joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4069d4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x410b08], esi
push edi
jne 0x4069f4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x410b04], esi
mov byte [0x410b00], al
jne 0x406a5a
mov ecx, dword [0x412008]
test ecx, ecx
je 0x406a3b
mov eax, dword [0x412004]
sub eax, 4
cmp eax, ecx
jmp 0x406a34
mov eax, dword [eax]
test eax, eax
je 0x406a26
call eax
mov eax, dword [0x412004]
sub eax, 4
cmp eax, dword [0x412008]
mov dword [0x412004], eax
jae 0x406a1e
mov eax, 0x40e028
mov esi, 0x40e030
cmp eax, esi
mov edi, eax
jae 0x406a5a
mov eax, dword [edi]
test eax, eax
je 0x406a53
call eax
add edi, 4
cmp edi, esi
jb 0x406a4b
mov eax, 0x40e034
mov esi, 0x40e03c
cmp eax, esi
mov edi, eax
jae 0x406a79
mov eax, dword [edi]
test eax, eax
je 0x406a72
call eax
add edi, 4
cmp edi, esi
jb 0x406a6a
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x406a93
push dword [ebp + 8]
mov dword [0x410b08], 1
call fcn.0040693a
pop ebp
ret

Function at 0x4076ca
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x40fbe0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40fc48]
je 0x4076ff
inc eax
cmp eax, 0x13
jb 0x4076f0
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40fc48]
jne 0x407825
mov eax, dword [0x410a48]
cmp eax, 1
je 0x4077fd
cmp eax, edx
jne 0x40772f
cmp dword [0x40fc04], 1
je 0x4077fd
cmp ecx, 0xfc
je 0x407825
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407765
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00408110
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00404940
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x407799
mov eax, edi
push eax
call fcn.00404940
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b6fc
push edi
call fcn.00408310
add esp, 0x10
push edi
call fcn.00404940
push dword [esi + 0x40fc4c]
mov ebx, eax
call fcn.00404940
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00404660
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00408110
push edi
push ebx
call fcn.00408120
push 0x40b6f8
push ebx
call fcn.00408120
push dword [esi + 0x40fc4c]
push ebx
call fcn.00408120
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00408208
add esp, 0x2c
jmp 0x407825
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40fc4c]
push dword [esi]
call fcn.00404940
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00403cf4
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x408208
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x410c48], ebx
push esi
push edi
jne 0x408288
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4082c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x410c48], eax
je 0x4082c3
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x410c4c], eax
call esi
cmp dword [0x410ac8], 2
mov dword [0x410c50], eax
jne 0x408288
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x410c58], eax
je 0x408288
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x410c54], eax
mov eax, dword [0x410c54]
test eax, eax
je 0x4082cd
call eax
test eax, eax
je 0x4082b4
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x410c58]
test eax, eax
je 0x4082b4
test byte [ebp - 8], 1
jne 0x4082cd
cmp dword [0x410ad4], 4
jb 0x4082c7
or byte [ebp + 0x12], 0x20
jmp 0x4082ec
xor eax, eax
jmp 0x4082fc
or byte [ebp + 0x12], 4
jmp 0x4082ec
mov eax, dword [0x410c4c]
test eax, eax
je 0x4082ec
call eax
mov ebx, eax
test ebx, ebx
je 0x4082ec
mov eax, dword [0x410c50]
test eax, eax
je 0x4082ec
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x410c48]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408528
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x411ee4]
mov eax, dword [0x40fbe0]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x4086ee
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x411f00]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x4086ee
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x408592
xor eax, eax
jmp 0x408702
test al, 0x20
je 0x4085a3
push 2
push edi
push edi
push ecx
call fcn.004093cb
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x408678
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x4086bf
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x408605
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4085f6
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x4085d8
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408645
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x408651
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x4085cc
jmp 0x408653
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x4086e9
cmp dword [ebp + 0x3a4], edi
je 0x4086bf
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x4086b1
mov dword [0x410ac0], eax
jmp 0x4086f5
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4086a3
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x408653
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x408653
push dword [ebp + 0x3a4]
call fcn.004092b6
pop ecx
jmp 0x4086ff
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4086d7
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x40858b
mov dword [0x410abc], 0x1c
mov dword [0x410ac0], edi
jmp 0x4086ff
sub eax, dword [ebp - 0x7c]
jmp 0x408702
and dword [0x410ac0], 0
mov dword [0x410abc], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.00403cf4
add ebp, 0x39c
leave
ret
Function at 0x4097df
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00404660
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40987a
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x410ac8]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40987a
cmp eax, 1
je 0x40989b
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40987a
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x409847
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x409876
xor eax, eax
inc eax
jmp 0x4098ba
cmp edi, eax
jae 0x40987e
xor eax, eax
jmp 0x4098ba
cmp eax, esi
jae 0x409885
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x410ac8]
jmp 0x40989e
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e34ac6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp ax, 0x5a0b
cmp ebp, eax
jmp 0x1e35052
Function at 0x1001bdc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cd080
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100f9080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.100a1388
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1009fdae
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1001bd60
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002ef50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdbad
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f9080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0xf
jbe 0x1002ef87
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1002efa5
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1002ef93
push esi
push edx
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
call fcn.1002fcf0
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002efd6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x3ffffff
je 0x1002f12c
lea eax, [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
push 0x40
mov dword [ebp - 0x1c], 0
call fcn.100a1388
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.1000b850
mov edx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0x1c]
mov dword [edi + 0x20], eax
lea eax, [edx + 0x20]
mov dword [edi + 0x24], ecx
lea ecx, [edi + 0x28]
push eax
call fcn.1000b850
mov dword [ebp - 4], 2
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ee410]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x100ee410]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1002f0ce
divss xmm0, xmm3
call fcn.1001e060
call fcn.100c9350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1002f0b2
cmp eax, 0x200
jae 0x1002f0b0
shl eax, 3
cmp eax, ecx
jae 0x1002f0b2
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1002f4d0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1002fcf0
mov edx, dword [eax]
jmp 0x1002f0d1
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1002f0f9
mov dword [ecx + eax*8], edi
jmp 0x1002f10b
cmp esi, edx
jne 0x1002f102
mov dword [ecx + eax*8], edi
jmp 0x1002f10f
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1002f10f
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1009fb1e
int3
Function at 0x1002f140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100cdbe5
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x100f9080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 0xf
jbe 0x1002f177
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x1002f195
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x1002f183
push esi
push edx
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.1002fcf0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1002f1c6
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x7ffffff
je 0x1002f2f8
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push 0x20
mov dword [ebp - 0x18], 0
call fcn.100a1388
add esp, 4
mov edi, eax
mov dword [ebp - 0x18], edi
push dword [ebp + 0xc]
lea ecx, [edi + 8]
call fcn.1000b850
mov dword [ebp - 4], 1
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ee410]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x100ee410]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x1002f29a
divss xmm0, xmm3
call fcn.1001e060
call fcn.100c9350
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x1002f27e
cmp eax, 0x200
jae 0x1002f27c
shl eax, 3
cmp eax, ecx
jae 0x1002f27e
mov eax, ecx
push eax
mov ecx, ebx
call fcn.1002f6c0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002fcf0
mov edx, dword [eax]
jmp 0x1002f29d
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
inc dword [ebx + 8]
mov dword [edi + 4], eax
mov dword [edi], edx
mov dword [eax], edi
mov dword [edx + 4], edi
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 0x18]
and eax, esi
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x1002f2c5
mov dword [ecx + eax*8], edi
jmp 0x1002f2d7
cmp esi, edx
jne 0x1002f2ce
mov dword [ecx + eax*8], edi
jmp 0x1002f2db
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x1002f2db
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.1009fb1e
int3
Function at 0x1002f9a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, eax
je 0x1002fb13
cmp dword [edx + 0x1c], 0xf
mov eax, dword [ecx + 4]
push esi
mov dword [ebp - 0x18], eax
mov esi, edx
mov eax, dword [ecx + 0xc]
push edi
mov dword [ebp - 0x14], eax
lea edi, [edx + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
jbe 0x1002f9db
mov edi, dword [edi]
xor edx, edx
push ebx
mov ebx, 0x811c9dc5
test eax, eax
je 0x1002fa04
mov ecx, eax
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1002f9f0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, ebx
lea eax, [ecx + eax*8]
mov ecx, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
nop dword [eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.1002f310
push 0x40
push edi
call fcn.100a16d2
mov eax, dword [ebp - 4]
add esp, 8
dec dword [eax + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1002fa6d
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x1002fa20
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1002fb08
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
jne 0x1002fa7f
mov eax, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x1002fa82
mov eax, dword [ebp - 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp esi, eax
je 0x1002fb08
nop dword [eax]
cmp dword [esi + 0x1c], 0xf
lea edx, [esi + 8]
mov ebx, dword [edx + 0x10]
jbe 0x1002fa9e
mov edx, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x1002fac1
nop dword [eax]
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x1002fab0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0x14]
and eax, edi
lea eax, [ecx + eax*8]
mov dword [ebp + 8], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea edx, [edi + 8]
call fcn.1002f310
push 0x40
push edi
call fcn.100a16d2
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [ecx + 8]
cmp ebx, dword [ebp - 0x1c]
je 0x1002fb19
cmp esi, eax
jne 0x1002fad8
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x18]
mov dword [ecx], edi
mov dword [ecx + 4], edi
cmp esi, eax
jne 0x1002fa90
mov ecx, dword [ebp - 8]
pop ebx
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10036270
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x100f9080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov esi, ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1003630f
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10036308
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax + eax]
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100362d0
sub eax, edx
mov ecx, esi
cmp dword [esi + 0x14], 0xf
jbe 0x100362e3
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.1001ded0
add esp, 8
test al, al
jne 0x10036322
lea eax, [ebp - 0x130]
push eax
push edi
call ebx
test eax, eax
jne 0x100362c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a137a
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x128]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10036308
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10036364
call esi
push edi
call esi
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a137a
mov esp, ebp
pop ebp
ret
call esi
push edi
call esi
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a137a
mov esp, ebp
pop ebp
ret
Function at 0x10036380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100f9080]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1018ab66], 0
push esi
push edi
mov dword [ebp - 0x24], ecx
jne 0x100363f2
mov ecx, dword [ecx]
xor eax, eax
cmp dword [eax*8 + 0x100dce9c], ecx
je 0x100363cd
inc eax
cmp eax, 0x86
jb 0x100363b5
mov ecx, str.Unknown
jmp 0x100363d4
mov ecx, dword [eax*8 + 0x100dce98]
push 0
call fcn.1008a9f0
add esp, 4
test al, al
je 0x10036566
mov byte [0x1018ab66], 1
jmp 0x1003655c
mov dword [ebp - 0x30], 0x6e31ba49
mov dword [ebp - 0x2c], 0x947f64ba
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x38a2ee8c
mov dword [ebp - 0x2c], 0x8ebfd9eb
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], 0x6e1f9467
mov dword [ebp - 0x2c], 0x947f64ba
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x38a2ee8c
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], 0x8ebfd9eb
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
movaps xmm1, xmmword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x38], eax
xorps xmm1, xmmword [ebp - 0x40]
push 0
movaps xmmword [ebp - 0x20], xmm1
call fcn.1008a9f0
mov eax, dword [0x1018ab68]
add esp, 4
inc eax
mov dword [0x1018ab68], eax
cmp eax, 3
jle 0x10036566
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
nop
push esi
call edi
test ax, ax
js 0x100364b4
inc esi
cmp esi, 0x100
jl 0x10036490
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a137a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp esi, 0x10
jne 0x100364ea
push 0xa0
call edi
test ax, ax
jns 0x100364d3
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa0
jmp 0x10036555
push 0xa1
call edi
test ax, ax
jns 0x10036555
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa1
jmp 0x10036555
cmp esi, 0x11
jne 0x1003651d
push 0xa2
call edi
test ax, ax
jns 0x10036506
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa2
jmp 0x10036555
push 0xa3
call edi
test ax, ax
jns 0x10036555
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa3
jmp 0x10036555
cmp esi, 0x12
jne 0x10036550
push 0xa4
call edi
test ax, ax
jns 0x10036539
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa4
jmp 0x10036555
push 0xa5
call edi
test ax, ax
jns 0x10036555
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa5
jmp 0x10036555
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
mov byte [0x1018ab66], 0
mov dword [0x1018ab68], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100a137a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret