joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10017810
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
lea eax, [ebp - 0x250]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x94
rep stosd dword es:[edi], eax
pop edi
pop eax
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 0xc]
call sub.KERNEL32.dll_FindFirstFileW
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x10017862
push 0x10067bfc
push dword [ebp + 8]
call fcn.10001640
add esp, 8
jmp 0x10017933
mov eax, dword [ebp + 0x10]
and eax, dword [ebp - 0x250]
test eax, eax
je 0x100178fb
mov eax, dword [ebp + 0x10]
and eax, 0x10
test eax, eax
je 0x100178d1
push 0x10067c70
lea eax, [ebp - 0x224]
push eax
call fcn.10059510
test eax, eax
sete al
shr eax, 1
sbb eax, eax
push 0x10069f18
lea ebx, [ebp - 0x224]
push ebx
mov ebx, eax
call fcn.10059510
test eax, eax
sete al
shr eax, 1
sbb eax, eax
or ebx, eax
je 0x100178d1
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x254]
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
jne 0x100178cf
jmp 0x10017918
jmp 0x10017913
push dword [ebp - 0x254]
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x250]
mov dword [eax], ebx
lea ebx, [ebp - 0x224]
push ebx
push dword [ebp + 8]
call fcn.10001640
add esp, 8
jmp 0x10017933
lea ebx, [ebp - 0x250]
push ebx
push dword [ebp - 0x254]
call sub.KERNEL32.dll_FindNextFileW
test eax, eax
jne 0x10017913
jmp 0x10017918
jmp 0x10017862
push dword [ebp - 0x254]
call sub.KERNEL32.dll_FindClose
push 0x10067bfc
push dword [ebp + 8]
call fcn.10001640
add esp, 8
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10017f00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push 0
push 5
push str.Open
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.100545d0
push 0
push 0xffffffffffffffff
push 0
push 1
call fcn.10054650
add esp, 8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.10054a10
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push 1
call fcn.10054650
add esp, 8
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x3c]
push eax
call fcn.10054890
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
call fcn.100545d0
push 0
push 7
push str._blank
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
call fcn.100545d0
push 0
push 0xffffffffffffffff
push 0
push 1
call fcn.10054650
add esp, 8
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
push eax
call fcn.10054a10
push 0
push 0xffffffffffffffff
push 0
push 1
call fcn.10054650
add esp, 8
push eax
lea eax, [0x1007758c]
push eax
call fcn.10059940
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push 0xffffffffffffffff
lea eax, [ebp - 0x30]
push eax
call fcn.100598c0
push dword [ebp - 0x40]
call fcn.1005a790
push 0
push dword [ebp + 8]
call fcn.1001baa0
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.SHELL32.dll_ShellExecuteA
call fcn.1001bad0
push 8
push dword [ebp + 8]
call fcn.1001baa0
lea eax, [ebp - 0x30]
push eax
call fcn.10055990
lea eax, [ebp - 0x24]
push eax
call fcn.10055990
lea eax, [ebp - 0x18]
push eax
call fcn.10055990
lea eax, [ebp - 0xc]
push eax
call fcn.10055990
mov esp, ebp
pop ebp
ret 8

Function at 0x100185d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10018609
mov dword [ebp - 4], 1
jmp 0x10018656
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
call fcn.10058f30
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp - 8]
call sub.KERNEL32.dll_WriteFile
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0xc], 0
jne 0x1001864f
mov dword [ebp - 4], 2
jmp 0x10018656
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x1001a980
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1001a9df
push 0
push 1
push 0x10066f2c
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.10054610
jmp 0x1001aab2
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
jne 0x1001aa1f
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GetFileSizeEx
test eax, eax
jne 0x1001aa1f
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
test eax, eax
sete al
shr eax, 1
sbb eax, eax
cmp dword [ebp - 0x1c], 0
seta bl
shr ebx, 1
sbb ebx, ebx
and eax, ebx
je 0x1001aa8e
push 0
push 0xffffffffffffffff
push 0
push dword [ebp - 0x1c]
call fcn.10055a20
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
call fcn.100545d0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
call fcn.10058f30
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x10]
call sub.KERNEL32.dll_ReadFile
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001aa8e
push 0
push 1
push 0x10066f2c
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
call fcn.100545d0
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.100545d0
lea eax, [ebp - 0x28]
push eax
call fcn.10055990
lea eax, [ebp - 0xc]
push eax
call fcn.10059150
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1001bb30
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 4], 0
lea eax, [ebp - 0x118]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x45
rep stosd dword es:[edi], eax
pop edi
pop eax
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.KERNEL32.dll_GetVersionExW
cmp dword [ebp - 0x108], 2
jne 0x1001bb84
cmp dword [ebp - 0x114], 5
jbe 0x1001bb84
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10033ae0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.10031990
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10033b1c
jmp 0x10033bc3
push dword [ebp - 0x10]
push 8
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapAlloc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10033b3a
jmp 0x10033bc3
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.10031990
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10033bb3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x10067d48
push dword [ebp - 0x14]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10033bb3
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov word [ebp - 0x18], bx
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 8]
and eax, 0xffff
mov word [ebp - 0x1c], ax
movzx eax, word [ebp - 0x18]
push eax
fild dword [esp]
add esp, 4
movzx eax, word [ebp - 0x1c]
push eax
fild dword [esp]
add esp, 4
fdiv qword [0x10069ca8]
fxch st(1)
faddp st(1)
fmul qword [0x10069ca8]
fistp dword [ebp - 4]
push dword [ebp - 0x14]
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100342d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push 0
push 0
push 0xe
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageW
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.1005acd0
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.100316c0
add esp, 8
push dword [ebp - 0x18]
call fcn.1005a790
lea eax, [ebp - 0x14]
push eax
call fcn.10031930
push eax
mov eax, dword [ebp - 4]
inc eax
mov ebx, eax
push ebx
push 0xd
push dword [ebp + 0xc]
call sub.USER32.dll_SendMessageW
lea ebx, [ebp - 0x14]
push ebx
call fcn.10031960
add eax, 0xffffffff
mov ebx, eax
push ebx
lea ebx, [ebp - 0x14]
push ebx
call fcn.10031930
push eax
call fcn.1005aae0
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebp + 8]
call fcn.100316c0
add esp, 8
push dword [ebp - 0x1c]
call fcn.1005a790
lea eax, [ebp - 0x14]
push eax
call fcn.100318d0
add esp, 4
jmp 0x10034378
mov eax, dword [ebp + 8]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x100350b0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov byte [ebp - 4], 0
push 0
push dword [ebp + 8]
call fcn.10031990
push eax
call sub.KERNEL32.dll_CreateDirectoryW
not eax
cmp eax, 0
setne bl
mov byte [ebp - 4], bl
mov al, byte [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100350e0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
mov byte [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.10031990
push eax
push dword [ebp + 8]
call fcn.10031990
push eax
call sub.KERNEL32.dll_MoveFileW
cmp eax, 0
setne bl
mov byte [ebp - 4], bl
mov al, byte [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10035750
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x254]
push eax
push edi
mov edi, eax
xor eax, eax
mov ecx, 0x94
rep stosd dword es:[edi], eax
pop edi
pop eax
push dword [ebp + 8]
call fcn.1005ab60
test eax, eax
jne 0x10035787
jmp 0x10035900
lea eax, [ebp - 0x254]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_FindFirstFileW
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x100357aa
jmp 0x10035900
push dword [ebp - 0x258]
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x254]
and eax, 0x10
cmp eax, 0x10
sete bl
shr ebx, 1
sbb ebx, ebx
mov eax, dword [ebp - 0x254]
and eax, 0x100
cmp eax, 0x100
sete cl
shr ecx, 1
sbb ecx, ecx
or ebx, ecx
je 0x100357e8
jmp 0x10035900
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x268], 0
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileW
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xffffffff
jne 0x1003583e
jmp 0x10035900
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x26c]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x264], 0
je 0x1003586f
push dword [ebp - 0x26c]
call sub.KERNEL32.dll_CloseHandle
jmp 0x10035900
mov dword [ebp - 0x270], 0
push dword [ebp - 0x260]
push 1
call sub.msvcrt.dll_calloc
add esp, 8
mov dword [ebp - 0x270], eax
push 0
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x260]
push dword [ebp - 0x270]
push dword [ebp - 0x26c]
call sub.KERNEL32.dll_ReadFile
mov dword [ebp - 0x25c], eax
push dword [ebp - 0x26c]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x25c], 0
je 0x10035900
cmp dword [ebp - 0x270], 0
je 0x10035900
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x260]
push dword [ebp - 0x270]
call fcn.100353e0
mov dword [ebp - 4], eax
push dword [ebp - 0x270]
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100477c0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov dword [ebp - 4], 0
push 3
push 0x10066f30
call fcn.100590d0
push eax
push dword [ebp + 8]
push 1
call fcn.10058ae0
mov dword [ebp - 8], eax
push 0
push 0xffffffffffffffff
cmp dword [ebp - 8], 0
jne 0x1004780c
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100591c0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call fcn.10054610
jmp 0x10047833
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
add eax, 3
push eax
push dword [ebp + 8]
call fcn.10058f90
push eax
call fcn.100591c0
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20]
push eax
call fcn.10054610
lea eax, [ebp - 0x20]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
call fcn.10054610
lea eax, [ebp - 0x20]
push eax
call fcn.10055990
push 3
push 0x10069f30
call fcn.100590d0
push eax
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.10058be0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1004788a
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
dec eax
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10058e10
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
call fcn.100545d0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
push dword [ebp - 0x14]
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x100478e2
push dword [ebp - 0x14]
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x100478d3
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.10055990
jmp 0x100478f1
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebx]
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
jmp 0x100478e8
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
lea ebx, [ebp - 0x14]
push ebx
call fcn.10055990
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10053b00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
sub esp, 0x10
mov eax, dword [0x1006b618]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x9908b0df
test eax, eax
je 0x10053c1a
cmp eax, 0x1006bfdc
jae 0x10053b5d
mov ebx, dword [eax]
mov edx, ebx
add eax, 4
shr edx, 0xb
mov dword [0x1006b618], eax
add esp, 0x10
xor edx, ebx
pop ebx
mov eax, edx
shl eax, 7
and eax, 0x9d2c5680
xor edx, eax
mov eax, edx
shl eax, 0xf
and eax, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
ret
xor eax, eax
nop
mov ecx, dword [eax*4 + 0x1006b61c]
add eax, 1
mov edx, dword [eax*4 + 0x1006b61c]
and ecx, 0x80000000
and edx, 0x7fffffff
or edx, ecx
mov ecx, edx
and edx, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x1006bc4c]
xor ecx, dword [esp + edx*4 + 8]
mov dword [eax*4 + 0x1006b618], ecx
cmp eax, 0xe3
jne 0x10053b60
nop
mov ecx, dword [eax*4 + 0x1006b61c]
add eax, 1
mov edx, dword [eax*4 + 0x1006b61c]
and ecx, 0x80000000
and edx, 0x7fffffff
or edx, ecx
mov ecx, edx
and edx, 1
shr ecx, 1
xor ecx, dword [eax*4 + 0x1006b28c]
xor ecx, dword [esp + edx*4 + 8]
mov dword [eax*4 + 0x1006b618], ecx
cmp eax, 0x26f
jne 0x10053ba0
mov ebx, dword [0x1006b61c]
mov ecx, dword [0x1006bfd8]
mov eax, ebx
and ecx, 0x80000000
and eax, 0x7fffffff
or ecx, eax
mov eax, ecx
and ecx, 1
shr eax, 1
xor eax, dword [0x1006bc4c]
xor eax, dword [esp + ecx*4 + 8]
mov dword [0x1006bfd8], eax
mov eax, 0x1006b61c
jmp 0x10053b2a
mov eax, 0x50000
xor edx, edx
call fcn.10053a90
mov eax, dword [0x1006b618]
jmp 0x10053b21

Function at 0x100541a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, dword [0x1006b618]
cmp eax, 0x1006bfdc
je 0x100541c0
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [0x1006b618], edx
ret
push ebx
sub esp, 0x38
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
sub esp, 0x14
cmp eax, 1
je 0x10054228
mov dword [esp + 8], 3
fld1
fchs
fstp qword [esp]
call fcn.10053e00
sub esp, 0xc
call fcn.10053b00
add esp, 0x38
pop ebx
ret
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], 0x1006b61c
mov dword [esp + 4], 0x9c0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
test ebx, ebx
je 0x10054201
mov eax, 0x1006b61c
lea edx, [eax + 4]
mov eax, dword [eax]
mov dword [0x1006b618], edx
jmp 0x1005421d
Function at 0x1005b410
Capabilities:
Create thread

Disassembly:
push esi
push ebx
sub esp, 0x34
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov ebx, eax
test eax, eax
je 0x1005b487
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
mov esi, eax
test eax, eax
je 0x1005b4ac
mov eax, dword [esp + 0x40]
mov dword [ebx + 4], 0
mov dword [esi + 8], ebx
mov dword [esi], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], 0
mov dword [esi + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1005b380
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov dword [ebx], eax
test eax, eax
je 0x1005b498
add esp, 0x34
mov eax, ebx
pop ebx
pop esi
ret 0xc
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_free
mov dword [esp], esi
call sub.msvcrt.dll_free
jmp 0x1005b487
mov dword [esp], ebx
xor ebx, ebx
call sub.msvcrt.dll_free
jmp 0x1005b487

Function at 0x1005b540
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
mov eax, dword [esi*4 + 0x100793c0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
test eax, eax
je 0x1005b570
add esp, 0x14
mov eax, ebx
pop ebx
pop esi
ret 0xc
mov eax, dword [esp + 0x24]
mov dword [esp], 1
add eax, 4
mov dword [esp + 4], eax
call sub.msvcrt.dll_calloc
mov ebx, eax
test eax, eax
je 0x1005b562
mov eax, dword [esp + 0x28]
add ebx, 4
mov dword [ebx - 4], eax
mov eax, dword [esi*4 + 0x100793c0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, ebx
sub esp, 8
add esp, 0x14
pop ebx
pop esi
ret 0xc

Function at 0x1005b5c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx*4 + 0x100793c0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
je 0x1005b612
mov edx, dword [eax - 4]
lea esi, [eax - 4]
test edx, edx
je 0x1005b5ef
mov dword [esp], eax
call edx
mov dword [esp], esi
call sub.msvcrt.dll_free
mov eax, dword [ebx*4 + 0x100793c0]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
add esp, 0x14
pop ebx
pop esi
ret 4
Function at 0x1005d700
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
test dword [esp + 0x4c], 0x100
je 0x1005d723
mov ebx, edi
test bl, bl
je 0x1005d758
cmp si, 0x58
jbe 0x1005d790
mov eax, dword [esp + 0x50]
test eax, eax
je 0x1005d740
mov ebx, 0xffffffff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edi
movzx ebx, al
test al, al
je 0x1005d731
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, esi
mov edx, 0x1c
xor eax, eax
jmp 0x1005d773
lea edx, [eax + eax*4]
movzx edx, word [edx + edx + 0x10071700]
cmp cx, dx
je 0x1005d840
add eax, 1
cmp eax, 0xc
jne 0x1005d768
jmp 0x1005d731
movzx esi, si
movzx eax, ax
mov dword [esp + 4], 2
lea ecx, [esi*8 + 0x10071420]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ebp, ax
sub esp, 8
mov dword [esp], ebp
mov ebx, ebp
call dword [sym.imp.msvcrt.dll_isupper]
mov dword [esp], ebp
test eax, eax
jne 0x1005d820
call dword [sym.imp.msvcrt.dll_islower]
mov ecx, eax
mov eax, ebp
test ecx, ecx
je 0x1005d7e1
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll_toupper]
test byte [esp + 0x4c], 3
je 0x1005d82d
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 6]
cmp ebx, 0xff
jle 0x1005d729
mov ecx, edi
movzx ecx, cl
cmp ecx, ebp
je 0x1005d80d
cmp eax, ecx
jne 0x1005d729
or bl, 0xff
add esp, 0x2c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.msvcrt.dll_tolower]
test byte [esp + 0x4c], 3
jne 0x1005d7e8
test byte [esp + 0x4c], 0xc
je 0x1005d880
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 4]
jmp 0x1005d7f0
lea eax, [eax + eax*4]
lea eax, [eax + eax + 0x10071700]
test byte [esp + 0x4c], 3
jne 0x1005d8a0
test byte [esp + 0x4c], 0xc
je 0x1005d8c0
movzx ebx, word [eax + 6]
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x1005d731
cmp ebx, 0xff
jle 0x1005d736
or bl, 0xff
jmp 0x1005d810
test byte [esp + 0x4c], 0x10
jne 0x1005d8b0
mov ecx, edi
test cl, cl
jne 0x1005d7f0
movzx ebx, word [esi*8 + 0x10071420]
jmp 0x1005d7f0
movzx ebx, word [eax + 8]
xor eax, eax
test ebx, ebx
setne al
jmp 0x1005d863
mov esi, dword [esp + 0x1c]
movzx ebx, word [esi + 2]
jmp 0x1005d7f0
test byte [esp + 0x4c], 0x10
je 0x1005d8d4
movzx ebx, word [eax + 4]
xor eax, eax
test ebx, ebx
setne al
jmp 0x1005d863
movzx ebx, word [eax + 2]
jmp 0x1005d86b