joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e33c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41e36a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41e388
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041e2a2
jmp 0x41e388
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41e388
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041e2a2
test edi, edi
mov eax, edi
jne 0x41e372
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x300063f9
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [section..cdata]
push edi
mov dword [ebp + 0x2a4], eax
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], 0xc0000409
lea eax, [ebp + 0x2ac]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp - 0x28], 0x10001
mov eax, dword [eax]
mov dword [ebp + 0x90], eax
lea eax, [ebp + 0x2ac]
mov dword [ebp + 0x9c], eax
push ss
pop dword [ebp + 0xa0]
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.300063f9
pop edi
add ebp, 0x2a8
leave
ret
cmp ecx, dword [section..cdata]
jne 0x300062d1
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x59184eb7
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x23b41714
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000d786
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
movaps xmm0, xmmword [0x10184da0]
lea eax, [ebp - 0x23c]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x248], 0x3f800000
mov edi, 0xa8
mov dword [ebp - 0x278], ebx
push edi
movups xmmword [ebp - 0x268], xmm0
push ebx
movaps xmm0, xmmword [0x10184dc0]
push eax
mov byte [ebp - 0x274], bl
mov dword [ebp - 0x270], ebx
mov byte [ebp - 0x26c], bl
movups xmmword [ebp - 0x258], xmm0
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
call fcn.100d26e0
add esp, 0xc
lea ecx, [ebp - 0x23c]
call fcn.1000da54
movaps xmm0, xmmword [0x10184da0]
lea eax, [ebp - 0x158]
push 0x70
movups xmmword [ebp - 0x184], xmm0
push ebx
movaps xmm0, xmmword [0x10184dc0]
push eax
mov dword [ebp - 0x194], ebx
mov byte [ebp - 0x190], bl
mov dword [ebp - 0x18c], ebx
mov byte [ebp - 0x188], bl
movups xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x164], 0x3f800000
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
call fcn.100d26e0
add esp, 0xc
mov eax, ebx
push 0xe
pop esi
mov dword [ebp + eax*8 - 0x158], ebx
mov dword [ebp + eax*8 - 0x154], ebx
inc eax
cmp eax, esi
jb 0x1000d860
push edi
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xe8], ebx
push ebx
push eax
call fcn.100d26e0
add esp, 0xc
lea eax, [ebp - 0xe0]
mov byte [eax - 4], bl
mov dword [eax], ebx
lea eax, [eax + 0xc]
mov byte [eax - 8], bl
sub esi, 1
jne 0x1000d890
xor eax, eax
mov dword [ebp - 0x3c], ebx
inc eax
mov byte [ebp - 0x38], bl
mov dword [ebp - 0x24], eax
lea esi, [ebp - 0x278]
mov dword [ebp - 0x14], eax
mov ecx, 0x9e
mov edi, 0x10192238
mov dword [ebp - 0x34], 0x3fa66666
mov byte [ebp - 0x30], bl
mov dword [ebp - 0x2c], 0x428c0000
mov byte [ebp - 0x28], bl
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], 0x3f800000
mov word [ebp - 0x18], bx
mov byte [ebp - 0x16], bl
mov word [ebp - 0x10], bx
mov byte [ebp - 0xe], bl
mov dword [ebp - 0xc], ebx
mov byte [ebp - 8], bl
mov dword [ebp - 4], 0x3fa00000
rep movsd dword es:[edi], dword [esi]
xor cl, cl
call fcn.10015228
xor edx, edx
call fcn.100585b8
call fcn.1005852a
push ebx
push ebx
push ebx
push 0x1000d93f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f15d
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x101019c5
call fcn.100ff2c0
sub esp, 0x44c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
push str._error_:__Unable_to_connect_to_server_
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], edi
mov esi, edx
xor ebx, ebx
call fcn.1000e1ae
push ebx
push ebx
push ebx
push 1
push str.Check_1.0
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000f1e6
sub esp, 0x28
lea edx, [ebp - 0x48]
mov eax, esp
lea ecx, [ebp - 0x30]
push ebx
push 1
mov dword [eax + 0x24], ebx
call fcn.1000f35c
add esp, 0x30
mov ecx, edi
push eax
call fcn.1000e4f2
mov byte [edi + 0x10], 1
mov byte [ebp - 4], 1
push dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
call fcn.1000e7f7
lea ecx, [ebp - 0x48]
call fcn.1000e743
mov eax, edi
jmp 0x1000f34d
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
push esi
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x1000f228
sub esp, 0x28
lea edx, [ebp - 0x48]
mov eax, esp
lea ecx, [ebp - 0x30]
push ebx
push 1
mov dword [eax + 0x24], ebx
call fcn.1000f35c
add esp, 0x30
mov ecx, edi
push eax
call fcn.1000e4f2
mov byte [edi + 0x10], 1
mov byte [ebp - 4], 2
jmp 0x1000f1cc
push ebx
push 0x80000000
push ebx
push ebx
push ebx
push dword [ebp + 8]
push 0x10181f20
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push ebx
push ebx
push 0x35
mov esi, eax
push str.Content_Type:_application_json_r_nUser_Agent:_Check_1.0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
lea eax, [ebp - 0x48]
jne 0x1000f26a
push eax
mov ecx, edi
call fcn.10013f50
mov byte [edi + 0x10], 1
jmp 0x1000f1d7
cmp dword [ebp - 0x34], 0x10
push 0x400
cmovae eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], ebx
push ebx
mov byte [eax], bl
lea eax, [ebp - 0x450]
push eax
call fcn.100d26e0
add esp, 0xc
mov dword [ebp - 0x18], ebx
jmp 0x1000f2a9
cmp dword [ebp - 0x18], 0
je 0x1000f2c4
push dword [ebp - 0x18]
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x48]
call fcn.10015198
lea eax, [ebp - 0x18]
push eax
push 0x3ff
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1000f291
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x4c]
call esi
push dword [ebp - 0x14]
call esi
sub esp, 0x28
mov byte [ebp - 4], 5
mov eax, esp
lea edx, [ebp - 0x48]
lea ecx, [ebp - 0x30]
push ebx
push 1
mov dword [eax + 0x24], ebx
call fcn.1000f35c
add esp, 0x30
mov ecx, edi
push eax
call fcn.1000e4f2
mov byte [edi + 0x10], bl
mov byte [ebp - 4], 6
jmp 0x1000f1cc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x100114c8
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
mov eax, 0x10101dcf
call fcn.100ff2c0
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], ecx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], ecx
mov byte [ebp - 4], 3
lea eax, [ebp + 0x10]
mov dword [edi + 0x30], ecx
mov byte [edi + 0x34], cl
lea ecx, [edi + 0x38]
push eax
call fcn.1001509c
mov byte [ebp - 4], 4
lea ecx, [edi + 0x70]
mov al, byte [ebp + 0xc]
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.1000dcab
lea eax, [ebp + 0xf]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 0x10]
mov byte [ebp + 0xf], 1
call fcn.10013558
lea ecx, [ebp + 0x10]
call fcn.100151f2
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 0x30

Function at 0x1001d8c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
test esi, esi
jg 0x1001d8e8
jl 0x1001d8df
test ebx, ebx
jne 0x1001d8e8
xor eax, eax
xor edx, edx
jmp 0x1001d9a8
cmp dword [ecx + 0x38], 0
je 0x1001d8fd
push esi
push ebx
push dword [ebp + 8]
call fcn.100230ab
jmp 0x1001d9a8
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov edx, dword [eax]
test edx, edx
je 0x1001d93c
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x1001d93c
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push edx
push dword [ebp + 8]
call fcn.100d2160
mov ecx, dword [ebp - 4]
sub edi, esi
add dword [ebp + 8], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
jmp 0x1001d942
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
cmp dword [ecx + 0x4c], 0
je 0x1001d99e
call fcn.1001e773
mov edx, dword [ebp + 8]
mov eax, edi
cmp edi, 0xfff
jbe 0x1001d989
push dword [ecx + 0x4c]
push 0xfff
push 1
push edx
call fcn.100dd3a1
mov edx, dword [ebp + 8]
mov ecx, 0xfff
add edx, eax
add esp, 0x10
sub edi, eax
mov dword [ebp + 8], edx
cmp eax, ecx
jne 0x1001d99e
cmp edi, ecx
mov ecx, dword [ebp - 4]
ja 0x1001d95a
mov eax, edi
test eax, eax
je 0x1001d99e
push dword [ecx + 0x4c]
push edi
push 1
push edx
call fcn.100dd3a1
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10028266
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
call fcn.1005831d
xor esi, esi
cmp dword [0x10192170], esi
jne 0x10028284
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10192170], eax
xor eax, eax
mov ecx, 0x1019216c
xchg dword [ecx], eax
call fcn.100284c4
push 0x10192688
mov edx, 0x10028365
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x44]
call fcn.100583d9
call fcn.100284c4
push 0x1019268c
mov edx, 0x100283e4
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x40]
call fcn.100583d9
mov ecx, dword [0x10192138]
mov edx, 0x10028426
push 0x10192690
lea ecx, [ecx + 0x1ad80]
call fcn.100583d9
mov ecx, dword [0x10192138]
mov edx, 0x10028479
push 0x10192694
add ecx, 0xa08c0
call fcn.100583d9
xor edx, edx
inc edx
call fcn.100585b8
push 0x40
push 0x3000
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
push ecx
mov ecx, esi
call fcn.10057260
mov edx, esi
call fcn.100571a0
mov dword [esp], 0x100283f4
push 0xfffffffffffffffc
push dword [0xc97c1c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [0x10192698], eax
pop esi
ret

Function at 0x100284c4
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x13c
push esi
mov esi, 0x104
lea eax, [ebp - 0x138]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 8], 0x6272fac3
mov edx, 0x52b3027f
mov dword [ebp - 4], 0x5ceb969f
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0x10a30b5c
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0x6419e9f
mov dword [ebp - 4], 0x308fb8a6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], 0x10a30b30
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 4]
movaps xmm1, xmmword [ebp - 0x20]
push eax
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x138]
xorps xmm1, xmmword [ebp - 0x30]
push esi
push eax
movaps xmmword [ebp - 0x20], xmm1
call fcn.100ddc42
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
lea ecx, [edx + 0x128000]
cmp edx, ecx
jae 0x100285b7
mov ecx, 0x8689
inc edx
mov eax, 0x6c7
cmp word [edx], ax
jne 0x100285ad
cmp word [edx + 6], cx
jne 0x100285ad
cmp word [edx + 0xc], cx
je 0x100285c2
lea eax, [edx + 0x128000]
cmp edx, eax
jb 0x10028596
inc edx
mov eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
add edx, 2
jmp 0x100285b8

Function at 0x10029086
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
mov edx, dword [ebp + 8]
push edi
mov edi, ecx
not edx
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017dd90]
inc edi
sub esi, 1
jne 0x10029094
pop edi
not edx
pop esi
mov eax, edx
pop ebp
ret
Function at 0x100290b4
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov edx, ebx
test edi, edi
je 0x10029118
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x100290e0
cmp edi, 2
jb 0x100290e0
cmp byte [esi], al
jne 0x100290e0
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017dd90]
test edi, edi
jne 0x100290c9
jmp 0x1002911f
cmp al, 0x23
jne 0x10029106
cmp byte [esi], al
jne 0x10029106
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017dd90]
mov al, byte [esi]
inc esi
test al, al
jne 0x100290f8
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x1002924c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002925c
and dword [edi], 0
mov edx, 0x10184684
call fcn.10029128
mov esi, eax
test esi, esi
je 0x100292c2
mov ecx, esi
call fcn.100291f3
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100292bb
mov ecx, ebx
call fcn.1002b54d
mov dword [ebp + 8], eax
test eax, eax
je 0x100292bb
push esi
push ebx
push 1
push eax
call fcn.100dd3a1
add esp, 0x10
push esi
cmp eax, ebx
je 0x100292aa
call fcn.100ddb63
pop ecx
mov ecx, dword [ebp + 8]
call fcn.1002b564
jmp 0x100292c2
call fcn.100ddb63
pop ecx
test edi, edi
je 0x100292b6
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x100292c4
push esi
call fcn.100ddb63
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1003a688
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101018fc
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x30]
test edi, edi
je 0x1003a6b9
mov ecx, edi
call fcn.1003a989
mov ecx, edi
call fcn.1002b564
mov edi, dword [esi + 0x34]
test edi, edi
je 0x1003a6ce
mov ecx, edi
call fcn.1003a989
mov ecx, edi
call fcn.1002b564
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push 0x10039900
push 2
push 0xc
push eax
call fcn.100d05c7
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x1003ea8a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1003eaa4
mov dword [esi + 4], edi
mov dword [esi], edi
call fcn.1002b564
mov dword [esi + 8], edi
lea ecx, [esi + 0xc]
call fcn.10039c24
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1003eac1
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
call fcn.1002b564
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1003eae2
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
call fcn.1002b564
mov dword [esi + 0x44], edi
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1003eaf7
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
call fcn.1002b564
mov dword [esi + 0x50], edi
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1003eb0c
mov dword [esi + 0x58], edi
mov dword [esi + 0x54], edi
call fcn.1002b564
mov dword [esi + 0x5c], edi
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10042008
Function at 0x100472ba
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x10192160]
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
lea edi, [eax + 8]
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x1000
call fcn.10028c67
push 0x10
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x2000
call fcn.10028c67
push 0x12
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x4000
call fcn.10028c67
push 0x5d
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x8000
call fcn.10028c67
pop edi
pop esi
ret
Function at 0x10052145
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1005217e
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x10052162
push edi
push 0x42
pop ecx
mov edi, 0x10192008
rep movsd dword es:[edi], dword [esi]
pop edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x1000d4a0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x10056cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push 0x40
push 1
push esi
mov edi, ecx
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x20], esi
call ebx
test eax, eax
setne byte [ebp - 0x14]
mov cl, byte [esi]
mov byte [ebp - 5], cl
test eax, eax
je 0x10056d3e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x20]
call ebx
mov cl, byte [ebp - 5]
movzx eax, cl
sub eax, 0xe8
je 0x10056dfc
sub eax, 1
je 0x10056dfc
sub eax, 0x16
jne 0x10056ded
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push 0x40
inc esi
mov dword [ebp - 0x1c], 1
push 1
push esi
mov dword [ebp - 0x20], esi
call ebx
test eax, eax
setne byte [ebp - 0x14]
mov cl, byte [esi]
mov byte [ebp - 5], cl
test eax, eax
je 0x10056d9c
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x20]
call ebx
mov cl, byte [ebp - 5]
cmp cl, 0x15
je 0x10056da6
cmp cl, 0x25
jne 0x10056ded
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x1c], 4
push 4
push esi
mov dword [ebp - 0x20], esi
call ebx
test eax, eax
setne byte [ebp - 0x14]
mov esi, dword [esi]
test eax, eax
je 0x10056de0
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x20]
call ebx
mov eax, dword [esi]
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
push 0x40
inc esi
mov dword [ebp - 0x1c], 4
push 4
push esi
mov dword [ebp - 0x20], esi
call ebx
test eax, eax
setne byte [ebp - 0x14]
mov ecx, dword [esi]
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x10056e3a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x20]
call ebx
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 4]
add eax, ecx
mov dword [edi], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10057120
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, edx
call fcn.10057a30
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.10057410
mov dword [ebp - 0x1c], 0
mov esi, dword [eax]
test edi, edi
jne 0x10057151
mov byte [ebp - 0x10], 0
jmp 0x1005716b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push 0x40
push edi
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0x10]
push edi
push 0x90
push esi
call fcn.100d26e0
add esp, 0xc
cmp byte [ebp - 0x10], 0
je 0x10057197
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100571a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov ecx, 0x4c03e7
mov edi, edx
call fcn.10057a30
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.10057410
push ecx
lea ecx, [ebp - 8]
mov esi, dword [eax]
mov eax, esp
mov dword [eax], esi
call fcn.10056cf0
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
add esp, 4
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], esi
push eax
push 0x40
push 1
push esi
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov byte [esi], 0xe8
cmp byte [ebp - 0x10], 0
je 0x10057213
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], 4
push eax
push 0x40
inc esi
push 4
sub edi, esi
mov dword [ebp - 0x1c], esi
push esi
sub edi, 4
call ebx
test eax, eax
setne byte [ebp - 0x10]
mov dword [esi], edi
cmp byte [ebp - 0x10], 0
je 0x1005724f
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 0x1c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret