joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100890c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [0x10163478]
mov ebx, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test esi, esi
jne 0x100890f5
push 0xdda
push str.D:KanyeHook_main_srcTeamFortress2TeamFortress2FeaturesMenuImGuiimgui.cpp
push str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call edi
mov esi, dword [0x10163478]
add esp, 0xc
cmp dword [esi + 0xc4], 0
je 0x1008910f
push 0x68
push str.D:KanyeHook_main_srcTeamFortress2TeamFortress2FeaturesMenuImGuiimgui_impl_win32.cpp
push str.io.BackendPlatformUserData__0___Already_initialized_a_platform_backend__
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x100892b7
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100892b7
mov eax, dword [0x10163478]
test eax, eax
je 0x10089142
inc dword [eax + 0x36c]
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x10089162
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10089164
xor edi, edi
or dword [esi + 0xc], 6
mov dword [esi + 0xc4], edi
mov dword [esi + 0xbc], str.imgui_impl_win32
mov dword [edi], ebx
mov byte [edi + 0x25], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
mov dword [esi + 0xe0], ebx
mov dword [esi + 0x34], 9
mov dword [esi + 0x38], 0x25
mov dword [esi + 0x3c], 0x27
mov dword [esi + 0x40], 0x26
mov dword [esi + 0x44], 0x28
mov dword [esi + 0x48], 0x21
mov dword [esi + 0x4c], 0x22
mov dword [esi + 0x50], 0x24
mov dword [esi + 0x54], 0x23
mov dword [esi + 0x58], 0x2d
mov dword [esi + 0x5c], 0x2e
mov dword [esi + 0x60], 8
mov dword [esi + 0x64], 0x20
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], 0x1b
mov dword [esi + 0x70], 0xd
mov dword [esi + 0x74], 0x41
mov dword [esi + 0x78], 0x43
mov dword [esi + 0x7c], 0x56
mov dword [esi + 0x80], 0x58
mov dword [esi + 0x84], 0x59
mov dword [esi + 0x88], 0x5a
xor esi, esi
mov dword [ebp - 0x2c], str.xinput1_4.dll
mov dword [ebp - 0x28], str.xinput1_3.dll
mov dword [ebp - 0x24], str.xinput9_1_0.dll
mov dword [ebp - 0x20], str.xinput1_2.dll
mov dword [ebp - 0x1c], str.xinput1_1.dll
nop dword [eax + eax]
push dword [ebp + esi*4 - 0x2c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1008928f
inc esi
cmp esi, 5
jl 0x10089270
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x28], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10091190
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [0x10163478]
push ebx
push esi
mov ebx, ecx
mov esi, dword [eax + 0x1f64]
push edi
cmp ebx, 0xffffffff
jne 0x100911ac
cmp dword [esi + 0x5c], ecx
cmovne ebx, dword [esi + 0x5c]
mov eax, dword [esi + 0x54]
cmp ebx, eax
jne 0x100911b8
or ebx, 0xffffffff
jmp 0x100911bd
cmp ebx, 0xffffffff
jl 0x100911c1
cmp ebx, eax
jl 0x100911d9
push 0xbc1
push str.D:KanyeHook_main_srcTeamFortress2TeamFortress2FeaturesMenuImGuiimgui_tables.cpp
push str.column_n____1__column_n___table__ColumnsCount
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
test byte [esi + 4], 7
je 0x10091234
mov ax, word [esi + 0x60]
mov edi, dword [esi]
mov word [esi + 0x62], ax
not edi
mov byte [esi + 0x1be], 1
mov ecx, edi
mov byte [esi + 0x1b0], bl
mov al, 0x23
mov esi, 0x10145ee5
cmp al, 0x23
jne 0x1009120f
cmp byte [esi], al
jne 0x1009120f
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x10105790]
test al, al
jne 0x10091201
not ecx
xor edx, edx
pop edi
pop esi
pop ebx
jmp fcn.10070940
pop edi
pop esi
pop ebx
ret
Function at 0x100b74e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100da5b1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x24
mov edx, dword [eax + edx*4]
mov eax, dword [0x101d140c]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x100b7643
push 0x101d140c
call fcn.100d50bc
add esp, 4
cmp dword [0x101d140c], 0xffffffff
jne 0x100b7643
mov dword [ebp - 4], 0
mov ecx, 8
vmovdqa xmm0, xmmword [str.s_In_PAWPBZdEOI]
vmovdqu ymm1, ymmword [0x1014fce0]
vmovdqu ymm2, ymmword [0x1014fc40]
vmovdqu ymm3, ymmword [0x10150520]
vmovdqu xmmword [ebp - 0x30], xmm0
vmovq xmm0, xmm0
vpmovsxbd ymm0, xmm0
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm2
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm3
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x20], 1
vmovq qword [ebp - 0x30], xmm0
nop dword [eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x30], al
inc ecx
cmp ecx, 0xf
jb 0x100b75b0
mov dword [ebp - 0x1f], 0x637f4b5a
mov eax, 8
mov dword [ebp - 0x1b], 0x75415043
vpmovsxbd ymm0, qword [ebp - 0x1f]
vpxor ymm0, ymm0, ymm1
vpshufb ymm0, ymm0, ymm2
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymm3
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0x20], 0
mov dword [ebp - 0x17], 0x4c51464a
mov word [ebp - 0x13], 0x58
mov byte [ebp - 0x11], 1
vmovq qword [ebp - 0x1f], xmm0
nop word [eax + eax]
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xd
jb 0x100b7610
lea eax, [ebp - 0x30]
mov byte [ebp - 0x11], 0
push eax
lea eax, [ebp - 0x1f]
push eax
vzeroupper
call fcn.1000f3e0
push 0x101d140c
mov dword [0x101d1414], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101d1414]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100b7660
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
cmp dword [0x101d1404], 0
jne 0x100b776f
mov dword [ebp - 0x44], 0xd7a0d4a
mov ecx, 8
mov dword [ebp - 0x40], 0xd4c0d41
mov dword [ebp - 0x3c], 0xd650d02
mov dword [ebp - 0x38], 0xd570d4b
vpmovzxwd ymm1, xmmword [ebp - 0x44]
vpxor ymm0, ymm1, ymmword [0x1014fda0]
vpshufb ymm0, ymm0, ymmword [0x10150540]
vpermq ymm0, ymm0, 0xd8
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x34], 0xd550d52
mov dword [ebp - 0x30], 0xd5a0d4d
mov dword [ebp - 0x2c], 0xd0b0d59
mov dword [ebp - 0x28], 0xd1e
mov byte [ebp - 0x24], 1
vmovdqu xmmword [ebp - 0x44], xmm0
nop dword [eax]
lea eax, [ecx + 0xd1e]
xor word [ebp + ecx*2 - 0x44], ax
inc ecx
cmp ecx, 0xf
jb 0x100b76e0
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x19], 0x454e7658
mov dword [ebp - 0x15], 0x414a4a75
mov dword [ebp - 0x11], 0x7f5049
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x100b7710
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [ebp - 0xc], 0x73654c4b
mov dword [ebp - 8], 0x410a1111
mov dword [ebp - 4], 0x1004b4a
lea ecx, [eax + 0x1e]
xor byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 0xa
jb 0x100b7738
push 0
lea eax, [ebp - 0x44]
mov byte [ebp - 1], 0
push eax
push 2
lea eax, [ebp - 0x19]
push eax
lea eax, [ebp - 0xc]
push eax
vzeroupper
call fcn.10029410
add esp, 0x14
mov dword [0x101d1404], eax
xor al, al
mov esp, ebp
pop ebp
ret
vmovdqa xmm0, xmmword [0x1014f4e0]
lea ecx, [ebp - 0x21]
mov dword [ebp - 0x11], 0x47404a
vmovdqu xmmword [ebp - 0x21], xmm0
mov byte [ebp - 0xd], 1
call fcn.1000bd20
mov edx, eax
mov dword [ebp - 0xc], 0x73654c4b
mov dword [ebp - 8], 0x410a1111
xor ecx, ecx
mov dword [ebp - 4], 0x1004b4a
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0xc], al
inc ecx
cmp ecx, 0xa
jb 0x100b77a8
push 0
push edx
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
call fcn.10029410
add esp, 0xc
cmp eax, dword [0x101d1404]
sete al
mov esp, ebp
pop ebp
ret
Function at 0x100b8840
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
vmovdqu xmm0, xmmword [edx]
vmovdqu xmmword [ecx], xmm0
vmovq xmm0, qword [edx + 0x10]
vmovq qword [ecx + 0x10], xmm0
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [ecx + 0x18], xmm0
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
vmovdqu xmm0, xmmword [edx + 0x18]
vmovdqu xmmword [ecx + 0x18], xmm0
vmovq xmm0, qword [edx + 0x28]
vmovq qword [ecx + 0x28], xmm0
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], 7
mov word [edx + 0x18], ax
mov al, byte [edx + 0x30]
mov byte [ecx + 0x30], al
mov eax, dword [edx + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x38]
mov dword [ecx + 0x38], eax
mov eax, ecx
pop ebp
ret 4

Function at 0x100b8a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100da651
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x101d1430]
cmp eax, dword [edx + 4]
jle 0x100b8b13
push 0x101d1430
call fcn.100d50bc
add esp, 4
cmp dword [0x101d1430], 0xffffffff
jne 0x100b8b13
mov dword [ebp - 4], 0
mov ecx, 8
mov dword [ebp - 0x28], 0x764e4073
mov dword [ebp - 0x24], 0x57415743
vpmovsxbd ymm1, qword [ebp - 0x28]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x20], 0x4c5e426a
mov word [ebp - 0x1c], 0x46
mov byte [ebp - 0x1a], 1
vmovq qword [ebp - 0x28], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, 0xd
jb 0x100b8ab4
mov byte [ebp - 0x1a], 0
xor ecx, ecx
mov dword [ebp - 0x19], 0x757f4b5a
mov dword [ebp - 0x15], 0x44487364
mov dword [ebp - 0x11], 0x5a425f
mov byte [ebp - 0xd], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x100b8ae0
lea eax, [ebp - 0x28]
mov byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x19]
push eax
vzeroupper
call fcn.1000f3e0
push 0x101d1430
mov dword [0x101d1444], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101d1444]
mov ecx, dword [ebp - 0xc]
mov al, byte [eax + esi]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100b8b30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x10162de0]
push esi
mov esi, dword [0x1015dfe8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test esi, esi
je 0x100b8c80
mov ecx, esi
call fcn.10018ac0
cmp byte [0x101d1221], 0
mov edi, dword [ebp + 8]
je 0x100b8c5c
mov ecx, esi
call fcn.1000c350
test al, al
jne 0x100b8c5c
mov ecx, esi
call fcn.100b8a00
cmp al, 1
ja 0x100b8c5c
mov ecx, esi
call fcn.10011430
shr eax, 0x12
test al, 1
jne 0x100b8c5c
mov ecx, esi
call fcn.10011430
shr eax, 0xd
test al, 1
jne 0x100b8c5c
mov eax, dword [esi + 0x1a4]
cmp eax, 8
je 0x100b8c5c
cmp eax, 9
je 0x100b8c5c
cmp eax, 0xa
je 0x100b8c5c
mov ecx, dword fs:[0x2c]
mov eax, dword [0x101d3534]
mov ecx, dword [ecx + ebx*4]
cmp eax, dword [ecx + 4]
jle 0x100b8c0e
push 0x101d3534
call fcn.100d50bc
add esp, 4
cmp dword [0x101d3534], 0xffffffff
jne 0x100b8c0e
mov ecx, 0x101d3538
call fcn.10033890
push 0x101d3534
call fcn.100d506b
add esp, 4
test byte [edi + 0x24], 2
je 0x100b8c4c
cmp byte [0x101d1452], 0
jne 0x100b8c43
mov ecx, esi
call fcn.1000cb40
cmp dword [eax], 0
jge 0x100b8c3a
mov ecx, esi
call fcn.1000c1f0
test al, 1
jne 0x100b8c3a
and dword [edi + 0x24], 0xfffffffd
jmp 0x100b8c5c
cmp byte [0x101d1452], 0
je 0x100b8c5c
mov byte [0x101d1452], 0
jmp 0x100b8c5c
cmp byte [0x101d1452], 0
jne 0x100b8c5c
mov byte [0x101d1452], 1
push ecx
push esi
push edi
call fcn.100b9f50
push edi
push esi
call fcn.100b8fd0
push esi
push edi
call fcn.100b9cf0
push dword [0x101d1238]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call edi
push str.sv_cheats
call fcn.100d0180
cmp byte [0x101d124a], 0
je 0x100b8ca9
test eax, eax
je 0x100b8ca9
lea ecx, [eax + 0x18]
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [0x101d1434], 1
jmp 0x100b8cc2
cmp byte [0x101d1434], 0
je 0x100b8cc2
lea ecx, [eax + 0x18]
mov eax, dword [ecx]
push 0
call dword [eax]
mov byte [0x101d1434], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [0x101d3554]
cmp eax, dword [ecx + 4]
jle 0x100b8d0f
push 0x101d3554
call fcn.100d50bc
add esp, 4
cmp dword [0x101d3554], 0xffffffff
jne 0x100b8d0f
push 0x101d3554
mov dword [0x101d3530], 0
mov dword [0x101d352c], 0x1015d148
call fcn.100d506b
add esp, 4
mov eax, dword [0x101d352c]
mov eax, dword [eax]
test eax, eax
jne 0x100b8d26
pop edi
pop esi
mov dword [0x101d3530], eax
pop ebx
pop ebp
ret 4
push eax
call edi
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x101d3530], eax
je 0x100b8d5d
cmp dword [0x101d1230], 0
jne 0x100b8d5d
cmp dword [0x101d144c], 0
jne 0x100b8d5d
cmp dword [0x101632a0], 0
jle 0x100b8d5d
mov eax, dword [0x1015d204]
mov dword [0x101d144c], eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100ba560
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100da6a1
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push esi
mov esi, ecx
mov edx, dword [eax + edx*4]
mov eax, dword [0x101d1460]
cmp eax, dword [edx + 4]
jle 0x100ba6ad
push 0x101d1460
call fcn.100d50bc
add esp, 4
cmp dword [0x101d1460], 0xffffffff
jne 0x100ba6ad
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x24], 0x754e4073
mov dword [ebp - 0x20], 0x674f404b
mov dword [ebp - 0x1c], 0x4d5447
mov byte [ebp - 0x18], 1
nop word [eax + eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0xb
jb 0x100ba5e0
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x40437072
mov dword [ebp - 0x13], 0x5145474e
mov word [ebp - 0xf], 0x47
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x100ba610
mov dword [ebp - 0x33], 0x637f4b5a
mov ecx, 8
mov dword [ebp - 0x2f], 0x75415043
vpmovsxbd ymm1, qword [ebp - 0x33]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x2b], 0x4c51464a
mov word [ebp - 0x27], 0x58
mov byte [ebp - 0x25], 1
vmovq qword [ebp - 0x33], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x33], al
inc ecx
cmp ecx, 0xd
jb 0x100ba676
lea eax, [ebp - 0x24]
mov byte [ebp - 0x25], 0
push eax
lea eax, [ebp - 0x17]
push eax
lea eax, [ebp - 0x33]
push eax
vzeroupper
call fcn.1000f4d0
push 0x101d1460
mov dword [0x101d1454], eax
call fcn.100d506b
add esp, 4
mov eax, dword [0x101d1454]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + esi]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100bb193
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100da6e1
push eax
mov dword fs:[0], esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
sub esp, 0x34
mov edx, dword [eax + edx*4]
mov eax, dword [0x101d1468]
push esi
mov esi, ecx
cmp eax, dword [edx + 4]
jle 0x100bb296
push 0x101d1468
call fcn.100d50bc
add esp, 4
cmp dword [0x101d1468], 0xffffffff
jne 0x100bb296
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
vmovdqa xmm0, xmmword [str.s_AOEf__gIOEOXw]
vmovdqu xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x30], 0x73
mov byte [ebp - 0x2e], 1
call fcn.1000c0c0
mov dword [ebp - 0x2d], 0x4e4e796a
mov edx, eax
mov dword [ebp - 0x29], 0x464b4f4c
mov ecx, 8
vpmovsxbd ymm1, qword [ebp - 0x2d]
vpxor ymm0, ymm1, ymmword [0x1014fce0]
vpshufb ymm0, ymm0, ymmword [0x1014fc40]
vpermq ymm0, ymm0, 0xd8
vpshufb ymm0, ymm0, ymmword [0x10150520]
vextracti128 xmm0, ymm0, 0
mov dword [ebp - 0x25], 0x484c4b47
mov dword [ebp - 0x21], 0x1004a5e
vmovq qword [ebp - 0x2d], xmm0
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xe
jb 0x100bb236
mov byte [ebp - 0x1e], 0
xor ecx, ecx
mov dword [ebp - 0x1d], 0x757f4b5a
mov dword [ebp - 0x19], 0x44487364
mov dword [ebp - 0x15], 0x5a425f
mov byte [ebp - 0x11], 1
lea eax, [ecx + 0x1e]
xor byte [ebp + ecx - 0x1d], al
inc ecx
cmp ecx, 0xb
jb 0x100bb262
push edx
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x11], 0
push eax
lea eax, [ebp - 0x1d]
push eax
vzeroupper
call fcn.1000f4d0
push 0x101d1468
mov dword [0x101d146c], eax
call fcn.100d506b
add esp, 4
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
vmovss xmm0, dword [eax]
vmovss xmm1, dword [eax + 4]
vmovss xmm2, dword [eax + 8]
mov eax, dword [0x101d146c]
vmovss dword [eax + esi], xmm0
vmovss dword [eax + esi + 4], xmm1
vmovss dword [eax + esi + 8], xmm2
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100bcb90
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x101d12de], 0
je 0x100bcbdc
cmp byte [0x101d147c], 0
je 0x100bcbdc
lea ecx, [ebp - 0xe]
mov dword [ebp - 0xe], 0x55537e72
mov dword [ebp - 0xa], 0x42574a46
mov dword [ebp - 6], 0x4c5b4e53
mov word [ebp - 2], 0x100
call fcn.1000bc50
mov ecx, dword [0x1016322c]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 0x1a8]
call eax
push ebx
mov ebx, dword [0x1015dfec]
push edi
mov edi, dword [0x1015dfe8]
mov byte [0x10163401], 0
mov byte [0x101d147c], 0
test edi, edi
je 0x100bcd5e
test ebx, ebx
je 0x100bcd5e
cmp byte [0x101d12ce], 0
je 0x100bcd5e
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10162de0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101d3558]
cmp eax, dword [ecx + 4]
jle 0x100bcc68
push 0x101d3558
call fcn.100d50bc
add esp, 4
cmp dword [0x101d3558], 0xffffffff
jne 0x100bcc68
push 0x101d3558
mov dword [0x101d3560], 0
mov dword [0x101d355c], 0x1015d254
call fcn.100d506b
add esp, 4
mov eax, dword [0x1015d254]
test eax, eax
je 0x100bccb1
mov ecx, dword [0x101d355c]
mov ecx, dword [ecx]
test ecx, ecx
jne 0x100bcc87
mov dword [0x101d3560], ecx
xor dl, dl
jmp 0x100bcca5
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, ax
mov eax, dword [0x1015d254]
shr edx, 0xf
and dl, 1
movzx ecx, dl
mov dword [0x101d3560], ecx
test dl, dl
jne 0x100bccb1
test eax, eax
jne 0x100bcd5e
mov ecx, dword [0x101d11e4]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
test al, al
jne 0x100bcd5e
mov ecx, dword [0x101d11a4]
mov eax, dword [ecx]
mov eax, dword [eax + 0xd4]
call eax
test al, al
jne 0x100bcd5e
push esi
mov esi, dword [ebp + 8]
push esi
push ecx
push edi
call fcn.100bacf0
cmp byte [0x101d12db], 0
je 0x100bcd45
cmp byte [0x10163269], 0
je 0x100bcd45
mov eax, dword [ebx]
mov ecx, ebx
mov eax, dword [eax + 0x5f4]
call eax
cmp eax, 7
jne 0x100bcd45
cmp byte [0x101d12d9], 0
push esi
je 0x100bcd25
push ebx
push edi
mov ecx, 0x101d1474
call fcn.100bba10
jmp 0x100bcd31
push ecx
push edi
mov ecx, 0x101d1474
call fcn.100bb810
test byte [esi + 0x24], 1
je 0x100bcd3e
mov byte [0x10163268], 1
mov byte [0x10163401], 1
push esi
push ecx
push edi
call fcn.100354c0
push esi
push ebx
push edi
call fcn.10034b10
push esi
push ebx
push edi
call fcn.10037280
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100bcd70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100da701
push eax
mov dword fs:[0], esp
sub esp, 0xe0
mov eax, dword fs:[0x2c]
mov edx, dword [0x10162de0]
push ebx
push esi
mov edx, dword [eax + edx*4]
mov esi, ecx
mov eax, dword [0x101d1498]
push edi
cmp eax, dword [edx + 4]
jle 0x100bcff1
push 0x101d1498
call fcn.100d50bc
add esp, 4
cmp dword [0x101d1498], 0xffffffff
jne 0x100bcff1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xea]
mov dword [ebp - 0xea], 0x3c623c63
mov dword [ebp - 0xe6], 0x3c613c78
mov dword [ebp - 0xe2], 0x3c7b3c18
mov dword [ebp - 0xde], 0x3c1e3c19
mov dword [ebp - 0xda], 0x3c673c7e
mov dword [ebp - 0xd6], 0x3c413c53
mov dword [ebp - 0xd2], 0x3c203c27
mov dword [ebp - 0xce], 0x3c553c44
mov dword [ebp - 0xca], 0x3c473c5e
mov dword [ebp - 0xc6], 0x3c5f3c5d
mov dword [ebp - 0xc2], 0x3c533c4a
mov dword [ebp - 0xbe], 0x3c4d3c2e
mov dword [ebp - 0xba], 0x3c5e3c28
mov dword [ebp - 0xb6], 0x3c443c50
mov dword [ebp - 0xb2], 0x3c533c45
mov dword [ebp - 0xae], 0x3c343c42
mov dword [ebp - 0xaa], 0x3c473c56
mov dword [ebp - 0xa6], 0x3c593c49
mov dword [ebp - 0xa2], 0x3c3a3c4c
mov dword [ebp - 0x9e], 0x3c4d3c5c
mov dword [ebp - 0x9a], 0x3c5f3c4e
mov dword [ebp - 0x96], 0x3cc33cb8
mov dword [ebp - 0x92], 0x3cba3ca2
mov dword [ebp - 0x8e], 0x3ca53cb2
mov dword [ebp - 0x8a], 0x3ca73cb9
mov dword [ebp - 0x86], 0x3ca93cb7
mov dword [ebp - 0x82], 0x3cab3cb5
mov dword [ebp - 0x7e], 0x3cad3cb3
mov dword [ebp - 0x7a], 0x3ccd3cb6
mov dword [ebp - 0x76], 0x3ca93cb0
mov dword [ebp - 0x72], 0x3cb33ca4
mov dword [ebp - 0x6e], 0x3cb53cab
mov dword [ebp - 0x6a], 0x3cb73ca9
mov dword [ebp - 0x66], 0x3cb93ca7
mov dword [ebp - 0x62], 0x3cbb3ca5
mov dword [ebp - 0x5e], 0x3cac3cdf
mov dword [ebp - 0x5a], 0x3cda3cbe
mov dword [ebp - 0x56], 0x3c813c92
mov dword [ebp - 0x52], 0x3c953c92
mov dword [ebp - 0x4e], 0x3c903c84
mov dword [ebp - 0x4a], 0x3c873c90
mov dword [ebp - 0x46], 0x3c913c9e
mov dword [ebp - 0x42], 0x3c943c8a
mov dword [ebp - 0x3e], 0x3c923c8c
mov dword [ebp - 0x3a], 0x3c903c8e
mov dword [ebp - 0x36], 0x3c8e3c90
mov dword [ebp - 0x32], 0x3c863c92
mov dword [ebp - 0x2e], 0x3c85
mov byte [ebp - 0x2a], 1
call fcn.100bde10
xor eax, eax
mov dword [ebp - 0x28], 0xd730d7d
mov dword [ebp - 0x24], 0xd440d49
xor ecx, ecx
mov dword [ebp - 0x20], 0xd570d4c
mov dword [ebp - 0x1c], 0xd410d0a
mov dword [ebp - 0x18], 0xd4b0d4a
mov word [ebp - 0x14], ax
mov byte [ebp - 0x12], 1
lea eax, [ecx + 0xd1e]
xor word [ebp + ecx*2 - 0x28], ax
inc ecx
cmp ecx, 0xa
jb 0x100bcfb3
lea eax, [ebp - 0xea]
mov byte [ebp - 0x12], 0
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100d4490
push 0x101d1498
mov dword [0x101d1494], eax
mov dword [ebp - 4], 0xffffffff
call fcn.100d506b
add esp, 4
mov eax, dword [0x101d1494]
mov ecx, esi
mov dword [ebp - 0x10], eax
call dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
pop edi
fstp dword [ebp - 0x10]
vmovss xmm0, dword [ebp - 0x10]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret