joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf03a246
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03a290
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03a290
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03a27c
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b018], esi
je 0xf03a298
call fcn.0f03a174
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0xf03a29e
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03a2fe
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03a2af
mov ebx, dword [ebp + 0x10]
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf03a2fd
cmp dword [ebp - 8], ebx
jne 0xf03a2fd
cmp dword [0xf09b018], esi
je 0xf03a2ef
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
add dword [ebp + 0x14], ebx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03a2f2
add dword [ebp + 0xc], ebx
sub dword [ebp + 0x10], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03a2a7
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03a292

Function at 0xf03a308
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03a3c2
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03a3c2
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03a346
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b018], esi
je 0xf03a35a
call fcn.0f03a174
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0xf03a3c2
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03a3bd
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03a36b
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b018], esi
je 0xf03a38d
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03a393
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf03a3bc
cmp dword [ebp - 8], ebx
jne 0xf03a3bc
sub dword [ebp + 0x10], ebx
add dword [ebp + 0x14], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03a363
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03a3c4
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03b069
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0096c9
test eax, eax
jne 0xf03b198
push edi
push 0x3c
call fcn.0f030e00
test eax, eax
jne 0xf03b0a4
push 0x3e
call fcn.0f030e00
test eax, eax
je 0xf03b0ff
mov edi, 0xf0641d0
push edi
call fcn.0f03a64c
call fcn.0f0096b7
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0096c9
test eax, eax
jne 0xf03b0f7
push edi
call fcn.0f03a628
call fcn.0f0096b7
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0096c9
test eax, eax
jne 0xf03b0f7
push edi
call fcn.0f03a64c
call fcn.0f0096b7
push 0x14
call esi
push 0xffffffffffffffff
call fcn.0f0096c9
test eax, eax
je 0xf03b0ff
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.0f031fd1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
je 0xf03b119
mov dword [ebp - 4], 0x80
push 0x90
call esi
test al, 1
mov edi, dword [ebp - 4]
je 0xf03b12a
or edi, 0x20
push 0x91
call esi
test al, 1
je 0xf03b138
or edi, 0x40
mov eax, dword [0xf064200]
xor eax, edi
test al, al
jns 0xf03b154
mov esi, 0xf0641b0
push esi
call fcn.0f03a628
push esi
call fcn.0f03a64c
mov eax, dword [0xf064200]
xor eax, edi
test al, 0x20
je 0xf03b170
mov esi, 0xf0641e0
push esi
call fcn.0f03a628
push esi
call fcn.0f03a64c
mov eax, dword [0xf064200]
xor eax, edi
test al, 0x40
je 0xf03b18c
mov esi, 0xf0641f0
push esi
call fcn.0f03a628
push esi
call fcn.0f03a64c
mov dword [0xf064200], edi
call fcn.0f0096b7
pop edi
pop esi
leave
ret

Function at 0xf03b416
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf06bb04], esi
je 0xf03b429
pop esi
jmp fcn.0f034856
cmp dword [0xf064204], 1
jne 0xf03b492
cmp dword [0xf063a68], esi
je 0xf03b492
cmp dword [0xf070698], esi
jne 0xf03b492
push 0xf09b50c
push dword [0xf09b460]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0xf03b472
push 0x7a7
push 0xf0024c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f03446f
call fcn.0f01f703
movzx eax, word [0xf06a9a4]
movzx ecx, word [0xf06a9b0]
shl eax, 4
push 2
add eax, ecx
push eax
call fcn.0f00f563
call fcn.0f0097ee
and byte [0xf0708c2], 0xfd
call fcn.0f014e9b
call fcn.0f035643
push esi
push dword [0xf09b5e4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0f03216e
call fcn.0f032c3a
cmp dword [0xf09b490], 2
je 0xf03b4d8
call fcn.0f035fe9
push dword [0xf09b4fc]
call fcn.0f00974b
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [0xf06bb04], esi
jne 0xf03b4ea
call fcn.0f03a9cd
call fcn.0f0162eb
push dword [0xf09b004]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
Function at 0xf03b7d7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0xf0708e0
jne 0xf03b7ef
mov edi, 0xf0708e4
mov eax, dword [edi]
test eax, eax
mov ebx, dword [ebp + 0xc]
jne 0xf03b877
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0xf03b814
mov al, byte [eax + ebx - 1]
cmp al, byte [0xf06420c]
je 0xf03b83f
mov eax, 0xf06420c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03b81b
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03b827
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 8], 0
mov eax, str.config.nt
jne 0xf03b84f
mov eax, str.autoexec.nt
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03b851
sub eax, edx
dec ebx
mov edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03b85d
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0xf03b89a
mov esi, 0x110
push esi
push ebx
push eax
call fcn.0f00e18c
test eax, eax
je 0xf03b88c
cmp eax, esi
jbe 0xf03b88f
mov byte [ebx], 0
push dword [edi]
call fcn.0f00579c
and dword [edi], 0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0xf03c64d
Capabilities:
Resume thread
Suspend thread

Disassembly:
push 0xc
push 0xf0025d0
call fcn.0f01b5a4
and dword [ebp - 0x1c], 0
xor edi, edi
inc edi
mov dword [0xf0708f4], edi
and dword [ebp - 4], 0
call fcn.0f0040f6
push dword [0xf09b5e0]
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
call esi
or ebx, 0xffffffff
cmp eax, ebx
je 0xf03c6f3
cmp dword [0xf06bb04], 0
jne 0xf03c699
push dword [0xf09b7b0]
call esi
cmp eax, ebx
je 0xf03c6f3
mov dword [0xf09ae48], edi
cmp dword [0xf09b490], edi
jne 0xf03c6ae
call fcn.0f03c5da
jmp 0xf03c6bb
push dword [0xf070618]
push 0
call fcn.0f03bfc5
and dword [0xf09ae48], 0
cmp dword [0xf06bb04], 0
jne 0xf03c6db
push dword [0xf09b7b0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03c6f3
push dword [0xf09b5e0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03c6f3
call fcn.0f0040e5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0xf03c703
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0xf03c73f
cmp dword [0xf0708f4], esi
je 0xf03c724
push dword [0xf09ae40]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0xf0708f4], esi
push 0x215
push 0xf00258c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f03446f
mov dword [0xf0708f4], esi
call fcn.0f01b5df
ret
Function at 0xf03c750
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [0xf09ae38]
test esi, esi
mov dword [ebp + 0xc], ecx
je 0xf03c789
mov dx, word [ebp + 8]
cmp word [esi + 8], dx
jne 0xf03c77e
cmp ecx, dword [esi]
jne 0xf03c77e
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 4]
je 0xf03c785
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03c76c
test esi, esi
jne 0xf03c79b
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03c87a
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
add ecx, 0xfff40000
mov dword [ebp - 8], ecx
movzx ecx, dx
sub ecx, 0xfffa
push ebx
mov dword [ebp + 8], eax
je 0xf03c7f1
dec ecx
dec ecx
je 0xf03c7d0
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03c879
push 0x40
push 0x1000
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03c866
push 0xe
jmp 0xf03c7c3
shr eax, 0xc
mov ebx, eax
mov dword [ebp + 8], 0x1000
jmp 0xf03c81b
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03c85f
add ebx, 0xffff
add dword [ebp + 0xc], 0x1000
test bx, bx
ja 0xf03c7ff
mov eax, dword [esi]
push 0x40
push 0x40000000
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jge 0xf03c866
push 5
jmp 0xf03c7c3
push dword [esi + 4]
mov word [esi + 8], 0xfffd
push dword [esi]
call fcn.0f04f759
xor eax, eax
inc eax
pop ebx
pop esi
leave
ret 0xc
Function at 0xf03c884
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0xf09ae38]
test edi, edi
mov dword [ebp + 8], edx
je 0xf03c8c7
mov eax, dword [ebp + 0xc]
cmp word [edi + 8], 0xfffa
jne 0xf03c8bc
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea esi, [edx + eax]
add ebx, ecx
cmp ebx, esi
jb 0xf03c8bc
cmp ecx, esi
jbe 0xf03c8c3
mov edi, dword [edi + 0x10]
test edi, edi
jne 0xf03c8a2
test edi, edi
jne 0xf03c8d1
push 0x1e7
jmp 0xf03c97f
mov ecx, edx
sub ecx, dword [edi]
and dword [ebp - 8], 0
xor ebx, ebx
shr ecx, 0xc
inc ebx
shr eax, 0xc
add edx, 0xfff40000
shl ebx, cl
test ax, ax
mov esi, 0x1000
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], edx
jbe 0xf03c96f
test dword [edi + 0xc], ebx
jne 0xf03c920
push 0x40
push esi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jl 0xf03c97d
or dword [edi + 0xc], ebx
jmp 0xf03c959
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03c979
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03c97d
add dword [ebp + 0xc], 0xffff
add dword [ebp - 0xc], esi
add dword [ebp + 8], esi
shl ebx, 1
cmp word [ebp + 0xc], 0
ja 0xf03c8fd
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
jmp 0xf03c97f
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03c972
Function at 0xf03c98e
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0xf09ae38]
test esi, esi
push edi
mov dword [ebp + 8], eax
je 0xf03c9d1
mov ecx, dword [ebp + 0xc]
cmp word [esi + 8], 0xfffa
jne 0xf03c9c6
mov edx, dword [esi]
mov ebx, dword [esi + 4]
lea edi, [eax + ecx]
add ebx, edx
cmp ebx, edi
jb 0xf03c9c6
cmp edx, edi
jbe 0xf03c9cd
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03c9ac
test esi, esi
jne 0xf03c9db
push 0x1e7
jmp 0xf03ca61
shr ecx, 0xc
mov dword [ebp + 0xc], ecx
mov ebx, 0x1000
mov ecx, eax
mov dword [ebp - 4], ebx
sub ecx, dword [esi]
and dword [ebp - 8], 0
xor edi, edi
shr ecx, 0xc
inc edi
shl edi, cl
sub eax, dword [esi]
mov dword [ebp - 0xc], eax
jmp 0xf03ca4e
test dword [esi + 0xc], edi
je 0xf03ca3f
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03ca5f
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03ca5f
add dword [ebp - 0xc], ebx
add dword [ebp + 8], ebx
add dword [ebp + 0xc], 0xffff
shl edi, 1
cmp word [ebp + 0xc], 0
ja 0xf03ca00
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03ca58
Function at 0xf03caae
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub ebx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
je 0xf03cb0a
push 0x14
call fcn.0f006f83
mov edi, eax
test edi, edi
pop ecx
jne 0xf03cae6
push 0xe
jmp 0xf03cbea
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov ecx, dword [ebp + 0xc]
or word [edi + 8], 0xffff
add ecx, edx
mov dword [edi], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
sub dword [esi + 4], eax
mov dword [esi + 0x10], edi
jmp 0xf03cb0d
mov edi, dword [ebp + 0x14]
test ebx, ebx
jbe 0xf03cb47
push 0x14
call fcn.0f006f83
test eax, eax
pop ecx
mov dword [ebp - 8], eax
je 0xf03cadf
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov cx, word [ebp + 0x14]
mov word [eax + 8], cx
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x10], ecx
or word [esi + 8], 0xffff
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
jmp 0xf03cb4f
mov ax, word [ebp + 0x14]
mov word [esi + 8], ax
push dword [esi]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cbe8
xor ecx, ecx
cmp ebx, ecx
mov ebx, dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [ebp - 0xc], ecx
jbe 0xf03cbab
mov eax, dword [esi + 4]
mov esi, dword [esi]
push 0x40
push 0x40000000
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
mov dword [ebp + 0xc], esi
add esi, 0xfff40000
mov dword [ebp - 0x10], esi
call ebx
test eax, eax
jl 0xf03cbe8
xor ecx, ecx
cmp dword [ebp - 4], ecx
jbe 0xf03cbf4
mov eax, dword [edi]
push 0x40
mov dword [ebp + 0xc], eax
add eax, 0xfff40000
push 0x40000000
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
call ebx
test eax, eax
jge 0xf03cbf4
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cbf7
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03cc03
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
push esi
push edi
je 0xf03cc3e
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp word [eax + 8], 0xffff
jne 0xf03cc33
mov ecx, dword [eax]
cmp ecx, edx
ja 0xf03cc33
mov edi, dword [eax + 4]
add edi, ecx
lea ecx, [edx + esi]
cmp edi, ecx
jae 0xf03cc3a
mov eax, dword [eax + 0x10]
test eax, eax
jne 0xf03cc19
test eax, eax
jne 0xf03cc4d
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03ccbb
push 0xfffa
push esi
push edx
push eax
call fcn.0f03caae
test eax, eax
je 0xf03cc49
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
shr esi, 0xc
mov edi, esi
mov esi, 0x1000
add eax, 0xfff40000
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
jmp 0xf03ccb3
push 0x40
push 0x40000000
push 2
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09ae34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03cc49
add dword [ebp + 8], esi
add edi, 0xffff
add dword [ebp - 8], esi
test di, di
ja 0xf03cc7c
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc

Function at 0xf03d8b5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf061038]
push esi
push edi
mov esi, 0xf002984
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x12a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0xf03d961
inc dword [0xf070928]
js 0xf03d961
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x230]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03d915
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03d925
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf03d944
mov esi, 0xf001680
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x130]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0f01b45c
leave
ret

Function at 0xf03e307
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 0x40
push 0x3000
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 8], 0xa0000
mov dword [ebp - 4], 0x20000
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03e34e
push 0xd9
push 0xf0029f8
push eax
push 0x3e9
call fcn.0f03446f
leave
ret
Function at 0xf040c67
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0xa]
xor ebx, ebx
cmp al, 0xf0
mov byte [ebp + 0xb], al
mov word [esi + 4], 1
mov word [esi + 6], bx
mov dword [esi + 0xc], ebx
jne 0xf040c94
cmp word [esi + 8], bx
je 0xf040c94
mov byte [ebp + 0xb], bl
push 1
lea eax, [ebp + 0xb]
push eax
push ebx
push 2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlOemToUnicodeN]
test eax, eax
jge 0xf040cb2
xor eax, eax
jmp 0xf040e78
mov cl, byte [ebp + 0xb]
cmp cl, bl
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jne 0xf040cfc
xor eax, eax
mov ax, word [esi + 8]
cmp ax, 0x54
jb 0xf040dad
cmp ax, 0xa6
ja 0xf040dad
add eax, 0xffffffac
mov word [esi + 8], ax
movzx eax, ax
shl eax, 3
mov ecx, dword [eax + 0xf064764]
mov dword [esi + 0xc], ecx
mov ax, word [eax + 0xf064760]
jmp 0xf040e4c
cmp cl, 0xe0
jne 0xf040dad
mov ax, word [esi + 8]
cmp ax, bx
je 0xf040dad
movzx ecx, ax
mov eax, 0x84
cmp ecx, eax
mov dword [esi + 0xc], 0x108
jg 0xf040d68
je 0xf040d60
sub ecx, 0x73
je 0xf040d58
dec ecx
je 0xf040d50
dec ecx
je 0xf040d48
dec ecx
je 0xf040d40
dec ecx
jne 0xf040d7b
mov word [esi + 8], 0x47
jmp 0xf040da2
mov word [esi + 8], 0x51
jmp 0xf040da2
mov word [esi + 8], 0x4f
jmp 0xf040da2
mov word [esi + 8], 0x4d
jmp 0xf040da2
mov word [esi + 8], 0x4b
jmp 0xf040da2
mov word [esi + 8], 0x49
jmp 0xf040da2
sub ecx, 0x8d
je 0xf040d9c
sub ecx, 4
je 0xf040d94
dec ecx
je 0xf040d8c
dec ecx
je 0xf040d84
mov dword [esi + 0xc], 0x100
jmp 0xf040da2
mov word [esi + 8], 0x53
jmp 0xf040da2
mov word [esi + 8], 0x52
jmp 0xf040da2
mov word [esi + 8], 0x50
jmp 0xf040da2
mov word [esi + 8], 0x48
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
jmp 0xf040e50
mov ax, word [esi + 8]
cmp ax, 0xe0
jne 0xf040deb
cmp cl, 0x2f
mov dword [esi + 0xc], 0x100
jne 0xf040dd1
mov word [esi + 8], 0x35
mov word [esi + 6], 0x6f
jmp 0xf040e50
cmp cl, 0xa
mov word [esi + 8], 0x1c
mov word [esi + 6], 0xd
jne 0xf040e50
mov dword [esi + 0xc], 0x108
jmp 0xf040e50
cmp cl, bl
je 0xf040e50
cmp ax, 1
je 0xf040e50
cmp ax, 0xe
je 0xf040e50
cmp ax, 0xf
je 0xf040e50
cmp ax, 0x1c
je 0xf040e50
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
jne 0xf040e22
mov word [esi + 8], bx
mov word [esi + 6], 0x12
jmp 0xf040e50
test ah, 1
movzx cx, al
mov word [esi + 6], cx
je 0xf040e33
or dword [esi + 0xc], 0x10
test ah, 2
je 0xf040e3c
or dword [esi + 0xc], 8
test ah, 4
je 0xf040e45
or dword [esi + 0xc], 2
movzx eax, cx
push ebx
push eax
call edi
mov word [esi + 8], ax
cmp word [esi + 6], bx
jne 0xf040e6c
movzx eax, word [esi + 8]
push 3
push eax
call edi
cmp ax, bx
mov word [esi + 6], ax
jne 0xf040e6c
xor eax, eax
jmp 0xf040e77
mov ax, word [ebp - 4]
mov word [esi + 0xa], ax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf040ed5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0xf077160], 0
je 0xf040f0e
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0xf077168]
shl eax, 2
push eax
push 0xf09ac40
push dword [0xf07715c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf040f0e
leave
ret
and dword [0xf077168], 0
xor eax, eax
inc eax
leave
ret

Function at 0xf0419f2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [0xf077184], esi
jne 0xf041a52
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0xf09abe0
mov dword [0xf077184], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0f058d1e
movzx ecx, word [0xf09ad44]
mov edx, ecx
shr edx, 2
shl edx, 6
add edx, eax
mov dword [0xf09abb0], eax
mov eax, ecx
mov dword [0xf09ab44], edx
push 4
cdq
pop ecx
idiv ecx
mov word [0xf09abc0], dx
push 0x3000
mov dword [0xf09ab64], 0x200
call fcn.0f041878
test eax, eax
je 0xf041abe
push edi
push esi
push 0x64
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push esi
push esi
mov dword [0xf09ab58], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ab4c], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09aba0], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ab94], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09abb8], eax
call edi
mov dword [0xf09abf8], eax
xor eax, eax
inc eax
pop edi
jmp 0xf041ac0
xor eax, eax
pop esi
leave
ret