joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015690
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
cmp dword [edx + 0x14], 0x10
mov esi, edx
push edi
mov edi, dword [edx + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
jb 0x100156bc
mov esi, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test edi, edi
je 0x100156d8
movzx eax, byte [ecx + esi]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x100156c7
mov ecx, dword [0x100e89c8]
mov esi, ebx
and esi, dword [0x100e89c4]
xor edx, edx
mov eax, esi
xor edi, edi
shl eax, 5
cmp dx, word [eax + ecx]
mov edx, dword [ebp - 8]
jg 0x1001572e
nop dword [eax + eax]
add ecx, 4
add ecx, eax
call fcn.100161e0
test al, al
jne 0x10015794
mov ecx, dword [0x100e89c8]
inc esi
and esi, dword [0x100e89c4]
inc edi
mov edx, dword [ebp - 8]
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x10015700
call fcn.10015b90
mov ecx, dword [0x100e89c8]
test al, al
je 0x10015765
mov edx, dword [0x100e89c4]
xor edi, edi
mov esi, edx
and esi, ebx
xor ebx, ebx
mov eax, esi
shl eax, 5
cmp bx, word [eax + ecx]
jg 0x10015765
inc esi
inc edi
and esi, edx
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x10015756
mov eax, dword [ebp + 0x14]
mov ebx, esi
shl ebx, 5
add ecx, ebx
mov dword [ebp - 8], ecx
mov eax, dword [eax]
push eax
cmp word [ecx], 0xffff
jne 0x100157b9
lea esi, [ecx + 4]
mov ecx, esi
call fcn.1000f4e0
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], 0
mov word [eax], di
jmp 0x1001580a
mov eax, dword [ebp - 0xc]
shl esi, 5
add esi, dword [0x100e89c8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0x14
lea ecx, [ebp - 0x28]
call fcn.1000f4e0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], 0
push eax
push ecx
push edi
push esi
call fcn.10015e90
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1001580a
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015800
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10015800
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007be73
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x100e89c8]
inc dword [0x100e89d8]
add eax, ebx
pop edi
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10016030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [edx + 0x10]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
jb 0x10016062
mov esi, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test edi, edi
je 0x10016081
nop dword [eax]
movzx eax, byte [ecx + esi]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x10016070
mov esi, dword [0x100e89c4]
xor edx, edx
mov ecx, dword [0x100e89c8]
and esi, ebx
mov eax, esi
xor edi, edi
shl eax, 5
cmp dx, word [eax + ecx]
mov edx, dword [ebp - 0xc]
jg 0x100160cf
add ecx, 4
add ecx, eax
call fcn.100161e0
test al, al
jne 0x10016136
mov ecx, dword [0x100e89c8]
inc esi
and esi, dword [0x100e89c4]
inc edi
mov edx, dword [ebp - 0xc]
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x100160a1
call fcn.10015b90
mov ecx, dword [0x100e89c8]
test al, al
je 0x10016106
mov edx, dword [0x100e89c4]
xor edi, edi
mov esi, edx
and esi, ebx
xor ebx, ebx
mov eax, esi
shl eax, 5
cmp bx, word [eax + ecx]
jg 0x10016106
inc esi
inc edi
and esi, edx
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x100160f7
push dword [ebp - 8]
mov ebx, esi
shl ebx, 5
cmp word [ebx + ecx], 0xffff
lea eax, [ebx + ecx]
mov dword [ebp - 0xc], eax
jne 0x1001615b
lea esi, [eax + 4]
mov ecx, esi
call fcn.1000f4e0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0xc]
mov word [eax], di
jmp 0x100161ae
mov eax, dword [ebp - 0x10]
shl esi, 5
add esi, dword [0x100e89c8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [ebp - 0x2c]
call fcn.1000f4e0
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
push ecx
push edi
push esi
call fcn.10015e90
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x100161ae
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100161a4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100161a4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007be73
add esp, 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x100e89c8]
inc dword [0x100e89d8]
add eax, ebx
pop edi
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100179e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
cmp dword [edx + 0x14], 0x10
mov esi, edx
push edi
mov edi, dword [edx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jb 0x10017a0c
mov esi, dword [edx]
xor ecx, ecx
mov ebx, 0x811c9dc5
test edi, edi
je 0x10017a28
movzx eax, byte [ecx + esi]
inc ecx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp ecx, edi
jb 0x10017a17
mov ecx, dword [0x100e89c8]
mov esi, ebx
and esi, dword [0x100e89c4]
xor edx, edx
mov eax, esi
xor edi, edi
shl eax, 5
cmp dx, word [ecx + eax]
mov edx, dword [ebp - 0xc]
jg 0x10017a7e
nop dword [eax + eax]
add ecx, 4
add ecx, eax
call fcn.100161e0
test al, al
jne 0x10017b13
mov ecx, dword [0x100e89c8]
inc esi
and esi, dword [0x100e89c4]
inc edi
mov edx, dword [ebp - 0xc]
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x10017a50
call fcn.10015b90
mov ecx, dword [0x100e89c8]
test al, al
je 0x10017ab5
mov edx, dword [0x100e89c4]
xor edi, edi
mov esi, edx
and esi, ebx
xor ebx, ebx
mov eax, esi
shl eax, 5
cmp bx, word [eax + ecx]
jg 0x10017ab5
inc esi
inc edi
and esi, edx
mov eax, esi
shl eax, 5
cmp di, word [eax + ecx]
jle 0x10017aa6
mov eax, dword [ebp + 0x14]
mov ebx, esi
shl ebx, 5
mov eax, dword [eax]
cmp word [ebx + ecx], 0xffff
jne 0x10017b38
mov dword [ebx + ecx + 4], 0
mov dword [ebx + ecx + 0x14], 0
mov dword [ebx + ecx + 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebx + ecx + 4], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebx + ecx + 0x14], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov dword [ebx + ecx + 0x1c], 0
mov word [ebx + ecx], di
jmp 0x10017ba3
mov eax, dword [ebp - 0x10]
shl esi, 5
add esi, dword [0x100e89c8]
mov dword [eax], esi
mov byte [eax + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0x14
movups xmm0, xmmword [eax]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x2c]
push eax
push ecx
push edi
push esi
movq qword [ebp - 0x1c], xmm0
call fcn.10015e90
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x10017ba3
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10017b99
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10017b99
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007be73
add esp, 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [0x100e89c8]
inc dword [0x100e89d8]
add eax, ebx
pop edi
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 8]
pop esi
xor ecx, ebp
pop ebx
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1002c690
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fd40
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
movaps xmm0, xmmword [str.9iKOWM]
mov ecx, edi
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
movd eax, xmm0
mov dword [ebp - 0x34], 0x18
movups xmmword [ebp - 0x30], xmm0
push eax
mov dword [ebp - 0x20], 0x525a585b
mov dword [ebp - 0x1c], 0x5a584b4d
mov byte [ebp - 0x18], 0x52
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x2f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1002c705
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x10034c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x47467233
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x5c47405c
mov byte [ebp - 0x18], 0x43
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x10034c88
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x100375e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x51505536
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x5e695969
mov byte [ebp - 0x18], 0x55
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x10037648
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4
Function at 0x1003a370
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x5660493f
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x51604860
mov byte [ebp - 0x18], 0x52
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003a3d8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x5b634a3c
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x53506350
mov byte [ebp - 0x18], 0x5f
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003b6e8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x1003d7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x5b416c28
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x4b46495c
mov byte [ebp - 0x18], 0x4d
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003d848
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4
Function at 0x1003dbb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x556c5e33
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x406c455c
mov byte [ebp - 0x18], 0x50
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003dc18
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x1003fdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x5c496e3d
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x5c4f4949
mov byte [ebp - 0x18], 0x56
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003fe28
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4

Function at 0x1003ff10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fc50
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x20], 0x2b6f2e0b
mov ecx, edi
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x1c], 0x67676260
mov byte [ebp - 0x18], 0x78
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov dword [edi], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0xf
call fcn.10010880
lea esi, [ebp - 0x1f]
movzx ecx, byte [esi]
push ecx
mov ecx, edi
call fcn.10010880
inc esi
lea eax, [ebp - 0x16]
cmp esi, eax
jne 0x1003ff78
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4
Function at 0x100402e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x10098010]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.10027440
cmp byte [esi + 0x210], 0
je 0x10040510
push 0xff
lea ebx, [esi + 4]
lea eax, [esi + 0x104]
push ebx
push eax
call sub.VCRUNTIME140.dll_memmove
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 0xc
xor esi, esi
nop
push esi
call edi
test ax, ax
setne al
mov byte [ebx + esi], al
inc esi
cmp esi, 0xff
jl 0x10040330
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1004041c
lea eax, [esp + 0x14]
push eax
push dword [0x100e8904]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 1
call edi
test ax, ax
je 0x10040381
cmp byte [0x100e9046], 0
jne 0x1004041c
jmp 0x10040388
mov byte [0x100e9046], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 1
mov dword [0x100e902c], eax
mov dword [0x100e9030], ecx
call edi
test ax, ax
je 0x100403d2
cmp byte [0x100e9044], 0
jne 0x100403d2
cmp byte [0x100e9045], 0
jne 0x100403d2
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov byte [0x100e9044], 1
mov dword [0x100e9034], eax
mov dword [0x100e9038], ecx
jmp 0x1004041c
push 1
call edi
test ax, ax
je 0x100403ef
cmp byte [0x100e9045], 0
jne 0x100403ef
mov word [0x100e9044], 0x100
jmp 0x10040409
push 1
call edi
test ax, ax
jne 0x10040400
mov word [0x100e9044], ax
jmp 0x1004041c
cmp byte [0x100e9045], 0
je 0x1004041c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [0x100e9040], ecx
mov dword [0x100e903c], eax
call fcn.10040840
cmp dword [eax + 0xc], 0
je 0x100404ee
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x100404ee
cvttsd2si eax, qword [0x100eb210]
cmp eax, dword [0x100e3d60]
je 0x100404ee
lea ebx, [eax + eax*2]
mov dword [0x100e3d60], eax
shl ebx, 4
xor esi, esi
add ebx, ecx
xor edi, edi
mov byte [ebx + 0x28], 1
mov eax, dword [0x100e9020]
mov ecx, dword [0x100e9024]
cmp eax, ecx
je 0x1004047d
mov edx, dword [ebx + 8]
cmp dword [eax], edx
je 0x1004047d
add eax, 0x1c
inc esi
cmp eax, ecx
jne 0x10040471
call fcn.100409c0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
cmp ecx, eax
je 0x1004049c
mov edx, dword [ebx + 0xc]
nop
cmp dword [ecx], edx
je 0x1004049c
add ecx, 0x1c
inc edi
cmp ecx, eax
jne 0x10040490
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movsd qword [0x100eb1e8], xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movsd qword [0x100eb1f0], xmm0
movd xmm0, dword [ebx + 0x18]
cvtdq2pd xmm0, xmm0
movsd qword [0x100eb208], xmm0
movd xmm0, dword [ebx + 0x10]
cvtdq2pd xmm0, xmm0
movsd qword [0x100eb200], xmm0
movss xmm0, dword [ebx + 0x14]
cvtps2pd xmm0, xmm0
movsd qword [0x100eb1f8], xmm0
mov esi, dword [esp + 0x10]
mov edi, dword [esi + 0x208]
mov esi, dword [esi + 0x204]
cmp esi, edi
je 0x10040510
mov ecx, dword [esi]
call fcn.100263c0
add esi, 4
cmp esi, edi
jne 0x10040502
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x10040620
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fdb5
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x54], esi
push 0x2d
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
mov byte [ebp - 0x41], al
cmp byte [0x100f15cc], al
je 0x100407e7
test al, al
je 0x10040680
cmp byte [esi + 0x210], 0
sete al
mov byte [esi + 0x210], al
movaps xmm0, xmmword [str.:YVeWUOI__T_XV_]
mov edi, 0xf
mov dword [ebp - 0x40], edi
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x3b]
xor edx, edx
sub edi, esi
lea ecx, [edx + esi]
mov esi, 0xf
sub esi, edx
mov dl, byte [ebp - 0x3c]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x100406b8
mov eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x40]
mov esi, esp
mov edi, 0xf
xor edx, edx
mov byte [esi + edi], 0
cmp byte [eax + 0x210], dl
sete dl
call fcn.1000b150
mov edx, eax
mov ecx, esi
mov dword [ebp - 4], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100406f7
sub ecx, edi
push ecx
push esi
push ecx
mov ecx, edx
call fcn.10015090
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x1004077b
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10040771
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10040771
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007be73
add esp, 8
mov ecx, dword [0x100e8994]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov eax, dword [ecx]
mov edx, dword [eax + 0x1b0]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edx
mov al, byte [ebp - 0x41]
mov edx, dword [ebp - 0x14]
mov byte [0x100f15cc], al
cmp edx, 0x10
jb 0x100407e7
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100407dd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100407dd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1007be73
add esp, 8
lea esp, [ebp - 0x60]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret

Function at 0x10040bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10040bef
push 0
push 0
push dword [ebp + 8]
push 0x10040bb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc