joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006fc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov ecx, dword [0x1004c8e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1004c8ec]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov esi, eax
lea ecx, [esp + 0x10]
movss xmm0, dword [esi + 0xe0]
movss dword [esp + 0x10], xmm0
movss xmm0, dword [esi + 0xe4]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esi + 0xe8]
movss dword [esp + 0x18], xmm0
call fcn.10002a30
comiss xmm0, dword [0x1004742c]
jbe 0x100071c2
push 0x56
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100071c2
cmp byte [0x10f6d7b1], 0
je 0x100071c2
movss xmm0, dword [esi + 0xe4]
divss xmm0, dword [esi + 0xe0]
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_atanf
movss xmm2, dword [esi + 0xe0]
xorps xmm1, xmm1
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x100473d8]
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x100474e4]
comiss xmm0, xmm2
movss dword [esp + 8], xmm1
jb 0x10007093
addss xmm1, dword [0x10047474]
movss dword [esp + 8], xmm1
cmp byte [0x11dba6e8], 0
je 0x100070a6
movss xmm3, dword [0x100474fc]
jmp 0x100070ae
movss xmm3, dword [0x10047348]
movss xmm0, dword [esi + 0xe4]
xorps xmm1, xmm1
mulss xmm0, xmm0
mulss xmm2, xmm2
fld dword [0x10047404]
movss xmm4, dword [0x10047424]
addss xmm0, xmm2
sqrtss xmm0, xmm0
movss dword [esp + 0xc], xmm0
fld dword [esp + 0xc]
fpatan
fstp dword [esp + 0xc]
movss xmm0, dword [esp + 0xc]
mulss xmm0, dword [0x10047434]
comiss xmm0, xmm1
jb 0x100070ff
comiss xmm4, xmm0
jae 0x1000710e
comiss xmm1, xmm0
ja 0x1000710a
movss xmm0, xmm4
jmp 0x1000710e
movss xmm0, xmm1
mov eax, dword [0x1004c8e8]
mulss xmm0, dword [eax + 0x1c]
mulss xmm0, xmm3
call fcn.10006360
comiss xmm0, dword [0x10047250]
mov dword [edi + 0x18], 0
movss dword [esp + 0xc], xmm0
jbe 0x10007141
movss xmm1, dword [0x10047528]
jmp 0x10007149
movss xmm1, dword [0x100474a8]
mov ecx, dword [0x1004c8e0]
lea edx, [esp + 0x10]
movss dword [edi + 0x1c], xmm1
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
call eax
movss xmm0, dword [esp + 8]
addss xmm0, dword [esp + 0xc]
movss xmm1, dword [esp + 0x14]
subss xmm1, xmm0
mulss xmm1, dword [0x10047280]
movaps xmm0, xmm1
call fcn.1003d3a0
movss xmm3, dword [edi + 0x18]
movaps xmm4, xmm0
movss xmm2, dword [edi + 0x1c]
movaps xmm5, xmm4
movaps xmm1, xmm3
shufps xmm5, xmm4, 1
movaps xmm0, xmm2
mulss xmm1, xmm5
mulss xmm0, xmm4
mulss xmm3, xmm4
mulss xmm2, xmm5
subss xmm1, xmm0
addss xmm3, xmm2
movss dword [edi + 0x18], xmm1
movss dword [edi + 0x1c], xmm3
pop edi
pop esi
add esp, 0x14
ret
Function at 0x10007630
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x1004c040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [esp + 0x4c]
movaps xmm1, xmm2
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
push edi
mov edi, edx
call fcn.10007480
cmp dword [eax + 0x14], 0xf
jbe 0x1000765d
mov eax, dword [eax]
push ebx
push 0x20
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100076a6
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000769c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000769c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003c526
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [esp + 0x50]
add esp, 4
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c1fe
add esp, 0x44
ret

Function at 0x10007760
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x1004c040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [esp + 0x58]
mov ebx, edx
push edi
mov edi, ecx
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.10011840
cmp dword [esp + 0x28], 0xf
lea ecx, [esp + 0x2c]
push esi
push 0x20
push ecx
lea eax, [esp + 0x20]
cmova eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100077db
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100077d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100077d1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003c526
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x50]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003c1fe
add esp, 0x48
ret
Function at 0x10011ab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x12
xor eax, eax
nop
mov dl, byte [edi + eax - 0xc09c6f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011add
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011ac0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10a5f68]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011b1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10011b00
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1013618]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011b5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10011b40
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x23
xor eax, eax
nop
mov dl, byte [edi + eax - 0x14d61d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011c8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10011c70
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 3
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9fbca]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011e5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011e40
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011e70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb
xor eax, eax
nop
mov dl, byte [edi + eax - 0x41dd9f2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011e9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011e80
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92a3c9]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001205d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012040
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x100121d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x28
xor eax, eax
nop
mov dl, byte [edi + eax - 0x298687]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100121fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x100121e0
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92318a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001223d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x10012220
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x62
xor eax, eax
nop
mov dl, byte [edi + eax - 0x47c8500]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001285d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012840
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x54
xor eax, eax
nop
mov dl, byte [edi + eax - 0x23aaae]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001289d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012880
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x66
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1139d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001294d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10012930
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x44f64f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012c9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012c80
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x267159c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012cdd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012cc0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x10012d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10ea140]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012d9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012d80
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2035a70]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012e6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012e50
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x20
xor eax, eax
nop
mov dl, byte [edi + eax - 0x8689b3]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001316d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013150
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100132c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x39
xor eax, eax
nop
mov dl, byte [edi + eax - 0x22d0978]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100132ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x100132d0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x44
xor eax, eax
nop
mov dl, byte [edi + eax - 0x118d64b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001348d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013470
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1c03f0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001355d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013540
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100136c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2efdb8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100136ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x100136d0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4
Function at 0x100137d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9a6c08]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100137fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100137e0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x22
xor eax, eax
nop
mov dl, byte [edi + eax - 0x153e223]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001394d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013930
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4a
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5960]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001398d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013970
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x18
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2348146]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013aad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013a90
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xa
xor eax, eax
nop
mov dl, byte [edi + eax - 0x270cf6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013aed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013ad0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x27
xor eax, eax
nop
mov dl, byte [edi + eax - 0xd9d908]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013b2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013b10
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x4134fcc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013b6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013b50
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10013df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x4d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x382c4a4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10013e1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013e00
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10014040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x66
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1496f8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001406d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x10014050
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4
Function at 0x10016f30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1004c040]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x1004c6c8], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100027f0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10016f94
test eax, 0x68000
jne 0x10016f94
mov eax, dword [esp + 0x22]
test eax, eax
je 0x10017020
cmp eax, 5
je 0x10016fe4
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.100027f0
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10016fc8
test eax, 0x68000
jne 0x10016fc8
mov ecx, dword [esp + 0x22]
jmp 0x10016fcb
or ecx, 0xffffffff
mov eax, dword [0x1004c6c8]
add eax, ecx
add esi, eax
mov dword [0x1004c6c8], eax
cmp eax, 5
jl 0x10016f55
jmp 0x10016ff1
mov eax, dword [0x1004c6c8]
add eax, 4
mov dword [0x1004c6c8], eax
push eax
call fcn.1003c667
add esp, 4
mov dword [0x1004c6d0], eax
mov dword [0x1004c6cc], edi
push 0x40
push 0x3000
push dword [0x1004c6c8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10017035
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1003c1fe
mov esp, ebp
pop ebp
ret 8
push dword [0x1004c6c8]
push edi
push dword [0x1004c6d0]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x1004c6c8]
push dword [0x1004c6d0]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x1004c6c8]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x1004c6c8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x1004c6c8], 5
mov cl, 5
jle 0x100170c1
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x1004c6c8]
jl 0x100170b0
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x1004c6c8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1003c1fe
mov esp, ebp
pop ebp
ret 8
Function at 0x100267b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.10026550
mov ecx, dword [0x1004c8e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100267f6
cmp byte [0x10f6d728], 0
je 0x100267f6
push dword [0x10f6d38c]
push dword [0x10f6d388]
push dword [0x10f6d384]
push dword [0x10f6d380]
call fcn.10025ef0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x10026815
cmp byte [0x1004c6dc], 0
sete al
mov byte [0x1004c6dc], al
jmp 0x1002681a
mov al, byte [0x1004c6dc]
test al, al
je 0x1002699d
push 1
call esi
test al, 1
je 0x10026833
mov byte [0x1004d6c4], 1
jmp 0x10026842
push 1
call esi
test al, 1
jne 0x10026842
mov byte [0x1004d6c4], 0
push 2
call esi
test al, 1
je 0x10026853
mov byte [0x1004c6de], 1
jmp 0x10026862
push 2
call esi
test al, 1
jne 0x10026862
mov byte [0x1004c6de], 0
push 1
call esi
test ax, ax
je 0x10026874
mov byte [0x1004d6c6], 1
jmp 0x10026882
push 1
call esi
test ax, ax
jne 0x10026882
mov byte [0x1004d6c6], al
push 2
call esi
test ax, ax
je 0x10026894
mov byte [0x1004c6df], 1
jmp 0x100268a2
push 2
call esi
test ax, ax
jne 0x100268a2
mov byte [0x1004c6df], al
cmp byte [0x10f6d7c3], 0
je 0x100268bc
mov ecx, 0x1004c6c4
call fcn.100081c0
mov byte [0x10f6d7c3], 0
cmp byte [0x10f6d7c2], 0
je 0x100268d6
mov ecx, 0x1004c6c4
call fcn.1000cb40
mov byte [0x10f6d7c2], 0
push dword [0x10f6d37c]
mov ecx, 0x1004c7e0
push dword [0x10f6d378]
push dword [0x10f6d374]
push dword [0x10f6d370]
call fcn.100203d0
push dword [0x10f6de2c]
push dword [0x10f6de24]
call fcn.10037250
mov ecx, dword [0x10f6d380]
test ecx, ecx
jns 0x1002691b
xor ecx, ecx
mov dword [0x10f6d380], ecx
mov eax, dword [0x10f6d384]
test eax, eax
jns 0x1002692b
xor eax, eax
mov dword [0x10f6d384], eax
mov edi, dword [0x1004c884]
mov ebx, edi
mov edx, dword [0x1004c880]
mov esi, edx
sub ebx, dword [0x10f6d38c]
sub esi, dword [0x10f6d388]
cmp ecx, ebx
jle 0x10026951
mov dword [0x10f6d380], ebx
cmp eax, esi
jle 0x1002695b
mov dword [0x10f6d384], esi
mov ecx, dword [0x10f6d370]
test ecx, ecx
jns 0x1002696d
xor ecx, ecx
mov dword [0x10f6d370], ecx
mov eax, dword [0x10f6d374]
test eax, eax
jns 0x1002697d
xor eax, eax
mov dword [0x10f6d374], eax
sub edi, dword [0x10f6d378]
sub edx, dword [0x10f6d37c]
cmp ecx, edi
jle 0x10026993
mov dword [0x10f6d370], edi
cmp eax, edx
jle 0x1002699d
mov dword [0x10f6d374], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10026b50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x63
xor eax, eax
nop
mov dl, byte [edi + eax - 0x3caa7c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10026b7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x19
jl 0x10026b60
pop edi
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret 4