joyce8/EMBER2024-capa huggingface dataset:
Function at 0x554580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x554727
sub esp, 0x30
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov eax, dword [esp + 0x34]
mov dword [esp], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov byte [esp + 8], 2
call sym.vendor_golang.org_x_crypto_cryptobyte._String_.ReadASN1
movzx eax, byte [esp + 0xc]
test al, al
je 0x55460f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x55460f
mov edx, dword [esp + 0x24]
cmp eax, 1
je 0x554602
movzx ebx, byte [edx]
test bl, bl
jne 0x5545f4
movzx ebp, byte [edx + 1]
xchg ebp, eax
test al, 0x80
xchg ebp, eax
je 0x55460f
cmp bl, 0xff
jne 0x554602
movzx ebx, byte [edx + 1]
test bl, 0x80
jne 0x55460f
cmp eax, 8
jg 0x554618
mov ebx, dword [esp + 0x38]
xor ecx, ecx
jmp 0x554643
mov byte [esp + 0x3c], 0
add esp, 0x30
ret
jg 0x55460f
mov byte [esp + 0x3c], 1
add esp, 0x30
ret
mov ebp, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, ebp
shl ebp, 8
mov dword [ebx], ebp
shl esi, 8
shr edi, 0x18
or edi, esi
mov dword [ebx + 4], edi
movzx esi, byte [edx + ecx]
or esi, ebp
mov dword [ebx], esi
inc ecx
cmp ecx, eax
jl 0x554623
mov dword [esp + 0x14], eax
mov edx, dword [ebx]
mov dword [esp + 0x20], edx
mov ebp, dword [ebx + 4]
shl eax, 3
lea ecx, [eax - 0x40]
neg ecx
mov byte [esp + 0x13], cl
shl ebp, cl
mov dword [esp + 0x1c], ebp
mov edi, edx
shl edx, cl
add eax, 0xffffffe0
mov byte [esp + 0x12], al
mov ecx, eax
shr edi, cl
mov dword [esp + 0x18], edi
neg eax
mov ecx, eax
mov esi, dword [esp + 0x20]
shl esi, cl
movzx edi, byte [esp + 0x13]
xchg edi, eax
shr al, 5
xchg edi, eax
xchg edi, eax
movzx eax, al
xchg edi, eax
mov dword [esp + 0x20], edi
cmp al, 0x20
sbb edi, edi
sbb ebp, ebp
and edi, esi
xchg ebp, ebx
not ebx
xchg ebp, ebx
or ebp, eax
xchg ebp, eax
mov byte [esp + 0x11], al
xchg ebp, eax
movzx ecx, byte [esp + 0x13]
cmp cl, 0x20
sbb eax, eax
sbb esi, esi
and edx, esi
mov dword [ebx], edx
mov ebp, dword [esp + 0x1c]
and ebp, esi
not eax
or eax, ecx
mov byte [esp + 0x13], al
shr edx, cl
and edx, esi
mov esi, dword [esp + 0x20]
cmp esi, 1
sbb esi, esi
xor esi, 0xffffffff
mov dword [esp + 0x20], esi
movzx ecx, byte [esp + 0x12]
cmp cl, 0x20
sbb eax, eax
mov esi, dword [esp + 0x18]
and esi, eax
or ebp, esi
or ebp, edi
mov dword [ebx + 4], ebp
mov esi, ebp
shl ebp, cl
and ebp, eax
or edx, ebp
movzx ecx, byte [esp + 0x11]
mov eax, esi
sar esi, cl
mov ebp, dword [esp + 0x20]
and ebp, esi
or ebp, edx
mov dword [ebx], ebp
movzx ecx, byte [esp + 0x13]
sar eax, cl
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
cmp eax, 8
jmp 0x554618
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_crypto_cryptobyte._String_.readASN1Int64
Function at 0x55dee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x55e08a
sub esp, 0x54
lea edi, [esp + 0x60]
xor eax, eax
call fcn.0046b1cb
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
xor ebx, ebx
jmp 0x55df0f
inc ebx
cmp edx, ebx
jle 0x55e02e
movzx ebp, byte [ecx + ebx]
xchg ebp, eax
cmp al, 0x25
xchg ebp, eax
je 0x55dfd2
xchg ebp, eax
cmp al, 0x2e
xchg ebp, eax
je 0x55df83
xchg ebp, eax
cmp al, 0x3a
xchg ebp, eax
jne 0x55df0e
lea edi, [esp + 0x28]
call fcn.0046b1cb
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv6
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046b6ae
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046b6ae
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x28]
call fcn.0046b1cb
mov ecx, dword [esp + 0x58]
mov dword [esp], ecx
mov dword [esp + 4], edx
call sym.net_netip.parseIPv4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x20]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
call fcn.0046b6ae
lea edi, [esp + 0x60]
lea esi, [esp + 0x28]
call fcn.0046b6ae
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046b1ca
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x5e5770]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x14
lea edi, [esp + 0x60]
call fcn.0046b1cb
lea ecx, [0x5ce7e0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x627e18]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
lea edi, [esp + 0x3c]
call fcn.0046b1ca
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
lea ecx, [0x5e4ade]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x12
lea edi, [esp + 0x60]
call fcn.0046b1cb
lea ecx, [0x5ce7e0]
mov dword [esp], ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
call sym.runtime.convT
mov ecx, dword [esp + 8]
lea edx, [0x627e18]
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
add esp, 0x54
ret
call sym.runtime.morestack_noctxt
jmp sym.net_netip.ParseAddr
Function at 0x5665b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x56676c
sub esp, 0x5c
lea edi, [esp + 0x7c]
xor eax, eax
call fcn.0046b1c7
mov ecx, dword [esp + 0x60]
test ecx, ecx
je 0x5665e8
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x60]
jmp 0x566611
lea eax, [0x5ba880]
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x200
call sym.runtime.makeslice
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 0x200
mov dword [esp + 0x30], ecx
lea edi, [esp + 0x34]
mov ebx, eax
xor eax, eax
call fcn.0046b1c7
mov dword [esp + 0x34], ebx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x50], ecx
movzx ecx, word [esp + 0x70]
shl ecx, 0xb
movzx edx, word [esp + 0x78]
movzx ebx, byte [esp + 0x75]
or edx, ecx
test bl, bl
je 0x566654
or edx, 0x80
movzx eax, byte [esp + 0x74]
test al, al
je 0x566663
or edx, 0x100
movzx eax, byte [esp + 0x73]
test al, al
je 0x566672
or edx, 0x200
movzx eax, byte [esp + 0x72]
test al, al
je 0x566681
or edx, 0x400
movzx eax, byte [esp + 0x6e]
test al, al
je 0x566690
or edx, 0xffff8000
movzx eax, byte [esp + 0x76]
test al, al
je 0x56669c
or edx, 0x20
movzx eax, byte [esp + 0x77]
test al, al
je 0x5666a8
or edx, 0x10
movzx eax, word [esp + 0x6c]
mov word [esp + 0x42], ax
mov word [esp + 0x44], dx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
lea edx, [ecx + 0xc]
mov ebx, dword [esp + 0x34]
cmp eax, edx
jae 0x566718
mov dword [esp + 0x30], ecx
mov dword [esp], ebx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xc
lea eax, [0x5ba880]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x58], ebx
add ecx, ebx
mov dword [esp], ecx
lea ecx, [esp + 0x20]
mov dword [esp + 4], ecx
mov dword [esp + 8], 0xc
call sym.runtime.memmove
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov byte [esp + 0x40], 1
lea edi, [esp + 0x7c]
lea esi, [esp + 0x34]
call fcn.0046b686
add esp, 0x5c
ret
call sym.runtime.morestack_noctxt
jmp sym.vendor_golang.org_x_net_dns_dnsmessage.NewBuilder
Function at 0x57cd60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x57ced1
sub esp, 0x48
mov eax, dword [esp + 0x78]
cmp eax, 4
jne 0x57cdf7
mov ecx, dword [esp + 0x74]
cmp dword [ecx], 0x6c616964
je 0x57cd96
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x57ce03
mov eax, dword [esp + 0x64]
mov ecx, dword [eax + 0x1c]
mov edx, dword [esp + 0x68]
mov dword [esp], edx
call ecx
movzx eax, byte [esp + 4]
test al, al
jne 0x57cdc1
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
jmp 0x57ce03
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 0x24]
mov ecx, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x58]
mov dword [esp + 8], edx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, eax
mov ebx, ecx
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
jmp 0x57ce03
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x68]
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x54]
mov dword [esp], ebp
mov esi, dword [esp + 0x58]
mov dword [esp + 4], esi
mov edi, dword [esp + 0x5c]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x60]
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call sym.net.favoriteAddrFamily
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x24]
mov edx, dword [esp + 0x4c]
mov dword [esp], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 4], edx
mov edx, dword [esp + 0x54]
mov dword [esp + 8], edx
mov edx, dword [esp + 0x58]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
call sym.net.socket
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
mov dword [esp + 0x88], edx
add esp, 0x48
ret
call sym.runtime.morestack_noctxt
jmp sym.net.internetSocket
Function at 0x58b7e0
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58b825
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_md5._digest_.Reset

Function at 0x58bc00
Capabilities:
Hash data with md5

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58bc68
sub esp, 8
lea eax, [0x5cd500]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
lea ecx, [0x6284bc]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_md5.New

Function at 0x58cd30
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58cd7c
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_sha1._digest_.Reset

Function at 0x58cd90
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x58cdff
sub esp, 8
lea eax, [0x5cd600]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
nop
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
lea ecx, [0x628570]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add esp, 8
ret
call sym.runtime.morestack_noctxt
jmp sym.crypto_sha1.New
Function at 0x5989d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x75a1cc]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x598adf
sub esp, 0xc
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x598a4d
mov edx, dword [esp + 0x1c]
cmp edx, ecx
jb 0x598ad9
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
cmp edx, ebx
je 0x598a28
mov ebp, edx
lea esi, [ebx + ecx - 1]
nop
cmp esi, edx
jb 0x598a26
lea esi, [ebp + ecx - 1]
cmp esi, ebx
jae 0x598ac1
mov edx, ebp
mov ebx, dword [esp + 0x20]
jmp 0x598a28
mov edx, ebp
lea eax, [ecx - 1]
mov ebp, dword [esp + 0x18]
cmp ebp, eax
jbe 0x598aba
mov eax, dword [esp + 0x10]
movzx ebp, byte [eax + 0x400]
movzx esi, byte [eax + 0x401]
xor edi, edi
jmp 0x598a9e
add esp, 0xc
ret
movzx ebx, byte [ebx + edi]
inc ebp
xchg ebp, eax
mov byte [esp + 0xb], al
xchg ebp, eax
xchg ebp, eax
movzx ecx, al
xchg ebp, eax
mov ebp, dword [eax + ecx*4]
add esi, ebp
xchg esi, eax
mov byte [esp + 0xa], al
xchg esi, eax
xchg esi, eax
movzx eax, al
xchg esi, eax
mov edx, dword [eax + esi*4]
mov dword [eax + ecx*4], edx
mov dword [eax + esi*4], ebp
lea ecx, [ebp + edx]
movzx ecx, cl
xor ebx, dword [eax + ecx*4]
mov edx, dword [esp + 0x14]
mov byte [edx + edi], bl
inc edi
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
movzx ebp, byte [esp + 0xb]
movzx esi, byte [esp + 0xa]
cmp ecx, edi
jg 0x598a51
xchg ebp, ebx
mov byte [eax + 0x400], bl
xchg ebp, ebx
xchg esi, ebx
mov byte [eax + 0x401], bl
xchg esi, ebx
add esp, 0xc
ret
mov ecx, ebp
call sym.runtime.panicIndex
lea eax, [0x5ba800]
mov dword [esp], eax
lea eax, [0x6278d0]
mov dword [esp + 4], eax
call sym.runtime.gopanic
call sym.runtime.panicSliceAcap
nop
call sym.runtime.morestack_noctxt
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x10002fd9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, edx
mov edx, dword [esp + 8]
push edi
mov edi, ecx
not edx
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10074320]
inc edi
sub esi, 1
jne 0x10002fe5
not edx
pop edi
mov eax, edx
pop esi
ret

Function at 0x10003004
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov edx, ebx
test edi, edi
je 0x10003066
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1000302e
cmp edi, 2
jb 0x1000302e
cmp byte [esi], al
jne 0x1000302e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10074320]
test edi, edi
jne 0x10003017
jmp 0x1000306d
cmp al, 0x23
jne 0x10003054
cmp byte [esi], al
jne 0x10003054
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10074320]
mov al, byte [esi]
inc esi
test al, al
jne 0x10003046
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret

Function at 0x10003184
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
test edi, edi
je 0x10003193
and dword [edi], 0
mov edx, 0x100724bc
call fcn.10003075
mov ebx, eax
test ebx, ebx
je 0x100031f9
mov ecx, ebx
call fcn.1000312e
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100031f2
mov ecx, ebp
call fcn.10006cd0
mov dword [esp + 0x14], eax
test eax, eax
je 0x100031f2
push ebx
push ebp
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
mov ecx, ebx
mov esi, eax
call fcn.1000311f
cmp esi, ebp
je 0x100031e6
mov ecx, dword [esp + 0x14]
call fcn.10006cee
jmp 0x100031f9
test edi, edi
je 0x100031ec
mov dword [edi], ebp
mov eax, dword [esp + 0x14]
jmp 0x100031fb
mov ecx, ebx
call fcn.1000311f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10015403
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
cmp dword [esi + 0x5a58], 0
lea edi, [esi + 0x5a5c]
mov ecx, edi
je 0x1001545e
push 0
call fcn.1001c1fe
push dword [esp + 0x10]
mov ecx, edi
push ebx
call fcn.10003c0e
mov edx, dword [edi]
mov ecx, 0x10090d44
push dword [esi + 0x5a58]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x5a64]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
jmp 0x10015468
push dword [esp + 0x10]
push ebx
call fcn.10003c0e
pop edi
pop esi
pop ebx
ret

Function at 0x10015d2f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10090d48]
push esi
mov esi, ecx
push edi
and dword [eax + 0x59f0], 0
test esi, esi
je 0x10015d7e
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
call fcn.10015d82
mov edx, 0x100724c0
mov ecx, esi
mov edi, eax
call fcn.10003075
mov esi, eax
test esi, esi
je 0x10015d7e
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, esi
call fcn.1000311f
pop edi
pop esi
leave
ret
Function at 0x1003e7e6
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
test byte [ecx], 4
mov dword [esp], ecx
jne 0x1003e986
imul eax, dword [ecx + 0x474], 0x1c
lea edx, [ecx + 0x68]
push ebx
push ebp
push esi
push edi
add eax, dword [ecx + 0x58]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
movzx ebp, word [eax]
movzx edx, word [eax + 6]
mov esi, ebp
movzx eax, word [eax + 4]
add edx, ebx
imul edx, dword [ecx + 0x2c]
sub esi, ebx
mov edi, dword [ecx + 0x24]
shr esi, 1
sub ebp, esi
sub ebp, ebx
add edx, eax
test edi, edi
je 0x1003e870
add edi, edx
test esi, esi
je 0x1003e846
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, esi
test ebx, ebx
je 0x1003e85b
push ebx
push 0xff
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test ebp, ebp
je 0x1003e8a6
push ebp
lea eax, [edi + ebx]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1003e8a6
mov eax, dword [ecx + 0x28]
lea edx, [eax + edx*4]
test esi, esi
je 0x1003e885
mov ecx, esi
mov eax, 0xffffff
mov edi, edx
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x1003e893
lea edi, [edx + esi*4]
mov ecx, ebx
or eax, 0xffffffff
rep stosd dword es:[edi], eax
test ebp, ebp
je 0x1003e8a6
lea eax, [esi + ebx]
mov ecx, ebp
lea edi, [edx + eax*4]
mov eax, 0xffffff
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
movzx edx, word [ecx + 4]
movzx ecx, word [ecx + 6]
add edx, esi
add ecx, ebx
lea esi, [esp + 0x1c]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10088fa0]
mov eax, dword [esp + 0x10]
cvtpd2ps xmm1, xmm0
movd xmm0, ecx
mulss xmm1, dword [eax + 0x38]
shr ecx, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [ecx*8 + 0x10088fa0]
mov ecx, eax
lea eax, [edx - 1]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [ecx + 0x38]
addss xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm1, dword [0x100884b0]
addsd xmm0, qword [eax*8 + 0x10088fa0]
lea eax, [ebx + 1]
add eax, edx
movss dword [esp + 0x20], xmm1
movss dword [esp + 0x28], xmm1
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [ecx + 0x34]
movss dword [esp + 0x1c], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
inc ebx
addsd xmm0, qword [eax*8 + 0x10088fa0]
mov eax, dword [esp + 0x14]
mov edi, eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [ecx + 0x34]
movss dword [esp + 0x24], xmm0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ebx, 0x40
jb 0x1003e810
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x10045992
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [0x10090d48]
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x11
lea edi, [eax + 8]
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x1000
call fcn.100029f4
push 0x10
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x2000
call fcn.100029f4
push 0x12
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x4000
call fcn.100029f4
push 0x5d
call esi
shr eax, 0xf
mov ecx, edi
and al, 1
movzx eax, al
push eax
push 0x8000
call fcn.100029f4
pop edi
pop esi
pop ecx
ret
Function at 0x1006a712
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edx, dword [0x100923cc]
push esi
xor esi, esi
jmp 0x1006a724
cmp dword [edx + 4], esi
jne 0x1006a770
mov edx, dword [edx]
test edx, edx
jne 0x1006a71d
push 0x40
push 0x3000
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
test edx, edx
je 0x1006a781
push 0x20
mov dword [edx + 4], esi
lea ecx, [edx + 0x20]
mov dword [edx + 8], esi
pop esi
mov eax, dword [edx + 4]
add esi, 0x20
mov dword [ecx], eax
mov dword [edx + 4], ecx
add ecx, 0x20
cmp esi, 0xfe0
jbe 0x1006a74d
mov eax, dword [0x100923cc]
mov dword [edx], eax
mov dword [0x100923cc], edx
test edx, edx
je 0x1006a781
mov eax, dword [edx + 4]
pop esi
mov ecx, dword [eax]
inc dword [edx + 8]
mov dword [edx + 4], ecx
ret
xor eax, eax
pop esi
ret

Function at 0x1006b00e
Capabilities:
Enumerate threads

Disassembly:
sub esp, 0x20
mov eax, dword [0x1008c00c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov esi, ecx
push ebp
push 4
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1006b118
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1006b111
inc edi
cmp dword [esp + 0x10], 0x10
jb 0x1006b0d3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x1c], eax
jne 0x1006b0d3
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esp + 0x18], eax
je 0x1006b0d3
mov edx, dword [esi]
test edx, edx
jne 0x1006b09f
push 0x200
push ebp
push dword [0x10090e44]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1006b0fa
jmp 0x1006b0c6
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1006b0c6
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push ebp
push dword [0x10090e44]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1006b0fa
mov dword [esi], edx
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1006b057
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1006b111
mov edi, ebp
cmp dword [esi], edi
je 0x1006b111
push dword [esi]
push ebp
push dword [0x10090e44]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1006dac1
add esp, 0x20
ret