joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100419f3
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10041a26
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10041a21
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10041b1b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0x289c
jl 0x10041a8a
mov dword [ebp - 0xc], 1
jmp 0x10041a8e
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
sub eax, 4
mov ecx, dword [ebp - 0x14]
cmp eax, dword [ecx]
jl 0x10041aa6
mov dword [ebp - 4], 1
jmp 0x10041aaa
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 4], eax
jl 0x10041ac2
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x10041ac2
and dword [ebp - 8], 0
jmp 0x10041ac9
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0x1d691704
je 0x10041adb
mov dword [ebp - 0x10], 1
jmp 0x10041adf
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jge 0x10041af0
mov dword [ebp - 0x18], 1
jmp 0x10041af4
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jne 0x10041b0c
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0
jne 0x10041b0c
and dword [ebp - 0x24], 0
jmp 0x10041b13
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10042006
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10042034
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042032
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x10042058
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10042058
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10044fd2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x7a0
push 1
push 0x511f
lea eax, [ebp + 8]
push eax
call fcn.10044c1c
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004500c
xor eax, eax
jmp 0x10045176
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
call fcn.10044c9d
add esp, 0x10
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10045034
xor eax, eax
jmp 0x10045176
push 0x69a6
push 0x7130
push 1
push 0x52a2
push 0x5733
push dword [ebp - 8]
push 0x2e0a
lea eax, [ebp - 0xc]
push eax
push 0x3900
call fcn.10043f5d
add esp, 0x24
cmp dword [ebp - 0xc], 0
jne 0x10045070
xor eax, eax
jmp 0x10045176
push 0x882
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
push 0x469d
push 1
call fcn.10044a92
add esp, 0x20
lea eax, [ebp - 4]
push eax
push 0x624f
push 0x167e
push 0x49dc
push 0x5f18
lea eax, [ebp + 8]
push eax
push 0x619d
push 1
push 0x78ad
push 0x5a0c
push 0x12f5
lea eax, [ebp - 8]
push eax
call fcn.10044cfd
add esp, 0x30
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 4]
push eax
push 1
push 0x71d1
push 0x1d90
lea eax, [ebp - 0x1c]
push eax
call fcn.10044f1d
add esp, 0x14
push dword [ebp - 4]
call fcn.10043e3a
pop ecx
test eax, eax
jne 0x1004510d
xor eax, eax
jmp 0x10045176
push 1
push dword [ebp - 4]
call fcn.1003d225
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1004515e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x10045138
xor eax, eax
jmp 0x10045176
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10045151
xor eax, eax
jmp 0x10045176
push 1
lea eax, [ebp - 4]
push eax
call fcn.10044f95
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1004516f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x10045173
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1004d3e2
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004d3fb
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1004d4fe
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0xf8609561
mov eax, 0xf8609561
test eax, eax
jne 0x1004d47f
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x1004d47f
and dword [ebp - 0xc], 0
jmp 0x1004d486
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x1004d4a3
mov eax, dword [ebp - 0x44]
cmp dword [eax], 0
jne 0x1004d4a3
and dword [ebp - 0x10], 0
jmp 0x1004d4aa
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0xd0d4
jge 0x1004d4bc
mov dword [ebp - 8], 1
jmp 0x1004d4c0
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
cmp dword [ebp - 8], eax
jl 0x1004d4db
mov dword [ebp - 0x14], 1
jmp 0x1004d4df
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jge 0x1004d4f2
mov dword [ebp - 0x18], 1
jmp 0x1004d4f6
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10050804
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1005081c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1005084d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10028177
mov dword [eax], 4
mov eax, dword [ebp - 0x10]
mov dword [eax], 4
mov esp, ebp
pop ebp
ret

Function at 0x10050c8c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10050ca4
push 0xf4
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x10050cac
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ebp
ret
Function at 0x10050cae
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10050d27
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10050d25
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10050d0d
mov ecx, dword [ebp - 4]
call fcn.10058507
movzx eax, al
test eax, eax
jne 0x10050d25
push dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
call fcn.100584c9
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov byte [eax], 1
jmp 0x10050d47
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10050d47
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x10083c25
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008e330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10074c3c
mov dword [ebp - 0x14], eax
cmp dword [0x1067baec], esi
jne 0x10083d18
push 0x800
push esi
push 0x100079bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10083ca5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10083df8
push esi
push esi
push 0x100079bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10083df8
push 0x100079d4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10083df8
push eax
call ebx
push 0x100079e0
push edi
mov dword [0x1067baec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079f0
push edi
mov dword [0x1067baf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a04
push edi
mov dword [0x1067baf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067bafc], eax
test eax, eax
je 0x10083d15
push 0x10007a20
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067baf8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10083d3d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10083d30
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10083d52
push 4
pop eax
jmp 0x10083dfa
cmp dword [ebp - 0x14], esi
je 0x10083d52
push dword [0x1067baec]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10083d37
mov eax, dword [0x1067baf8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10083db0
cmp dword [0x1067bafc], edi
je 0x10083db0
push eax
call ebx
push dword [0x1067bafc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10083db0
test eax, eax
je 0x10083db0
call ecx
test eax, eax
je 0x10083da5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10083da5
test byte [ebp - 8], 1
jne 0x10083db0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10083de0
mov eax, dword [0x1067baf0]
cmp eax, edi
je 0x10083ddd
push eax
call ebx
test eax, eax
je 0x10083ddd
call eax
mov esi, eax
test esi, esi
je 0x10083ddd
mov eax, dword [0x1067baf4]
cmp eax, edi
je 0x10083ddd
push eax
call ebx
test eax, eax
je 0x10083ddd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067baec]
call ebx
test eax, eax
je 0x10083df8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10083dfa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x1000ff90
Capabilities:
Create directory

Disassembly:
push esi
push 0
push str.C:kumori
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, esi
call fcn.10007ed0
mov ecx, esi
call fcn.10009bb0
mov ecx, esi
call fcn.1000ae90
mov ecx, esi
call fcn.1000cbc0
mov ecx, esi
call fcn.1000e780
mov ecx, esi
pop esi
jmp fcn.1000efa0

Function at 0x10010200
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1011fac5
push eax
mov dword fs:[0], esp
mov eax, Ordinal_2
mov ecx, dword [0x1016c264]
sub esp, 0x64
sub eax, ecx
push ebx
cmp eax, 0xa
jb 0x1001033d
cmp dword [0x1016c268], 0xf
mov eax, 0x1016c254
push ecx
cmova eax, dword [0x1016c254]
push eax
push 0xa
push str.C:kumori_
push ecx
push dword [ebp - 0x14]
lea ecx, [ebp - 0x54]
call fcn.100116d0
push 0
push str.C:kumori
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push str.C:kumori_records
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp - 0x40], 0xf
lea eax, [ebp - 0x54]
push dword [ebp - 0x44]
cmova eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
push eax
mov byte [ebp - 0x14], 0
push dword [ebp - 0x14]
call fcn.10011ae0
add esp, 0xc
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x6c]
call fcn.10007410
add esp, 4
mov dword [ebp - 0x18], 0x10164b18
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x1001031a
cmp eax, 1
setne bl
lea ecx, [ebp - 0x6c]
call fcn.10010de0
test bl, bl
je 0x100102f2
cmp dword [ebp - 0x40], 0xf
lea eax, [ebp - 0x54]
cmova eax, dword [ebp - 0x54]
push eax
call fcn.100faf56
add esp, 4
mov ecx, dword [ebp - 0x40]
cmp ecx, 0xf
jbe 0x1001032c
mov edx, dword [ebp - 0x54]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10010322
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10010342
jmp 0x10010322
xor bl, bl
test ecx, ecx
jne 0x10010347
jmp 0x100102d2
push ecx
push edx
call fcn.100f5603
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10002fa0
call fcn.100fac9a
lea eax, [ebp - 0x6c]
mov ecx, str.exists
push eax
lea edx, [ebp - 0x1c]
call fcn.100073a0
int3
Function at 0x100189f0
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ff3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x260
push esi
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x28], eax
push ecx
push eax
mov dword [ebp - 0x270], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x10018a80
mov byte [ebp - 0x11], al
jmp 0x10018b92
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10018aa0
sub ecx, edx
lea eax, [ebp - 0x24c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.1001a360
cmp dword [ebp - 0x2c], 7
lea edi, [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmova edi, eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x30], 0xb
jne 0x10018afb
mov eax, str.Spotify.exe
mov esi, 0xb
sub edi, eax
movzx edx, word [edi + eax]
movzx ecx, word [eax]
cmp dx, cx
jne 0x10018afb
add eax, 2
sub esi, 1
jne 0x10018ae1
mov byte [ebp - 0x11], 1
jmp 0x10018aff
mov byte [ebp - 0x11], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 7
jbe 0x10018b39
mov edx, dword [ebp - 0x24]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10018b2f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018bdb
push ecx
push edx
call fcn.100f5603
add esp, 8
cmp byte [ebp - 0x11], 0
je 0x10018b65
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x18]
je 0x10018b55
mov eax, dword [ebp - 0x268]
mov dword [ecx], eax
add dword [ebp - 0x1c], 4
jmp 0x10018b65
lea eax, [ebp - 0x268]
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.10004a20
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10018a80
lea eax, [ebp - 0x20]
push eax
push 0x100187b0
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
setne byte [ebp - 0x11]
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x10018bc5
mov ecx, dword [ebp - 0x18]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10018bbb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018bdb
push ecx
push edx
call fcn.100f5603
add esp, 8
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp - 0x11]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100fac9a
int3
Function at 0x1001feb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10168938], 0
push esi
push edi
mov esi, ecx
je 0x10020033
push dword [0x10168940]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10020033
mov eax, dword [0x1016bffc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10020033
call fcn.10093ba0
test al, al
je 0x10020033
mov ecx, dword [0x10167e4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10020033
mov ecx, dword [0x10167e4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x10020033
mov eax, dword [0x1016bffc]
mov ecx, dword [eax]
call fcn.10017c60
mov eax, dword [eax]
cmp eax, 0x400
je 0x10020033
cmp eax, 8
je 0x10020033
mov eax, dword [0x1016bffc]
mov eax, dword [eax]
mov eax, dword [eax + 0x25c]
cmp eax, 9
je 0x10020033
cmp eax, 8
je 0x10020033
cmp byte [esi + 0x60], 0
je 0x10020037
mov edi, dword [ebp + 8]
movss xmm1, dword [edi]
ucomiss xmm1, dword [0x10151bac]
lahf
test ah, 0x44
jnp 0x10020037
mov edx, dword [esi + 0x6c]
xorps xmm0, xmm0
mov eax, dword [0x10167e48]
mov ecx, dword [esi + 0x70]
cvtsi2ss xmm0, edx
sub ecx, dword [eax + 0x1c]
add ecx, edx
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, ecx
fld qword [esp + 8]
divss xmm0, xmm1
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm0
fld qword [esp + 8]
call fcn.10119da0
movsd xmm2, qword [0x10151d60]
fstp qword [esp + 8]
movsd xmm0, qword [esp + 8]
cvtpd2ps xmm0, xmm0
cvtps2pd xmm1, xmm0
xorps xmm0, xmm0
cvtsi2ss xmm0, dword [esi + 0x74]
addsd xmm1, xmm2
mulss xmm0, dword [0x10168944]
cvtps2pd xmm0, xmm0
addsd xmm1, xmm0
divsd xmm2, xmm1
cvtpd2ps xmm1, xmm2
movss dword [esp + 8], xmm1
fld dword [esp + 8]
fstp dword [esp + 8]
movss xmm0, dword [esp + 8]
ucomiss xmm0, xmm0
setp al
cmp al, 1
je 0x10020037
mulss xmm1, dword [edi]
movss dword [edi], xmm1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov byte [esi + 0x60], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10022c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101207c5
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0xf
mov ebx, dword [edi + 0x10]
jbe 0x10022c6e
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x10022c91
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x10022c80
push esi
push edi
lea eax, [ebp - 0x18]
push eax
call fcn.10026290
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10022d55
cmp dword [0x10168db4], 0x6666666
je 0x10022d6b
mov dword [ebp - 0x20], 0x10168db0
mov dword [ebp - 4], eax
push 0x28
mov dword [ebp - 0x1c], eax
call fcn.100f52b9
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
lea ecx, [ebx + 8]
push edi
call fcn.10010d10
xorps xmm0, xmm0
lea edi, [ebx + 8]
movq qword [edi + 0x18], xmm0
mov dword [ebp - 4], 1
mov eax, dword [0x10168db4]
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10152160]
mov eax, dword [0x10168dc8]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10152160]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x10168dac]
jbe 0x10022d4a
call fcn.10025c10
push esi
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.10026290
mov ecx, dword [eax]
jmp 0x10022d4d
mov ecx, dword [ebp - 0x18]
push ebx
push ecx
push esi
call fcn.10025ca0
mov ecx, dword [ebp - 0xc]
add eax, 0x20
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.100f3afa
int3

Function at 0x10024620
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x101208c0
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100f52b9
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.100f4537
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.100249a0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret