx
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100a2740
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0x1013a098]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x664]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a27fd
mov bl, byte [ebp + 0xc]
test bl, bl
je 0x100a2784
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a27fd
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp + eax*2 - 0x414]
nop
mov ecx, eax
sub eax, 2
cmp word [eax], 0x5c
jne 0x100a27a0
push edi
push 0x104
push ecx
call fcn.100ddaa5
add esp, 0xc
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a27fd
test bl, bl
je 0x100a27ea
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100a27fd
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d2719
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d2719
mov esp, ebp
pop ebp
ret

Function at 0x100a2ba0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10cb94d0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10cb8e9c]
cmp eax, dword [ecx + 4]
jg 0x100a2be9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x10cb89e8
push edi
push dword [esi]
call ebx
test eax, eax
jne 0x100a2be4
add esi, 4
cmp esi, 0x10cb8e98
jne 0x100a2bd0
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10cb8e9c
call fcn.100d28ed
add esp, 4
cmp dword [0x10cb8e9c], 0xffffffff
jne 0x100a2bbf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0x10140e68
push 0x4b0
push 0x10cb89e8
push eax
call sub.PSAPI.DLL_EnumProcessModules
push 0x10cb8e9c
mov dword [0x10cb8e98], eax
call fcn.100d28a3
add esp, 4
jmp 0x100a2bbf

Function at 0x100a2c30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a2c70
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x100a2c70
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x100a2c70
mov edx, dword [ebp + 0xc]
cmp dword [eax], edx
je 0x100a2c72
add eax, 4
cmp eax, ecx
jb 0x100a2c65
xor eax, eax
pop ebp
ret
Function at 0x100a2c80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x100a2cd7
mov ecx, dword [edx + 0x3c]
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x100a2cd7
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
test byte [eax + 0x24], 0x20
jne 0x100a2cb9
nop dword [eax]
add eax, 0x28
test byte [eax + 0x24], 0x20
je 0x100a2cb0
mov ecx, dword [ebp + 0xc]
add edx, dword [eax + 0xc]
mov dword [ecx], edx
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
and ecx, 0xfffff000
add ecx, 0x1000
add ecx, edx
mov dword [eax], ecx
xor eax, eax
pop ebp
ret