joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019cc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x100683b8], 0
nop dword [eax + eax]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.1000a7a0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10019d33
test eax, 0x68000
jne 0x10019d33
mov eax, dword [esp + 0x22]
test eax, eax
je 0x10019e91
cmp eax, 5
je 0x10019e7f
xorps xmm0, xmm0
lea edx, [esp + 0x50]
mov ecx, esi
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x60], xmm0
movq qword [esp + 0x70], xmm0
call fcn.1000a7a0
mov eax, dword [esp + 0x56]
cmp eax, 0xffffffff
je 0x10019d67
test eax, 0x68000
jne 0x10019d67
mov ecx, dword [esp + 0x52]
jmp 0x10019d6a
or ecx, 0xffffffff
mov eax, dword [0x100683b8]
add eax, ecx
add esi, eax
mov dword [0x100683b8], eax
cmp eax, 5
jl 0x10019cf0
push eax
call fcn.1003e119
add esp, 4
mov dword [0x100683c0], eax
mov dword [0x100683bc], edi
push 0x40
push 0x3000
push dword [0x100683b8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x10019e91
push dword [0x100683b8]
push edi
push dword [0x100683c0]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x100683b8]
push dword [0x100683c0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x100683b8]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add ecx, esi
mov dword [esp + 0x21], eax
add esp, 0xc
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x100683b8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100683b8], 5
mov cl, 5
jle 0x10019e38
mov eax, 5
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x100683b8]
jl 0x10019e27
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x100683b8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.1003da32
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x100683b8]
add eax, 4
mov dword [0x100683b8], eax
jmp 0x10019d81
mov ecx, dword [esp + 0x8c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1003da32
mov esp, ebp
pop ebp
ret 8
Function at 0x10019eb0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x34
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x30], eax
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov eax, dword [0x10047ee0]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
push edi
push 0
push 0
mov dword [esp + 0x40], eax
mov esi, ecx
mov ax, word [0x10047ee4]
push 3
movups xmmword [esp + 0x1c], xmm0
push 0
movups xmm0, xmmword [0x10047ec8]
mov word [esp + 0x4c], ax
mov eax, 0x30
push 0
mov word [esp + 0x4e], ax
lea eax, [esp + 0x24]
movups xmmword [esp + 0x34], xmm0
push 0xc0000000
movq xmm0, qword [0x10047ed8]
push eax
movq qword [esp + 0x4c], xmm0
call ebp
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10019f88
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call edi
cmp eax, 2
jne 0x10019f53
mov ax, word [esp + 0x3a]
cmp ax, 0x39
jae 0x10019fa0
inc ax
mov word [esp + 0x3a], ax
jmp 0x10019f6a
cmp eax, 0xe7
jne 0x10019fa0
push 0x2710
lea eax, [esp + 0x14]
push eax
call ebx
test eax, eax
je 0x10019fa0
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea eax, [esp + 0x28]
push eax
call ebp
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10019f38
pop edi
mov byte [esi], 1
mov al, 1
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1003da32
add esp, 0x34
ret
mov ecx, dword [esp + 0x40]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003da32
add esp, 0x34
ret

Function at 0x10019fe0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x10019fef
mov al, 1
pop esi
ret 8
test ecx, ecx
jne 0x10019ff9
xor al, al
pop esi
ret 8
mov ecx, dword [ecx + 4]
cmp ecx, 0xffffffff
je 0x10019ff3
mov eax, dword [esp + 8]
test eax, eax
je 0x10019ff3
push 0
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0
push edx
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1001a030
cmp dword [esp + 0xc], esi
jne 0x1001a030
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x1001a1d0
Capabilities:
Set registry value

Disassembly:
push ecx
mov dword [esp], 0
push esi
mov esi, ecx
mov eax, esi
test edx, edx
je 0x1001a20b
cmp word [edx], 0
je 0x1001a20b
push 0
lea eax, [esp + 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1001a23b
mov eax, dword [esp + 4]
push edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 1
push 0
push dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 8]
mov edi, eax
test ecx, ecx
je 0x1001a238
cmp ecx, esi
je 0x1001a238
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1001bbc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov eax, ecx
mov ebx, 1
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
lea ebp, [eax + 0x10]
mov dword [esp + 0x10], eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], esi
push 0x5851f42d
xor eax, eax
mov ecx, esi
push 0x4c957f2d
shr ecx, 0x1e
xor eax, esi
xor ecx, edi
push eax
push ecx
call fcn.1003ee20
mov edi, eax
lea ebp, [ebp + 8]
mov eax, ebx
mov esi, edx
cdq
add edi, eax
mov dword [ebp - 8], edi
adc esi, edx
inc ebx
mov dword [ebp - 4], esi
cmp ebx, 0x138
jl 0x1001bbe1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], 0x138
pop ebx
pop ecx
ret 0x10

Function at 0x1001c7b0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [0x100683c4]
push esi
push dword [esp + 0x18]
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x1001c867
mov eax, dword [edi]
test eax, eax
je 0x1001c822
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x1001c822
test ebx, ebx
je 0x1001c822
push 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1001c822
cmp dword [esp + 0x18], esi
je 0x1001c867
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x1001c842
mov eax, dword [edi + 4]
cmp eax, 3
je 0x1001c836
cmp eax, 1
jne 0x1001c842
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
pop ecx
ret 8
pop edi
pop esi
mov al, 1
pop ebx
pop ecx
ret 8
Function at 0x1002a100
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.10029f10
mov ecx, dword [0x1006c4b4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002a146
cmp byte [0x10febc84], 0
je 0x1002a146
push dword [0x10feb8f4]
push dword [0x10feb8f0]
push dword [0x10feb8ec]
push dword [0x10feb8e8]
call fcn.10029900
push 0x2d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1002a163
cmp byte [0x1006c40b], 0
sete al
mov byte [0x1006c40b], al
jmp 0x1002a168
mov al, byte [0x1006c40b]
test al, al
je 0x1002a251
call fcn.10037980
cmp byte [0x10febd1d], 0
je 0x1002a18a
call fcn.1000fff0
mov byte [0x10febd1d], 0
cmp byte [0x10febd1c], 0
je 0x1002a19f
call fcn.10013500
mov byte [0x10febd1c], 0
push dword [0x10feb8c4]
push dword [0x10feb8c0]
push dword [0x10feb8bc]
push dword [0x10feb8b8]
call fcn.10029880
push dword [0x10fec388]
push dword [0x10fec380]
call fcn.10037590
mov esi, dword [0x10feb8e8]
xor eax, eax
mov edx, dword [0x10feb8ec]
test esi, esi
mov edi, dword [0x1006c418]
mov ebx, dword [0x1006c414]
cmovs esi, eax
test edx, edx
mov ecx, ebx
cmovs edx, eax
sub ecx, dword [0x10feb8f0]
mov eax, edi
sub eax, dword [0x10feb8f4]
cmp esi, eax
cmovg esi, eax
cmp edx, ecx
mov dword [0x10feb8e8], esi
cmovg edx, ecx
mov ecx, dword [0x10feb8b8]
xor eax, eax
mov dword [0x10feb8ec], edx
test ecx, ecx
cmovs ecx, eax
mov eax, dword [0x10feb8bc]
xor edx, edx
test eax, eax
cmovs eax, edx
sub edi, dword [0x10feb8c0]
sub ebx, dword [0x10feb8c4]
cmp ecx, edi
cmovg ecx, edi
cmp eax, ebx
mov dword [0x10feb8b8], ecx
cmovg eax, ebx
mov dword [0x10feb8bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a8b0
Capabilities:
Parse pe header

Disassembly:
call fcn.1002a620
mov edx, eax
test edx, edx
jne 0x1002a8d0
push 0x1004a09c
push 0x10049df4
call fcn.1002d410
add esp, 8
xor eax, eax
ret
mov eax, 0x5a4d
cmp word [edx], ax
je 0x1002a8ea
push 0x10049e58
call fcn.1002d410
add esp, 4
xor eax, eax
ret
mov eax, dword [edx + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x1002a906
push 0x10049e28
call fcn.1002d410
add esp, 4
xor eax, eax
ret
push ebx
push ebp
mov ebp, dword [eax + edx + 0x50]
push esi
push edi
add ebp, edx
xor edi, edi
mov esi, str.8B_0D_________8B_01_FF_50_64_84_C0_74_0B
cmp edx, ebp
jae 0x1002a9b6
mov eax, 0x3f3f
mov bl, byte [esi]
cmp bl, 0x3f
je 0x1002a982
cmp bl, 0x30
jb 0x1002a93d
cmp bl, 0x39
ja 0x1002a93d
movzx ecx, bl
sub ecx, 0x30
jmp 0x1002a946
movzx ecx, bl
and ecx, 0xffffffdf
sub ecx, 0x37
mov al, byte [esi + 1]
cmp al, 0x30
jb 0x1002a959
cmp al, 0x39
ja 0x1002a959
movzx eax, al
sub eax, 0x30
jmp 0x1002a962
movzx eax, al
and eax, 0xffffffdf
sub eax, 0x37
shl ecx, 4
or ecx, eax
movzx eax, byte [edx]
cmp eax, ecx
je 0x1002a97d
test edi, edi
je 0x1002a9a8
mov edx, edi
mov esi, str.8B_0D_________8B_01_FF_50_64_84_C0_74_0B
xor edi, edi
jmp 0x1002a9a8
mov eax, 0x3f3f
test edi, edi
cmove edi, edx
cmp byte [esi + 2], 0
je 0x1002a9ca
cmp word [esi], ax
je 0x1002a99c
mov eax, 2
cmp bl, 0x3f
je 0x1002a9a1
mov eax, 3
add esi, eax
cmp byte [esi], 0
je 0x1002a9ca
inc edx
mov eax, 0x3f3f
cmp edx, ebp
jb 0x1002a924
push 0x10049e90
call fcn.1002d410
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1002d000
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x48]
mov ebp, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], edx
push ecx
push eax
mov dword [esp + 0x14], 0x2b6277
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
mov dword [esp + 0x14], 0
add esp, 8
test ebx, ebx
je 0x1002d08f
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push ebx
push 1
push 4
push edi
call esi
mov ecx, dword [edi]
push ebx
push ecx
push 0xc
push dword [esp + 0x30]
lea eax, [ecx - 1]
mov dword [edi], eax
call esi
mov ecx, dword [edi]
push ebx
push ecx
push 0x24
lea eax, [ecx - 1]
push ebp
mov dword [edi], eax
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x34
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret
mov ecx, 0x3f
xor edx, edx
mov al, byte [edx + str.r_7._2]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1002d0b3
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x1002d096
mov byte [esp + 0x24], 0
mov ecx, 0x6e
xor edx, edx
mov al, byte [edx + 0x1004a7d0]
xor al, cl
inc ecx
mov byte [esp + edx + 0x28], al
and ecx, 0x800000ff
jns 0x1002d0e2
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x1002d0c5
push 0
lea eax, [esp + 0x18]
mov byte [esp + 0x40], 0
push eax
lea eax, [esp + 0x30]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x40]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret
Function at 0x1002d120
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x48]
mov ebp, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], edx
push ecx
push eax
mov dword [esp + 0x14], 0x2b6272
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov ebx, eax
mov dword [esp + 0x14], 0
add esp, 8
test ebx, ebx
je 0x1002d1af
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push ebx
push 1
push 4
push edi
call esi
mov ecx, dword [edi]
push ebx
push ecx
push 0xc
push dword [esp + 0x30]
lea eax, [ecx - 1]
mov dword [edi], eax
call esi
mov ecx, dword [edi]
push ebx
push ecx
push 0x24
lea eax, [ecx - 1]
push ebp
mov dword [edi], eax
call esi
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x34
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret
mov ecx, 0x12
xor edx, edx
mov al, byte [edx + str._bprvmH]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1002d1d3
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x1002d1b6
mov byte [esp + 0x24], 0
mov ecx, 0xa1
xor edx, edx
mov al, byte [edx + 0x1004a818]
xor al, cl
inc ecx
mov byte [esp + edx + 0x28], al
and ecx, 0x800000ff
jns 0x1002d202
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x1002d1e5
push 0
lea eax, [esp + 0x18]
mov byte [esp + 0x40], 0
push eax
lea eax, [esp + 0x30]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x40]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret
Function at 0x1002d240
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x38
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 8]
push edi
push ecx
push eax
mov ebx, edx
mov dword [esp + 0x14], 0x2b6272
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edi, eax
mov dword [esp + 0x14], 0
add esp, 8
test edi, edi
je 0x1002d2cb
push esi
mov esi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push edi
push 1
push 4
push ebx
call esi
push edi
push 1
push 0xc
push dword [esp + 0x30]
call esi
mov ecx, dword [ebx]
push edi
push ecx
push 0x1c
lea eax, [ecx - 1]
push ebp
mov dword [ebx], eax
call esi
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x34
pop esi
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret
mov ecx, 0x5f
xor edx, edx
mov al, byte [edx + 0x1004a848]
xor al, cl
inc ecx
mov byte [esp + edx + 0x14], al
and ecx, 0x800000ff
jns 0x1002d2ef
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x1002d2d2
mov byte [esp + 0x24], 0
mov ecx, 0x69
xor edx, edx
mov al, byte [edx + 0x1004a830]
xor al, cl
inc ecx
mov byte [esp + edx + 0x28], al
and ecx, 0x800000ff
jns 0x1002d31e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x14
jl 0x1002d301
push 0
lea eax, [esp + 0x18]
mov byte [esp + 0x40], 0
push eax
lea eax, [esp + 0x30]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x40]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003da32
add esp, 0x38
ret

Function at 0x1002d480
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x1005200c]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x28], 1
push esi
mov esi, dword [esp + 0x28]
jne 0x1002d592
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0xa4
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1004a954]
xor al, cl
inc ecx
mov byte [esp + edx + 4], al
and ecx, 0x800000ff
jns 0x1002d4cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1002d4b0
push 0x1002d350
lea eax, [esp + 8]
mov byte [esp + 0x14], 0
push eax
push 0x2695b372
lea ecx, [esp + 0x20]
call fcn.1002d5b0
push eax
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x1006d234], eax
mov ecx, 0x10
xor edx, edx
nop dword [eax + eax]
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 4], al
and ecx, 0x800000ff
jns 0x1002d52d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1002d510
push 0x1002d3a0
lea eax, [esp + 8]
mov byte [esp + 0x14], 0
push eax
mov eax, 0x1004a980
lea ecx, [esp + 0x1c]
sub eax, 0x6f6fd167
push eax
call fcn.1002d640
push eax
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x1006d238
push esi
mov dword [0x1006d230], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push esi
push 0x1002ae60
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100683ac], esi
mov ecx, dword [esp + 0x20]
mov eax, 1
pop esi
xor ecx, esp
call fcn.1003da32
add esp, 0x20
ret 0xc
Function at 0x10033e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [edi + eax + 0x1ae5bcb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10033ebd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10033ea0
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret 4

Function at 0x10033ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb6
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1151b3c8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10033efd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10033ee0
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret 4

Function at 0x10033f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x90
xor eax, eax
nop
mov dl, byte [edi + eax - 0x3676a912]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10033f3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x10033f20
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret 4

Function at 0x10033f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd3
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3288abd1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10033f7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10033f60
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10033f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xa3
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3c851f7b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10033fbd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10033fa0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x10034110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x8e
xor eax, eax
nop
mov dl, byte [edi + eax - 0x387c1f1c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1003413d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x16
jl 0x10034120
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x10034150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x21
xor eax, eax
nop
mov dl, byte [edi + eax - 0x754575ac]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1003417d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x15
jl 0x10034160
pop edi
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret 4
Function at 0x10034190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x17
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7361ce9c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100341bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100341a0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10034350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 2
xor eax, eax
nop
mov dl, byte [edi + eax + 0x11501c91]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1003437d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x10034360
pop edi
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret 4

Function at 0x10034390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5c2156bc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100343bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x100343a0
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret 4

Function at 0x10034820
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x10febd0e], 0
je 0x1003486a
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1003486a
cmp byte [0x10febd0e], 0
jne 0x1003491d
mov ecx, dword [esi + 0x3578]
cmp ecx, dword [esi + 0x3570]
jne 0x1003488e
inc dword [esi + 0x3574]
mov eax, dword [esi + 0x3574]
add eax, ecx
mov dword [esi + 0x3578], eax
jmp 0x10034898
mov dword [esi + 0x3574], 0
mov ecx, dword [0x1006c4b4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [0x1006c4b4]
fstp dword [esp + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x120]
call eax
mov ecx, eax
push 0
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [0x1006c4bc]
fstp dword [esp + 0x14]
movss xmm0, dword [esp + 0x14]
addss xmm0, dword [esp + 8]
divss xmm0, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
inc eax
addss xmm0, dword [0x1004cef8]
cvttss2si ecx, xmm0
add eax, ecx
cmp dword [esi + 0x3578], eax
jle 0x10034911
call fcn.1002c9d0
mov dword [esi + 0x3578], eax
mov eax, dword [esi + 0x3578]
mov dword [edi + 0xe08], eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi + 0x35a0], eax
pop esi
pop ecx
ret 8
Function at 0x10037980
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test al, 1
je 0x10037998
mov byte [0x1006d355], 1
jmp 0x100379a8
push 1
call esi
and al, 1
neg al
sbb al, al
and byte [0x1006d355], al
push 2
call esi
test al, 1
je 0x100379b9
mov byte [0x1006d347], 1
jmp 0x100379c9
push 2
call esi
and al, 1
neg al
sbb al, al
and byte [0x1006d347], al
push 1
call esi
test ax, ax
je 0x100379db
mov byte [0x1006d369], 1
jmp 0x100379ea
push 1
call esi
neg ax
sbb al, al
and byte [0x1006d369], al
push 2
call esi
test ax, ax
je 0x100379fc
mov byte [0x1006d354], 1
pop esi
ret
push 2
call esi
neg ax
pop esi
sbb al, al
and byte [0x1006d354], al
ret
Function at 0x1003b7a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x41
call esi
test ax, ax
jne 0x1003b7c6
push 0x57
call esi
test ax, ax
jne 0x1003b7c6
push 0x53
call esi
test ax, ax
jne 0x1003b7c6
push 0x44
call esi
push 0x20
call esi
test ax, ax
je 0x1003b7dc
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
call fcn.1003ad50
pop esi
ret 8