joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006fc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov ecx, dword [0x1004b8d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1004b8e4]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov esi, eax
lea ecx, [esp + 0x10]
movss xmm0, dword [esi + 0xe0]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [esi + 0xe4]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esi + 0xe8]
movss dword [esp + 0x18], xmm0
call fcn.10002a30
comiss xmm0, dword [0x100462e4]
jbe 0x100071c2
push 0x56
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100071c2
cmp byte [0x10f6c791], 0
je 0x100071c2
movss xmm0, dword [esi + 0xe4]
divss xmm0, dword [esi + 0xe0]
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_atanf
movss xmm2, dword [esi + 0xe0]
xorps xmm1, xmm1
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x10046290]
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x100463ac]
comiss xmm0, xmm2
movss dword [esp + 8], xmm1
jb 0x10007093
addss xmm1, dword [0x10046334]
movss dword [esp + 8], xmm1
cmp byte [0x11db96c0], 0
je 0x100070a6
movss xmm3, dword [0x100463c4]
jmp 0x100070ae
movss xmm3, dword [0x10046200]
movss xmm0, dword [esi + 0xe4]
xorps xmm1, xmm1
mulss xmm0, xmm0
mulss xmm2, xmm2
fld dword [0x100462bc]
movss xmm4, dword [0x100462dc]
addss xmm0, xmm2
sqrtss xmm0, xmm0
movss dword [esp + 0xc], xmm0
fld dword [esp + 0xc]
fpatan
fstp dword [esp + 0xc]
movss xmm0, dword [esp + 0xc]
mulss xmm0, dword [0x100462ec]
comiss xmm0, xmm1
jb 0x100070ff
comiss xmm4, xmm0
jae 0x1000710e
comiss xmm1, xmm0
ja 0x1000710a
movss xmm0, xmm4
jmp 0x1000710e
movss xmm0, xmm1
mov eax, dword [0x1004b8e0]
mulss xmm0, dword [eax + 0x1c]
mulss xmm0, xmm3
call fcn.10006360
comiss xmm0, dword [0x10046108]
mov dword [edi + 0x18], 0
movss dword [esp + 0xc], xmm0
jbe 0x10007141
movss xmm1, dword [0x100463f0]
jmp 0x10007149
movss xmm1, dword [0x1004636c]
mov ecx, dword [0x1004b8d8]
lea edx, [esp + 0x10]
movss dword [edi + 0x1c], xmm1
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
call eax
movss xmm0, dword [esp + 8]
addss xmm0, dword [esp + 0xc]
movss xmm1, dword [esp + 0x14]
subss xmm1, xmm0
mulss xmm1, dword [0x10046138]
movaps xmm0, xmm1
call fcn.1003c0f0
movss xmm3, dword [edi + 0x18]
movaps xmm4, xmm0
movss xmm2, dword [edi + 0x1c]
movaps xmm5, xmm4
movaps xmm1, xmm3
shufps xmm5, xmm4, 1
movaps xmm0, xmm2
mulss xmm1, xmm5
mulss xmm0, xmm4
mulss xmm3, xmm4
mulss xmm2, xmm5
subss xmm1, xmm0
addss xmm3, xmm2
movss dword [edi + 0x18], xmm1
movss dword [edi + 0x1c], xmm3
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10007630
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x1004b040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [esp + 0x4c]
movaps xmm1, xmm2
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
push edi
mov edi, edx
call fcn.10007480
cmp dword [eax + 0x14], 0xf
jbe 0x1000765d
mov eax, dword [eax]
push ebx
push 0x20
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100076a6
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000769c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000769c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003b276
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [esp + 0x50]
add esp, 4
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003af4e
add esp, 0x44
ret

Function at 0x10007760
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x1004b040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [esp + 0x58]
mov ebx, edx
push edi
mov edi, ecx
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.100112a0
cmp dword [esp + 0x28], 0xf
lea ecx, [esp + 0x2c]
push esi
push 0x20
push ecx
lea eax, [esp + 0x20]
cmova eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100077db
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100077d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100077d1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003b276
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x50]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003af4e
add esp, 0x48
ret
Function at 0x10011510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x12
xor eax, eax
nop
mov dl, byte [edi + eax - 0xc09c6f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001153d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011520
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10a5f68]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001157d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10011560
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1013618]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100115bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x100115a0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x100116c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x23
xor eax, eax
nop
mov dl, byte [edi + eax - 0x14d61d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100116ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100116d0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 3
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9fbca]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100118bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100118a0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100118d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb
xor eax, eax
nop
mov dl, byte [edi + eax - 0x41dd9f2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100118fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100118e0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92a3c9]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011abd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011aa0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10011ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92318a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011ccd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x10011cb0
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x100122c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x62
xor eax, eax
nop
mov dl, byte [edi + eax - 0x47c8500]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100122ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100122d0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x54
xor eax, eax
nop
mov dl, byte [edi + eax - 0x23aaae]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001232d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012310
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100123b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x66
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1139d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100123dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x100123c0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x44f64f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001272d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012710
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x267159c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001276d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012750
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10ea140]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001282d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012810
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x100128d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2035a70]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100128fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100128e0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x157e395]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012b3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x10012b20
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x44
xor eax, eax
nop
mov dl, byte [edi + eax - 0x118d64b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012dad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012d90
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1c03f0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012e7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012e60
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2efdb8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001300d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x10012ff0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x100130f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9a6c08]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001311d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10013100
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x22
xor eax, eax
nop
mov dl, byte [edi + eax - 0x153e223]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001326d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013250
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10013280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4a
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5960]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100132ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013290
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100133a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x18
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2348146]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100133cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100133b0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100133e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xa
xor eax, eax
nop
mov dl, byte [edi + eax - 0x270cf6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001340d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100133f0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x27
xor eax, eax
nop
mov dl, byte [edi + eax - 0xd9d908]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001344d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013430
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x4134fcc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001348d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013470
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100134a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x45
xor eax, eax
nop
mov dl, byte [edi + eax - 0x39db14a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100134cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x100134b0
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x100134e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 6
xor eax, eax
nop
mov dl, byte [edi + eax - 0x38cda7]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001350d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100134f0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x10013520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0xe7c0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001354d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10013530
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100137d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x382c4a4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100137fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100137e0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x66
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1496f8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013a4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10013a30
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4
Function at 0x100168c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1004b040]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x1004b6c8], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100027f0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10016924
test eax, 0x68000
jne 0x10016924
mov eax, dword [esp + 0x22]
test eax, eax
je 0x100169b0
cmp eax, 5
je 0x10016974
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100027f0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10016958
test eax, 0x68000
jne 0x10016958
mov ecx, dword [esp + 0x22]
jmp 0x1001695b
or ecx, 0xffffffff
mov eax, dword [0x1004b6c8]
add eax, ecx
add esi, eax
mov dword [0x1004b6c8], eax
cmp eax, 5
jl 0x100168e5
jmp 0x10016981
mov eax, dword [0x1004b6c8]
add eax, 4
mov dword [0x1004b6c8], eax
push eax
call fcn.1003b3b7
add esp, 4
mov dword [0x1004b6d0], eax
mov dword [0x1004b6cc], edi
push 0x40
push 0x3000
push dword [0x1004b6c8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100169c5
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1003af4e
mov esp, ebp
pop ebp
ret 8
push dword [0x1004b6c8]
push edi
push dword [0x1004b6d0]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x1004b6c8]
push dword [0x1004b6d0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x1004b6c8]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x1004b6c8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x1004b6c8], 5
mov cl, 5
jle 0x10016a51
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x1004b6c8]
jl 0x10016a40
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x1004b6c8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1003af4e
mov esp, ebp
pop ebp
ret 8
Function at 0x10025aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.10025840
mov ecx, dword [0x1004b8d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10025ae6
cmp byte [0x10f6c708], 0
je 0x10025ae6
push dword [0x10f6c384]
push dword [0x10f6c380]
push dword [0x10f6c37c]
push dword [0x10f6c378]
call fcn.100251e0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x10025b05
cmp byte [0x1004b6dc], 0
sete al
mov byte [0x1004b6dc], al
jmp 0x10025b0a
mov al, byte [0x1004b6dc]
test al, al
je 0x10025c8d
push 1
call esi
test al, 1
je 0x10025b23
mov byte [0x1004c6bc], 1
jmp 0x10025b32
push 1
call esi
test al, 1
jne 0x10025b32
mov byte [0x1004c6bc], 0
push 2
call esi
test al, 1
je 0x10025b43
mov byte [0x1004b6de], 1
jmp 0x10025b52
push 2
call esi
test al, 1
jne 0x10025b52
mov byte [0x1004b6de], 0
push 1
call esi
test ax, ax
je 0x10025b64
mov byte [0x1004c6be], 1
jmp 0x10025b72
push 1
call esi
test ax, ax
jne 0x10025b72
mov byte [0x1004c6be], al
push 2
call esi
test ax, ax
je 0x10025b84
mov byte [0x1004b6df], 1
jmp 0x10025b92
push 2
call esi
test ax, ax
jne 0x10025b92
mov byte [0x1004b6df], al
cmp byte [0x10f6c7a3], 0
je 0x10025bac
mov ecx, 0x1004b6c4
call fcn.100081c0
mov byte [0x10f6c7a3], 0
cmp byte [0x10f6c7a2], 0
je 0x10025bc6
mov ecx, 0x1004b6c4
call fcn.1000c850
mov byte [0x10f6c7a2], 0
push dword [0x10f6c374]
mov ecx, 0x1004b7e0
push dword [0x10f6c370]
push dword [0x10f6c36c]
push dword [0x10f6c368]
call fcn.1001f700
push dword [0x10f6ce04]
push dword [0x10f6cdfc]
call fcn.100360e0
mov ecx, dword [0x10f6c378]
test ecx, ecx
jns 0x10025c0b
xor ecx, ecx
mov dword [0x10f6c378], ecx
mov eax, dword [0x10f6c37c]
test eax, eax
jns 0x10025c1b
xor eax, eax
mov dword [0x10f6c37c], eax
mov edi, dword [0x1004b884]
mov ebx, edi
mov edx, dword [0x1004b880]
mov esi, edx
sub ebx, dword [0x10f6c384]
sub esi, dword [0x10f6c380]
cmp ecx, ebx
jle 0x10025c41
mov dword [0x10f6c378], ebx
cmp eax, esi
jle 0x10025c4b
mov dword [0x10f6c37c], esi
mov ecx, dword [0x10f6c368]
test ecx, ecx
jns 0x10025c5d
xor ecx, ecx
mov dword [0x10f6c368], ecx
mov eax, dword [0x10f6c36c]
test eax, eax
jns 0x10025c6d
xor eax, eax
mov dword [0x10f6c36c], eax
sub edi, dword [0x10f6c370]
sub edx, dword [0x10f6c374]
cmp ecx, edi
jle 0x10025c83
mov dword [0x10f6c368], edi
cmp eax, edx
jle 0x10025c8d
mov dword [0x10f6c36c], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2ce3d2e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10025e6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x19
jl 0x10025e50
pop edi
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret 4