joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066110
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x101e253c]
sub esp, 0x14
push ebx
mov ebx, dword fs:[0x2c]
push esi
mov esi, dword [eax]
push edi
mov edi, dword [0x101e14f0]
cmp esi, 3
jl 0x1006620c
mov eax, dword [0x101dfe74]
inc eax
cmp eax, 3
ja case.default.0x10066144
jmp dword [eax*4 + 0x100662ac]
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x10066165
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
jne case.0x10066144.0
mov eax, dword [0x101e2528]
cmp byte [eax + 0x64767], 0
jne case.0x10066144.0
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x101e0948]
mov dword [esp + 0x10], eax
mov eax, dword [0x101e29e0]
cmp eax, dword [ecx + 4]
jle 0x100661c7
push 0x101e29e0
call fcn.100b5535
add esp, 4
cmp dword [0x101e29e0], 0xffffffff
jne 0x100661c7
mov eax, dword [0x101e2878]
push 0x101e29e0
mov dword [0x101e29d0], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e29d0]
mov ecx, dword [esp + 0x10]
movq xmm0, qword [eax + ecx]
movq qword [esp + 0x14], xmm0
movss xmm0, dword [esp + 0x18]
movss xmm1, dword [esp + 0x14]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm1, xmm0
movss xmm0, dword [0x1016d700]
comiss xmm0, xmm1
jbe 0x1006620c
mov eax, 0x101dd258
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + edi*4]
mov eax, dword [0x101e0948]
mov dword [esp + 0x10], eax
mov eax, dword [0x101e29e0]
cmp eax, dword [ecx + 4]
jle 0x10066252
push 0x101e29e0
call fcn.100b5535
add esp, 4
cmp dword [0x101e29e0], 0xffffffff
jne 0x10066252
mov eax, dword [0x101e2878]
push 0x101e29e0
mov dword [0x101e29d0], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e29d0]
mov ecx, dword [esp + 0x10]
movq xmm0, qword [eax + ecx]
movq qword [esp + 0x14], xmm0
movss xmm1, dword [esp + 0x14]
movss xmm0, dword [esp + 0x18]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
comiss xmm1, dword [0x1016d700]
jbe 0x10066298
cmp esi, 3
jl 0x1006629d
mov eax, 0x101dd280
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 3
jge 0x100662a2
mov eax, 0x101dd2a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10067920
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
call fcn.10066110
test eax, eax
je case.0x100679ef.0
cmp byte [eax + 8], 0
je case.0x100679ef.0
mov eax, dword [0x101dff34]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 3
ja case.default.0x10067959
jmp dword [eax*4 + 0x10067adc]
push dword [0x101dff30]
call esi
jmp 0x10067972
push dword [0x101dff30]
call edi
test ax, ax
setne al
test al, al
jne case.0x100679ef.0
mov eax, dword [0x101dff54]
inc eax
cmp eax, 3
ja case.default.0x1006798b
jmp dword [eax*4 + 0x10067aec]
push dword [0x101dff50]
call esi
jmp 0x100679a4
push dword [0x101dff50]
call edi
test ax, ax
setne al
test al, al
jne case.0x100679ef.0
mov eax, dword [0x101dff74]
inc eax
cmp eax, 3
ja case.default.0x100679bd
jmp dword [eax*4 + 0x10067afc]
push dword [0x101dff70]
call esi
jmp 0x100679d6
push dword [0x101dff70]
call edi
test ax, ax
setne al
test al, al
jne case.0x100679ef.0
mov eax, dword [0x101dff94]
inc eax
cmp eax, 3
ja case.default.0x100679ef
jmp dword [eax*4 + 0x10067b0c]
push dword [0x101dff90]
call esi
jmp 0x10067a08
push dword [0x101dff90]
call edi
test ax, ax
setne al
test al, al
jne case.0x100679ef.0
push 1
push 0
call fcn.100662c0
mov ecx, eax
test ecx, ecx
je case.0x100679ef.0
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov ecx, dword [0x101e0948]
movq xmm0, qword [eax]
mov eax, dword [ecx]
movq qword [esp + 0x1c], xmm0
mov eax, dword [eax + 0x28]
call eax
movq xmm0, qword [eax]
movq qword [esp + 0x10], xmm0
movss xmm1, dword [esp + 0x10]
subss xmm1, dword [esp + 0x1c]
movss xmm0, dword [esp + 0x14]
subss xmm0, dword [esp + 0x20]
movss dword [esp + 0xc], xmm1
divss xmm0, xmm1
call fcn.101321ce
movss xmm1, dword [esp + 0xc]
comiss xmm1, dword [0x1016d438]
mulss xmm0, dword [0x1016d6bc]
movss xmm2, dword [0x1016d73c]
jb 0x10067a9b
addss xmm0, xmm2
movss xmm3, dword [0x1016d858]
comiss xmm3, xmm0
movss xmm1, dword [0x1016d768]
jbe 0x10067ab9
addss xmm0, xmm1
comiss xmm3, xmm0
ja 0x10067ab0
comiss xmm0, xmm2
jbe 0x10067ac9
nop
subss xmm0, xmm1
comiss xmm0, xmm2
ja 0x10067ac0
mov eax, dword [0x101e07bc]
movss dword [eax + 0x10], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10067b20
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [0x101e0948]
push edi
mov edi, ecx
mov eax, dword [esi + 0x258]
cmp eax, 8
je 0x10067c8d
cmp eax, 9
je 0x10067c8d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e14f0]
push ebx
mov ebx, dword [eax + ecx*4]
mov eax, dword [0x101e2744]
cmp eax, dword [ebx + 4]
jle 0x10067b8c
push 0x101e2744
call fcn.100b5535
add esp, 4
cmp dword [0x101e2744], 0xffffffff
jne 0x10067b8c
mov eax, dword [0x101e2734]
push 0x101e2744
mov dword [0x101e271c], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e271c]
test byte [eax + esi], 0x40
jne 0x10067c8c
mov eax, dword [0x101e29cc]
mov esi, dword [0x101e0948]
cmp eax, dword [ebx + 4]
jle 0x10067bdb
push 0x101e29cc
call fcn.100b5535
add esp, 4
cmp dword [0x101e29cc], 0xffffffff
jne 0x10067bdb
mov eax, dword [0x101e287c]
push 0x101e29cc
mov dword [0x101e29b8], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e29b8]
cmp byte [eax + esi], 0
jne 0x10067c8c
mov eax, dword [0x101e0948]
cmp dword [eax + 0x3874], 0
je 0x10067c84
mov eax, dword [0x101e07bc]
or dword [eax + 0x30], 0x400000
mov eax, dword [0x101dfe54]
inc eax
cmp eax, 3
ja case.default.0x10067c13
jmp dword [eax*4 + 0x10067c90]
push dword [0x101dfe50]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x10067c34
push dword [0x101dfe50]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
je case.default.0x10067c13
mov eax, dword [0x101e253c]
cmp dword [eax], 3
jl case.default.0x10067c13
mov eax, dword [0x101e07bc]
test byte [eax + 0x30], 2
jne case.default.0x10067c13
mov eax, dword [0x101e1d50]
mov byte [edi], 1
cmp dword [eax + 0x4cb0], 6
mov eax, dword [0x101e07bc]
jg 0x10067c75
and dword [eax + 0x30], 0xfffffffb
pop ebx
pop edi
pop esi
jmp fcn.10066f30
or dword [eax + 0x30], 4
pop ebx
pop edi
pop esi
jmp fcn.10066f30
mov byte [edi], 0
pop ebx
pop edi
pop esi
jmp fcn.10066f30
pop ebx
pop edi
pop esi
ret
Function at 0x10069620
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [0x101e29f4], 0
push ebx
push esi
push edi
jne 0x100697fd
mov eax, dword [0x101e227c]
test eax, eax
je 0x1006964b
lea ecx, [eax + 1]
mov dword [esp + 0x14], ecx
jmp 0x10069653
mov dword [esp + 0x14], 0
mov eax, dword fs:[0x30]
mov dword [esp + 0x10], 0
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop word [eax + eax]
mov ebx, dword [eax + 0x18]
mov dword [esp + 0x24], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [esp + 0x20], ecx
cmp ecx, ebx
je 0x100696ee
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x100696ee
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
mov esi, dword [ecx - 4]
sub ecx, 4
add esi, ebx
mov dword [esp + 0x1c], ecx
dec edx
mov edi, 0x737f49d9
mov dword [esp + 0x18], edx
mov bl, byte [esi]
inc esi
test bl, bl
je 0x100696e7
movsx edx, bl
lea esi, [esi + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x100696b4
cmp edi, 0x8c0a5077
je 0x100696f5
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10069697
mov eax, dword [eax]
jmp 0x10069670
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push 4
add eax, edx
push ebx
call eax
mov eax, dword fs:[0x30]
mov dword [ebx], 0x11
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov ebx, dword [eax + 0x18]
mov dword [esp + 0x1c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [esp + 0x20], ecx
cmp ecx, ebx
je 0x100697bd
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x100697bd
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [esp + 0x24], ecx
mov edi, 0xf4c75c58
mov dword [esp + 0x18], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x100697b2
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x10069783
cmp edi, 0xee7418aa
je 0x100697c4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10069767
mov eax, dword [eax]
jmp 0x10069740
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
lea ecx, [esp + 0x10]
push ecx
push dword [esp + 0x14]
add eax, edx
push 4
push dword [esp + 0x20]
call eax
mov byte [0x101e29f4], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10069810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x101dfe74]
sub esp, 0x14
inc eax
push ebx
push esi
push edi
cmp eax, 3
ja case.default.0x10069827
jmp dword [eax*4 + 0x100699b0]
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x10069848
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
jne case.0x10069827.0
mov eax, dword [0x101e2528]
cmp byte [eax + 0x64767], 0
jne case.0x10069827.0
mov eax, dword [0x101e2520]
cmp byte [eax], 0
jne case.0x10069827.0
mov eax, dword fs:[0x2c]
mov esi, 1
mov ecx, dword [0x101e14f0]
mov ebx, dword [0x101e0948]
mov edi, dword [eax + ecx*4]
mov eax, dword [0x101e27e0]
cmp eax, dword [edi + 4]
jle 0x100698ca
push 0x101e27e0
call fcn.100b5535
add esp, 4
cmp dword [0x101e27e0], 0xffffffff
jne 0x100698ca
mov eax, dword [0x101e2810]
push 0x101e27e0
mov dword [0x101e27e8], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e27e8]
movss xmm0, dword [eax + ebx]
comiss xmm0, dword [0x1016d438]
mov eax, dword [0x101e0948]
mov dword [esp + 0x10], eax
mov eax, dword [0x101e29e0]
seta bl
cmp eax, dword [edi + 4]
jle 0x10069921
push 0x101e29e0
call fcn.100b5535
add esp, 4
cmp dword [0x101e29e0], 0xffffffff
jne 0x10069921
mov eax, dword [0x101e2878]
push 0x101e29e0
mov dword [0x101e29d0], eax
call fcn.100b54eb
add esp, 4
mov ecx, dword [esp + 0x10]
mov eax, dword [0x101e29d0]
movq xmm0, qword [eax + ecx]
mov ecx, dword [0x101dd2e0]
movq qword [esp + 0x14], xmm0
movss xmm0, dword [esp + 0x18]
movss xmm1, dword [esp + 0x14]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm1, xmm0
movss xmm0, dword [0x1016d700]
comiss xmm0, xmm1
seta dl
test cl, 1
je 0x1006996a
test dl, dl
jne 0x10069994
mov eax, dword [0x101e253c]
test cl, 2
je 0x1006997d
test dl, dl
jne 0x1006997d
cmp dword [eax], 3
jge 0x10069994
test cl, 4
je 0x1006998b
cmp dword [eax], 3
jge 0x1006998b
test bl, bl
je 0x10069994
test cl, 8
je 0x1006999b
test bl, bl
je 0x1006999b
call fcn.100694e0
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100694e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006abe0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x10], ebx
mov edx, dword [ebx + 0x3c]
mov ecx, dword [edx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
je 0x1006ac78
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1006ac78
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
mov esi, dword [ecx - 4]
sub ecx, 4
add esi, ebx
mov dword [ebp - 8], ecx
dec edx
mov edi, 0xc2debf27
mov dword [ebp - 4], edx
mov bl, byte [esi]
inc esi
test bl, bl
je 0x1006ac71
movsx edx, bl
lea esi, [esi + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x1006ac40
cmp edi, 0x5308d8a1
je 0x1006ac7c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1006ac25
mov eax, dword [eax]
jmp 0x1006ac00
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
push dword [ebp - 0x14]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
cmp eax, 0xffffffff
jne 0x1006ad64
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x10], ecx
cmp ecx, ebx
je 0x1006ad38
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1006ad38
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop dword [eax]
sub ecx, 4
dec edx
mov dword [ebp - 0x14], ecx
mov edi, 0x3f96a982
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1006ad2e
nop word [eax + eax]
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1006ad00
cmp edi, 0xc9b30284
je 0x1006ad3f
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1006ace0
mov eax, dword [eax]
jmp 0x1006acb4
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
cmp eax, 2
jmp 0x1006ad66
test al, 0x10
jne 0x1006ad71
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100783d0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 8], ecx
mov esi, dword [eax + ecx*8 + 4]
cmp esi, edx
je 0x100784a2
mov ecx, dword [eax + ecx*8]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
je 0x1007843c
nop
cmp esi, ecx
je 0x100784a2
mov esi, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x10078430
test esi, esi
je 0x100784a2
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + ecx*8]
cmp dword [edi + ecx*8 + 4], esi
jne 0x10078465
cmp eax, esi
jne 0x1007845c
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], edx
jmp 0x1007846e
mov edx, dword [esi + 4]
mov dword [edi + ecx*8 + 4], edx
jmp 0x1007846e
cmp eax, esi
jne 0x1007846e
mov eax, dword [esi]
mov dword [edi + ecx*8], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0xc]
call fcn.1005c190
push 0x94
push esi
call fcn.100b595a
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007b0c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.10078b90
mov ecx, esi
call fcn.1007aa00
test al, al
je case.0x1007b12f.0
mov eax, dword [0x101e07bc]
mov ecx, dword [0x101e0948]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [eax + 4]
mov dword [0x101e0824], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 4], 0
call dword [0x101e1e48]
mov eax, dword [ebp - 4]
movq xmm0, qword [ebp - 0xc]
mov dword [0x101e07fc], eax
mov eax, dword [0x101dfe74]
inc eax
movq qword [0x101e07f4], xmm0
cmp eax, 3
ja case.default.0x1007b12f
jmp dword [eax*4 + 0x1007b268]
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1007b150
push dword [0x101dfe70]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
jne case.0x1007b12f.0
mov eax, dword [0x101e2520]
cmp byte [eax], 0
jne case.0x1007b12f.0
mov eax, dword [0x101e2534]
cmp byte [eax + 0x1c], 0
jne case.0x1007b12f.0
mov esi, dword [0x101e094c]
mov ecx, esi
push edi
mov eax, dword [esi]
mov eax, dword [eax + 0x6f8]
call eax
mov edi, eax
test edi, edi
je 0x1007b1ff
mov ecx, dword fs:[0x2c]
mov edx, dword [0x101e14f0]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x101e274c]
cmp ecx, dword [edx + 4]
jle 0x1007b1df
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x1007b1df
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
cmp word [eax + esi], 0x1f
je 0x1007b207
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x1007b207
cmp eax, 7
jl 0x1007b1ff
cmp eax, 0x10
jle 0x1007b207
mov eax, dword [0x101e07c0]
mov byte [eax], 1
pop edi
mov ecx, dword [0x101e07bc]
mov eax, dword [0x101e0824]
pop esi
cmp eax, dword [ecx + 4]
mov eax, dword [0x101e1d50]
sete byte [0x101e0866]
cmp dword [eax + 0x4cb0], 1
jl 0x1007b24f
mov eax, dword [0x101e07c0]
cmp byte [eax], 0
je 0x1007b24f
movq xmm0, qword [ecx + 0xc]
movq qword [0x101e07dc], xmm0
mov eax, dword [ecx + 0x14]
mov dword [0x101e07e4], eax
mov esp, ebp
pop ebp
ret
movq xmm0, qword [ecx + 0xc]
movq qword [0x101e07e8], xmm0
mov eax, dword [ecx + 0x14]
mov dword [0x101e07f0], eax
mov esp, ebp
pop ebp
ret
Function at 0x1007c2c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x101e07a9], 0
push ebx
mov ebx, ecx
je 0x1007c50d
mov eax, dword fs:[0x2c]
mov edx, dword [0x101e14f0]
push esi
push edi
mov edi, dword [0x101e0948]
mov esi, dword [eax + edx*4]
mov eax, dword [0x101e26f4]
cmp eax, dword [esi + 4]
jle 0x1007c321
push 0x101e26f4
call fcn.100b5535
add esp, 4
cmp dword [0x101e26f4], 0xffffffff
jne 0x1007c321
mov eax, dword [0x101e26fc]
push 0x101e26f4
mov dword [0x101e26f8], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e26f8]
cmp dword [eax + edi], 0
jne 0x1007c50b
mov eax, dword [0x101e26ec]
cmp eax, dword [esi + 4]
jle 0x1007c36a
push 0x101e26ec
call fcn.100b5535
add esp, 4
cmp dword [0x101e26ec], 0xffffffff
jne 0x1007c36a
mov eax, dword [0x101e2700]
push 0x101e26ec
mov dword [0x101e26f0], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e26f0]
cmp dword [eax + edi], 0
jle 0x1007c50b
mov edi, dword [0x101e0948]
mov eax, dword [edi + 0x258]
cmp eax, 9
je 0x1007c50b
cmp eax, 8
je 0x1007c50b
mov eax, dword [0x101e2744]
cmp eax, dword [esi + 4]
jle 0x1007c3d1
push 0x101e2744
call fcn.100b5535
add esp, 4
cmp dword [0x101e2744], 0xffffffff
jne 0x1007c3d1
mov eax, dword [0x101e2734]
push 0x101e2744
mov dword [0x101e271c], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e271c]
test byte [eax + edi], 0x40
jne 0x1007c50b
mov eax, dword [0x101e29cc]
mov edi, dword [0x101e0948]
cmp eax, dword [esi + 4]
jle 0x1007c420
push 0x101e29cc
call fcn.100b5535
add esp, 4
cmp dword [0x101e29cc], 0xffffffff
jne 0x1007c420
mov eax, dword [0x101e287c]
push 0x101e29cc
mov dword [0x101e29b8], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e29b8]
cmp byte [eax + edi], 0
jne 0x1007c50b
mov ecx, dword [0x101e0950]
test ecx, ecx
je 0x1007c50b
mov eax, dword [0x101e2740]
mov edi, dword [0x101e0948]
cmp eax, dword [esi + 4]
jle 0x1007c483
push 0x101e2740
call fcn.100b5535
add esp, 4
cmp dword [0x101e2740], 0xffffffff
jne 0x1007c47d
mov eax, dword [0x101e2730]
push 0x101e2740
mov dword [0x101e2710], eax
call fcn.100b54eb
add esp, 4
mov ecx, dword [0x101e0950]
mov eax, dword [0x101e2710]
cmp byte [eax + edi], 0
je 0x1007c498
movss xmm0, dword [ecx + 0x130]
jmp 0x1007c4a0
movss xmm0, dword [ecx + 0x12c]
movss dword [ebx], xmm0
cmp byte [0x101dd651], 0
je 0x1007c501
mov eax, dword [0x101e2744]
mov edi, dword [0x101e0948]
cmp eax, dword [esi + 4]
jle 0x1007c4ed
push 0x101e2744
call fcn.100b5535
add esp, 4
cmp dword [0x101e2744], 0xffffffff
jne 0x1007c4ed
mov eax, dword [0x101e2734]
push 0x101e2744
mov dword [0x101e271c], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e271c]
test byte [eax + edi], 1
jne 0x1007c501
mov eax, dword [0x101e07bc]
and dword [eax + 0x30], 0xfffffffd
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.1007b7f0
pop edi
pop esi
pop ebx
ret
Function at 0x1007cb90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], 0x43800000
mov dword [ebp - 8], 0x42000000
call fcn.1002d710
add esp, 8
test al, al
je 0x1007cc02
test byte [ebp + 0x10], 1
jne 0x1007cc02
push 4
call fcn.100b560b
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [eax], ecx
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push 0x1007cc30
push 0
push 0
call fcn.1011c993
add esp, 0x18
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1007cc15
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x1007cc08
push ecx
push eax
call fcn.100b2b83
add esp, 8
test eax, eax
jne 0x1007cc0f
mov esp, ebp
pop ebp
ret 0xc
push 1
call fcn.100b2d75
push eax
call fcn.100b2d48
push 6
mov dword [ebp - 8], 0
call fcn.100b2d75
int3
Function at 0x1008f7b0
Capabilities:
Get number of processors
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x101733b8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x8c]
push eax
call fcn.10094760
mov ecx, dword [0x101e14f0]
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x48], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [ebp - 0x38], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [eax + 0x30]
mov eax, dword fs:[0x2c]
movups xmmword [ebp - 0x18], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101e26ec]
cmp eax, dword [ecx + 4]
jle 0x1008f83a
push 0x101e26ec
call fcn.100b5535
add esp, 4
cmp dword [0x101e26ec], 0xffffffff
jne 0x1008f83a
mov eax, dword [0x101e2700]
push 0x101e26ec
mov dword [0x101e26f0], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e26f0]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [eax + ecx]
mov eax, dword [0x101dffb4]
inc eax
cmp eax, 3
ja case.default.0x1008f851
jmp dword [eax*4 + 0x1008f8a0]
push dword [0x101dffb0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1008f872
push dword [0x101dffb0]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
test al, al
je case.default.0x1008f851
mov eax, dword [ebp - 0x3c]
jmp 0x1008f884
mov eax, dword [ebp - 0x40]
cmp eax, 0x64
jl 0x1008f88e
add eax, 0xffffff9c
add eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100b5418
mov esp, ebp
pop ebp
ret 4