joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100852d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1025afd0]
mov eax, dword [eax + 0x19e4]
test byte [eax + 0xb], 2
je 0x1005ba56
jmp fcn.10057cc0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
movss xmm5, dword [esi]
movss xmm6, dword [esi + 4]
movss xmm1, dword [0x101a8280]
movaps xmm0, xmm1
minss xmm0, xmm5
xorps xmm2, xmm2
cmpltss xmm5, xmm2
andnps xmm5, xmm0
movss xmm3, dword [0x101a8294]
mulss xmm5, xmm3
movss xmm0, dword [0x101a82c0]
movaps xmm4, xmm1
minss xmm4, xmm6
cmpltss xmm6, xmm2
andnps xmm6, xmm4
mulss xmm6, xmm3
movss xmm7, dword [esi + 8]
movaps xmm4, xmm1
minss xmm4, xmm7
cmpltss xmm7, xmm2
andnps xmm7, xmm4
mulss xmm7, xmm3
mov ecx, 0xff
mov dword [esp + 4], eax
test al, 2
jne 0x10085377
movss xmm3, dword [esi + 0xc]
minss xmm1, xmm3
cmpltss xmm3, xmm2
andnps xmm3, xmm1
mulss xmm3, dword [0x101a8294]
addss xmm3, dword [0x101a82c0]
cvttss2si ecx, xmm3
mov dword [esp], ecx
addss xmm5, xmm0
movups xmmword [esp + 0x28], xmm5
addss xmm6, xmm0
movups xmmword [esp + 0x18], xmm6
addss xmm7, xmm0
movups xmmword [esp + 8], xmm7
push 1
push 0
call fcn.1005b890
add esp, 8
test edi, edi
je 0x100853c3
push 0
push edi
call fcn.10049780
add esp, 8
cmp eax, edi
jbe 0x100853c3
push eax
push edi
call fcn.10071d90
add esp, 8
call fcn.100747e0
cvttss2si edi, dword [esp + 0x28]
cvttss2si ebx, dword [esp + 0x18]
cvttss2si ebp, dword [esp + 8]
push 0xbf800000
push 0
call fcn.1004bf70
add esp, 8
test byte [esp + 4], 2
jne 0x1008545e
movss xmm0, dword [esi + 0xc]
cvtss2sd xmm0, xmm0
movss xmm1, dword [esi + 8]
cvtss2sd xmm1, xmm1
movss xmm2, dword [esi]
movss xmm3, dword [esi + 4]
cvtss2sd xmm3, xmm3
cvtss2sd xmm2, xmm2
sub esp, 0x44
movsd qword [esp + 0x3c], xmm0
movsd qword [esp + 0x34], xmm1
movsd qword [esp + 0x2c], xmm3
movsd qword [esp + 0x24], xmm2
mov eax, dword [esp + 0x44]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], str._02X_02X_02X_02X_nR:_d__G:_d__B:_d__A:_d_n__.3f___.3f___.3f___.3f_
call fcn.100721a0
add esp, 0x44
jmp 0x100854b4
movss xmm0, dword [esi + 8]
cvtss2sd xmm0, xmm0
movss xmm1, dword [esi]
movss xmm2, dword [esi + 4]
cvtss2sd xmm2, xmm2
cvtss2sd xmm1, xmm1
sub esp, 0x34
movsd qword [esp + 0x2c], xmm0
movsd qword [esp + 0x24], xmm2
movsd qword [esp + 0x1c], xmm1
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], str._02X_02X_02X_nR:__d__G:__d__B:__d_n__.3f___.3f___.3f_
call fcn.100721a0
add esp, 0x34
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
jmp 0x1005ba40
Function at 0x10085bc0
Capabilities:
Terminate process

Disassembly:
cmp dword [ecx], 5
jge 0x10085c77
movzx edx, byte [esp + 0xc]
movss xmm0, dword [esp + 8]
mov eax, dword [esp + 4]
mov dword [ecx], eax
xorps xmm1, xmm1
movlps qword [ecx + 8], xmm1
movss dword [ecx + 4], xmm0
test dl, dl
je 0x10085bee
movups xmmword [ecx + 0x20], xmm1
test eax, eax
jle 0x10085c74
mov dword [ecx + 0x10], 0
xorps xmm1, xmm1
movss xmm2, dword [ecx + 0x20]
addss xmm2, xmm1
mov dword [ecx + 0x20], 0
cmp eax, 1
jne 0x10085c1a
movaps xmm3, xmm2
jmp 0x10085c6f
dec eax
xor edx, edx
movss xmm1, dword [0x101b0354]
nop word cs:[eax + eax]
movss xmm4, dword [ecx + edx*4 + 0x24]
xorps xmm3, xmm3
cmpltss xmm3, xmm4
movaps xmm5, xmm3
andps xmm5, xmm0
andnps xmm3, xmm1
orps xmm3, xmm5
addss xmm3, xmm2
cvttps2dq xmm2, xmm3
cvtdq2ps xmm2, xmm2
movss dword [ecx + edx*4 + 0x14], xmm2
addss xmm3, xmm4
mov dword [ecx + edx*4 + 0x24], 0
inc edx
movaps xmm2, xmm3
cmp eax, edx
jne 0x10085c30
movss dword [ecx + 8], xmm3
ret 0xc
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10085c90
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [ecx + 0x2c]
mov eax, edx
mov dword [esp], edx
cmp ebx, edx
jl 0x10085dfe
mov esi, ecx
mov ebp, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edi, dword [esi + 0xe64]
lea eax, [ecx + ebp*2]
push eax
push ecx
call fcn.10048d90
add esp, 8
test edi, 0x40000
jne 0x10085ced
mov ecx, dword [esi + 0x28]
add ecx, eax
cmp ecx, dword [esi + 0x30]
jge 0x10085ce6
mov dword [esp + 4], eax
lea eax, [ebx + ebp]
cmp eax, dword [esi + 4]
jl 0x10085da0
xor eax, eax
jmp 0x10085df6
mov dword [esp + 4], eax
lea ecx, [ebx + ebp]
mov eax, dword [esi + 4]
cmp ecx, eax
jl 0x10085da0
cmp ebx, eax
jge 0x10085dfe
cmp ebp, 0x101
mov eax, 0x100
cmovge eax, ebp
lea ecx, [ebp*4]
cmp ecx, eax
cmovl eax, ecx
cmp ebp, 8
mov ecx, 0x20
cmovge ecx, eax
lea edx, [ebx + ecx]
lea edi, [ebx + ecx]
inc edi
mov eax, dword [esi + 8]
cmp eax, edx
jg 0x10085d9d
test eax, eax
je 0x10085d4b
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x10085d50
mov ecx, 8
cmp ecx, edi
cmovle ecx, edi
cmp eax, ecx
jge 0x10085d9d
mov dword [esp + 0xc], ecx
lea eax, [ecx + ecx]
push eax
call fcn.100485a0
add esp, 4
mov edx, dword [esi + 0xc]
test edx, edx
je 0x10085d93
mov ecx, dword [esi + 4]
add ecx, ecx
push ecx
push edx
push eax
mov dword [esp + 0x14], eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [esi + 0xc]
call fcn.100485d0
mov eax, dword [esp + 0xc]
add esp, 4
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 4], edi
mov edi, dword [esi + 0xc]
mov eax, dword [esp]
sub ebx, eax
je 0x10085dc4
mov eax, dword [esp]
lea eax, [edi + eax*2]
lea ecx, [eax + ebp*2]
add ebx, ebx
push ebx
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0xc]
add esp, 0xc
lea eax, [edi + eax*2]
mov ecx, ebp
add ecx, ebp
push ecx
push dword [esp + 0x28]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add ebp, dword [esi + 0x2c]
mov dword [esi + 0x2c], ebp
mov eax, dword [esp + 4]
add dword [esi + 0x28], eax
cmp dword [esi + 4], ebp
jle 0x10085dfe
mov eax, dword [esi + 0xc]
mov word [eax + ebp*2], 0
mov al, 1
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10086150
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, edx
mov edi, ecx
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
lea ecx, [ebx + 0x18]
push 0
push ebp
call fcn.10086210
add esp, 8
test ebp, ebp
jle 0x1008619a
test eax, eax
je 0x1008619a
mov ecx, dword [esp + 0x18]
mov edx, ebp
nop dword [eax]
cmp dword [edi + 4], ecx
jle 0x10086205
mov esi, dword [edi + 0xc]
movzx esi, word [esi + ecx*2]
mov word [eax], si
add eax, 2
inc ecx
dec edx
jne 0x10086180
mov dword [esp], ebx
mov eax, dword [esp + 0x18]
lea ebx, [eax + eax]
mov esi, dword [edi + 0xc]
add esi, ebx
lea eax, [esi + ebp*2]
push eax
push esi
call fcn.10048d90
add esp, 8
sub dword [edi + 0x28], eax
sub dword [edi + 0x2c], ebp
mov ecx, dword [edi + 0xc]
mov eax, dword [esp + 0x18]
lea eax, [ecx + eax*2]
movzx eax, word [eax + ebp*2]
test ax, ax
je 0x100861f1
lea edx, [ebx + ebp*2]
add ecx, edx
add ecx, 2
nop word [eax + eax]
mov word [esi], ax
add esi, 2
movzx eax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100861e0
mov word [esi], 0
mov eax, dword [esp]
mov byte [eax + 0xf], 0
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x10086420
Capabilities:
Terminate process

Disassembly:
push ebx
push edi
push esi
mov eax, 1
test edx, edx
jle case.0x1008645c.32
mov esi, dword [ecx + 4]
cmp esi, edx
jl 0x1008648a
mov ecx, dword [ecx + 0xc]
movzx edi, word [ecx + edx*2 - 2]
xor eax, eax
lea ebx, [edi - 0x20]
cmp ebx, 0x5d
ja case.default.0x10086445
jmp dword [ebx*4 + 0x101b125c]
cmp esi, edx
jle 0x1008648a
movzx ecx, word [ecx + edx*2]
lea edx, [ecx - 0x20]
cmp edx, 0x5d
ja case.default.0x1008645c
jmp dword [edx*4 + 0x101b13d4]
pop esi
pop edi
pop ebx
ret
cmp edi, 0x3000
je case.0x10086445.32
cmp edi, 9
je case.0x10086445.32
jmp case.0x1008645c.32
cmp ecx, 9
je case.0x1008645c.32
cmp ecx, 0x3000
je case.0x1008645c.32
mov eax, 1
jmp case.0x1008645c.32
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x100864a0
Capabilities:
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
movss dword [esp], xmm1
mov eax, dword [ecx + 0x2c]
test eax, eax
jle 0x100866c5
movss dword [esp + 0x14], xmm0
mov dword [esp + 0x10], ecx
mov esi, dword [ecx + 0xc]
mov ecx, dword [0x1025afd0]
mov edx, dword [ecx + 0x18fc]
movss xmm1, dword [ecx + 0x1900]
movaps xmm0, xmm1
divss xmm0, dword [edx + 0x10]
movups xmmword [esp + 0x2c], xmm0
lea edi, [esi + eax*2]
mov dword [esp + 0xc], edx
lea ecx, [edx + 0xc]
mov dword [esp + 8], ecx
xorps xmm0, xmm0
movaps xmm2, xmm1
addss xmm2, xmm0
movups xmmword [esp + 0x1c], xmm2
xor ebx, ebx
xorps xmm4, xmm4
mov dword [esp + 4], eax
mov dword [esp + 0x18], esi
nop
lea edx, [esi + ebx*2]
mov ebp, edx
xorps xmm6, xmm6
nop dword [eax + eax]
cmp ebp, edi
jae 0x10086570
movzx ecx, word [ebp]
add ebp, 2
cmp ecx, 0xd
je 0x10086520
cmp ecx, 0xa
je 0x10086580
lea esi, [ecx*4]
mov eax, dword [esp + 0xc]
add esi, dword [eax + 8]
cmp dword [eax], ecx
cmovle esi, dword [esp + 8]
movss xmm0, dword [esi]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 4]
mulss xmm0, dword [esp + 0x2c]
addss xmm6, xmm0
jmp 0x10086520
xorps xmm5, xmm5
xorps xmm0, xmm0
jmp 0x10086596
xorps xmm5, xmm5
movaps xmm0, xmm6
cmpless xmm0, xmm5
andnps xmm0, xmm6
movups xmm5, xmmword [esp + 0x1c]
xorps xmm6, xmm6
sub ebp, edx
cmp ebp, 2
jl 0x100866c5
test ebx, ebx
jne 0x100865b6
movaps xmm7, xmm4
addss xmm7, dword [0x101a9780]
ucomiss xmm7, dword [esp]
ja 0x10086609
movaps xmm7, xmm5
cmpeqss xmm7, dword [0x101a9780]
movaps xmm2, xmm7
andps xmm2, xmm1
movss xmm3, dword [0x101b0354]
andnps xmm7, xmm3
orps xmm7, xmm2
xorps xmm2, xmm2
cmpltss xmm2, xmm6
movaps xmm3, xmm2
andnps xmm3, xmm7
andps xmm2, xmm1
orps xmm2, xmm3
addss xmm2, xmm5
addss xmm4, xmm2
sar ebp, 1
ucomiss xmm4, dword [esp]
ja 0x10086610
add ebx, ebp
cmp ebx, eax
jl 0x10086510
jmp 0x100866c5
xor eax, eax
jmp 0x100866c5
xorps xmm1, xmm1
movss xmm4, dword [esp + 0x14]
ucomiss xmm1, xmm4
jbe 0x10086625
mov eax, ebx
jmp 0x100866c5
maxss xmm6, xmm0
ucomiss xmm6, xmm4
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
jbe 0x100866b1
mov eax, dword [esp + 0x1c]
cmp ebx, eax
mov edi, eax
cmovg edi, ebx
cmp ebp, 2
mov edx, 1
cmovge edx, ebp
movss xmm0, dword [0x101a97b0]
mov eax, ebx
mov dword [esp], edi
nop dword [eax]
cmp edi, eax
je 0x100866e1
movzx ecx, word [esi + eax*2]
movaps xmm2, xmm0
cmp ecx, 0xa
je 0x1008669e
mov dword [esp + 4], eax
mov edi, esi
lea esi, [ecx*4]
mov eax, dword [esp + 0xc]
add esi, dword [eax + 8]
cmp dword [eax], ecx
cmovle esi, dword [esp + 8]
movss xmm2, dword [esi]
mov esi, edi
mov edi, dword [esp]
mov eax, dword [esp + 4]
mulss xmm2, dword [esp + 0x2c]
movaps xmm3, xmm1
addss xmm3, xmm2
ucomiss xmm3, xmm4
ja 0x100866cd
inc eax
movaps xmm1, xmm3
dec edx
jne 0x10086660
add ebp, ebx
cmp dword [esp + 0x1c], ebp
jl 0x100866e1
lea eax, [ebp - 1]
cmp word [esi + ebp*2 - 2], 0xa
cmovne eax, ebp
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
mulss xmm2, dword [0x101a82c0]
addss xmm1, xmm2
ucomiss xmm1, xmm4
ja 0x100866c5
inc eax
jmp 0x100866c5
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x10086a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x1025ad40]
xor ecx, ebp
mov dword [esp + 0x58], ecx
movzx ecx, byte [eax]
jmp 0x10086ab0
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086be5
cmp cl, 0x25
jne 0x10086aa0
cmp byte [eax + 1], 0x25
je 0x10086aa0
lea ebx, [esp + 0x18]
push esi
push edi
push eax
push 0x40
push ebx
call fcn.100486b0
add esp, 0x14
nop word cs:[eax + eax]
movzx ecx, byte [ebx]
inc ebx
cmp cl, 0x20
je 0x10086ae0
mov eax, dword [ebp + 0xc]
and eax, 0xfffffffe
cmp eax, 4
jne 0x10086b5f
dec ebx
push ebx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
add esp, 4
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
movsd xmm1, qword [0x101b0da8]
ucomisd xmm0, xmm1
jae 0x10086b1b
xorpd xmm1, xmm1
subsd xmm0, xmm1
movsd qword [esp + 8], xmm0
setae al
fld qword [esp + 8]
fnstcw word [esp + 4]
movzx ecx, word [esp + 4]
or ecx, 0xc00
mov word [esp + 6], cx
fldcw word [esp + 6]
fistp qword [esp + 8]
fldcw word [esp + 4]
movzx esi, al
shl esi, 0x1f
xor esi, dword [esp + 0xc]
mov edi, dword [esp + 8]
jmp 0x10086be5
xor eax, eax
cmp cl, 0x2d
sete al
xor edx, edx
cmp byte [ebx + eax - 1], 0x2b
sete dl
add edx, eax
mov ch, byte [ebx + edx - 1]
mov al, ch
add al, 0xd0
mov byte [esp + 3], al
mov eax, 0
mov esi, 0
cmp byte [esp + 3], 9
ja 0x10086bcf
add ebx, edx
xor edx, edx
xor esi, esi
nop word cs:[eax + eax]
mov eax, edx
mov edx, 0xa
mul edx
mov edi, eax
movzx eax, ch
add esi, esi
lea esi, [esi + esi*4]
add eax, 0xffffffd0
add eax, edi
adc esi, edx
mov ch, byte [ebx]
mov byte [esp + 3], ch
add ch, 0xd0
inc ebx
mov edx, eax
cmp ch, 0xa
mov ch, byte [esp + 3]
jb 0x10086ba0
mov edi, eax
neg edi
mov edx, 0
sbb edx, esi
cmp cl, 0x2d
cmovne edi, eax
cmovne edx, esi
mov esi, edx
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.10157981
mov eax, edi
mov edx, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10086c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
sub esp, 0x6c
movss xmm0, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
mov ecx, dword [0x1025ad40]
xor ecx, esp
mov dword [esp + 0x68], ecx
movzx ecx, byte [eax]
test cl, cl
je 0x10086d0e
mov edi, dword [esp + 0x7c]
jmp 0x10086c48
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086d0e
cmp cl, 0x25
jne 0x10086c30
cmp byte [eax + 1], 0x25
je 0x10086c30
cvtss2sd xmm0, xmm0
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], eax
lea esi, [esp + 0x28]
mov dword [esp], esi
mov dword [esp + 4], 0x40
call fcn.100486b0
nop word cs:[eax + eax]
movzx eax, byte [esi]
inc esi
cmp al, 0x20
je 0x10086c80
and edi, 0xfffffffe
cmp edi, 4
jne 0x10086ca6
dec esi
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
fstp dword [esp + 0x18]
movss xmm0, dword [esp + 0x18]
jmp 0x10086d0e
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [esi + ecx - 1], 0x2b
sete dl
add edx, ecx
movzx ecx, byte [esi + edx - 1]
mov ah, cl
add ah, 0xd0
xorps xmm0, xmm0
cmp ah, 9
ja 0x10086d03
add esi, edx
movss xmm1, dword [0x101a99bc]
nop word cs:[eax + eax]
movzx ecx, cl
add ecx, 0xffffffd0
xorps xmm2, xmm2
cvtsi2ss xmm2, ecx
mulss xmm0, xmm1
addss xmm0, xmm2
movzx ecx, byte [esi]
mov edx, ecx
add dl, 0xd0
inc esi
cmp dl, 0xa
jb 0x10086ce0
cmp al, 0x2d
jne 0x10086d0e
xorps xmm0, xmmword [0x101a97e0]
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
fstp xword [esp + 0x1c]
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.10157981
fld xword [esp + 0x1c]
add esp, 0x6c
pop esi
pop edi
ret
Function at 0x10086d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
movsd xmm0, qword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [0x1025ad40]
xor ecx, ebp
mov dword [esp + 0x74], ecx
movzx ecx, byte [eax]
test cl, cl
je 0x10086e4f
mov edi, dword [ebp + 0xc]
jmp 0x10086d88
xor edx, edx
cmp cl, 0x25
sete dl
movzx ecx, byte [eax + edx + 1]
add eax, edx
inc eax
test cl, cl
je 0x10086e4f
cmp cl, 0x25
jne 0x10086d70
cmp byte [eax + 1], 0x25
je 0x10086d70
movsd qword [esp + 0xc], xmm0
mov dword [esp + 8], eax
lea esi, [esp + 0x34]
mov dword [esp], esi
mov dword [esp + 4], 0x40
call fcn.100486b0
nop word cs:[eax + eax]
movzx eax, byte [esi]
inc esi
cmp al, 0x20
je 0x10086dc0
and edi, 0xfffffffe
cmp edi, 4
jne 0x10086de6
dec esi
mov dword [esp], esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
fstp qword [esp + 0x20]
movsd xmm0, qword [esp + 0x20]
jmp 0x10086e4f
xor ecx, ecx
cmp al, 0x2d
sete cl
xor edx, edx
cmp byte [esi + ecx - 1], 0x2b
sete dl
add edx, ecx
movzx ecx, byte [esi + edx - 1]
mov ah, cl
add ah, 0xd0
xorpd xmm0, xmm0
cmp ah, 9
ja 0x10086e43
add esi, edx
movsd xmm1, qword [0x101b1028]
nop word cs:[eax + eax]
movzx ecx, cl
add ecx, 0xffffffd0
xorps xmm2, xmm2
cvtsi2sd xmm2, ecx
mulsd xmm0, xmm1
addsd xmm0, xmm2
movzx ecx, byte [esi]
mov edx, ecx
add dl, 0xd0
inc esi
cmp dl, 0xa
jb 0x10086e20
cmp al, 0x2d
jne 0x10086e4f
xorpd xmm0, xmmword [0x101a83a0]
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0x28]
mov ecx, dword [esp + 0x74]
xor ecx, ebp
call fcn.10157981
fld xword [esp + 0x28]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x10087260
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp edx, 3
je 0x10087287
cmp edx, 2
je 0x10087295
mov al, 1
cmp edx, 1
jne 0x10087294
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
ret

Function at 0x10087b60
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x10260600]
test eax, eax
je 0x10087ba4
mov edi, ecx
xor ebx, ebx
mov ebp, 0x14
mov ecx, dword [0x102605f8]
nop word [eax + eax]
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
jne 0x10087bab
inc ebx
add ebp, 0x2c
cmp eax, ebx
jne 0x10087b90
xor esi, esi
jmp 0x10087c6a
xor eax, eax
test edi, edi
setne al
lea ecx, [esp + 4]
mov edx, 0xffffffff
push eax
call fcn.10087eb0
add esp, 4
mov eax, dword [0x10260600]
xor esi, esi
cmp ebx, eax
jae 0x10087c10
mov ecx, dword [0x102605f8]
jmp 0x10087be8
inc ebx
add ebp, 0x2c
cmp ebx, eax
jae 0x10087c10
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
je 0x10087be0
mov ecx, ebx
mov edx, edi
call fcn.10088220
test eax, eax
jne 0x10087c0e
mov ecx, dword [0x102605f8]
mov eax, dword [0x10260600]
jmp 0x10087be0
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x10087c6a
mov dword [esp], esi
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x10087c58
xor esi, esi
jmp 0x10087c35
inc esi
cmp ebp, esi
je 0x10087c58
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10087c30
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10087c30
push ebx
push 0
push dword [0x102605f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10157981
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0xc], eax
mov esi, dword [0x102605f8]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
lea ecx, [esp + 8]
push ecx
push 0x40
mov dword [esp + 0xc], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100882a1
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp], ecx
je 0x100882a8
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
lea edx, [esp + 8]
je 0x100882cc
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100882cc
mov esi, 0xa
jmp 0x10088306
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
lea edx, [esp + 8]
jne 0x100882c2
movzx ecx, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x100882cc
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp]
movzx eax, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor esi, esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10157981
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088340
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], edx
mov ebx, ecx
mov eax, dword [0x1025ad40]
xor eax, esp
mov dword [esp + 0x10], eax
xor esi, esi
mov ebp, 1
xor eax, eax
lock cmpxchg dword [0x102605f0], ebp
je 0x10088388
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp esi, 0x20
setae al
push eax
call edi
inc esi
xor eax, eax
lock cmpxchg dword [0x102605f0], ebp
jne 0x10088370
cmp dword [0x102605f4], 0
je 0x100883d1
test ebx, ebx
je 0x100883db
mov ecx, dword [0x10260600]
mov esi, 4
test ecx, ecx
je 0x10088478
mov eax, dword [0x102605f8]
neg ecx
xor ebp, ebp
nop word cs:[eax + eax]
cmp dword [eax], ebx
je 0x100883ea
dec ebp
add eax, 0x2c
cmp ecx, ebp
jne 0x100883c0
jmp 0x10088478
mov esi, 2
jmp 0x10088478
mov ecx, dword [esp]
call fcn.10087b60
mov esi, eax
jmp 0x10088478
cmp ebp, 1
je 0x10088478
mov eax, dword [eax + 0x14]
shr eax, 1
and eax, 1
mov edi, dword [esp]
cmp eax, edi
jne 0x1008840c
xor esi, esi
cmp edi, 1
adc esi, 5
jmp 0x10088478
neg ebp
lea ecx, [esp + 4]
mov edx, ebp
push 1
call fcn.10087eb0
add esp, 4
mov ecx, ebp
mov edx, edi
call fcn.10088220
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x10088478
mov eax, dword [esp + 0xc]
mov dword [esp], eax
test eax, eax
je 0x10088469
xor ebp, ebp
jmp 0x10088446
inc ebp
cmp dword [esp], ebp
je 0x10088469
push dword [ebx + ebp*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10088440
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10088440
push ebx
push 0
push dword [0x102605f4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xchg dword [0x102605f0], eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10157981
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088b30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10089480
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call sub.MSVCP140.dll__Thrd_hardware_concurrency
mov esi, eax
mov dword [0x10260664], eax
push 0x14
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [0x10260660], eax
test esi, esi
je 0x10088c00
xor esi, esi
xor eax, eax
nop word cs:[eax + eax]
mov ecx, dword [0x10260660]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ecx + esi + 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
push 0x18
call fcn.1015791b
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
call fcn.100894a0
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + esi]
mov edx, dword [ebp - 0x20]
mov dword [ecx + esi + 4], edx
mov dword [ecx + esi + 8], 0x10260608
push 0
push 0
push eax
push 0x10088cd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x28]
inc eax
add esi, 0x14
cmp eax, dword [0x10260664]
jb 0x10088b90
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret