joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f270
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xf8
xor cl, byte [esp + eax]
add cl, 0x28
mov byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x43f2a0
mov edi, dword [esp]
mov eax, dword [0x451cfc]
test eax, eax
je 0x43f306
xor ecx, ecx
mov edx, dword [0x451d00]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0xc85f7986
je 0x43f2e0
inc ecx
cmp eax, ecx
jne 0x43f2d0
jmp 0x43f306
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x43f306
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 4
push dword [0x451d04]
push eax
call fcn.00441c30
add esp, 0x1c
mov edi, eax
cmp edi, 0xc0000004
jne 0x43f415
push dword [esp + 0xc]
call fcn.0043f150
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, edx
add cl, 0xf8
xor cl, byte [esp + edx]
add cl, 0x28
mov byte [esp + edx], cl
inc edx
cmp edx, 7
jne 0x43f340
mov edi, dword [esp]
mov edx, dword [0x451cfc]
test edx, edx
je 0x43f3ac
mov dword [esp + 8], esi
mov ecx, ebp
xor ebp, ebp
mov esi, dword [0x451d00]
nop
cmp dword [esi + ebp*8], 0xc85f7986
je 0x43f382
inc ebp
cmp edx, ebp
jne 0x43f370
mov ebp, ecx
jmp 0x43f3ac
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
mov ebp, ecx
je 0x43f3ac
push 0
push dword [esp + 0xc]
push eax
push 5
push 4
push dword [0x451d04]
push edx
mov esi, eax
call fcn.00441c30
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43f40c
mov dword [esp + 8], ebp
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0x43f3e5
add edi, 2
cmp si, bp
je 0x43f3d0
cmp si, bp
je 0x43f3f7
mov esi, dword [ecx]
test esi, esi
jne 0x43f3c0
mov edi, 0xc0000225
jmp 0x43f40c
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043f1f0
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43f450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x43f500
xor eax, eax
cmp dword [ecx], 0
jne 0x43f53a
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
mov ebx, eax
add bl, 0xf8
xor bl, byte [esp + eax]
add bl, 0x28
mov byte [esp + eax], bl
inc eax
cmp eax, 7
jne 0x43f4c0
mov eax, dword [esp]
mov esi, dword [0x451cfc]
test esi, esi
je 0x43f53a
xor edi, edi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x3ba5404
je 0x43f543
inc edi
cmp esi, edi
jne 0x43f4f0
jmp 0x43f53a
mov dword [esp + 8], 0x89cacb34
mov eax, 0xfc737333
nop
nop
nop
movzx ecx, byte [esp + eax + 0x38c8cd5]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
inc cl
mov byte [esp + eax + 0x38c8cd5], cl
inc eax
cmp eax, 0xfc737337
jne 0x43f510
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43f53a
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 4
push dword [0x451d04]
push esi
call fcn.00441c30
add esp, 0x1c
jmp 0x43f53a

Function at 0x43f580
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43f61a
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, edx
add bl, 0xf8
xor bl, byte [esp + edx]
add bl, 0x28
mov byte [esp + edx], bl
inc edx
cmp edx, 7
jne 0x43f5b0
mov edx, dword [0x451cfc]
test edx, edx
je 0x43f60e
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x7e776f1
je 0x43f5f0
inc edi
cmp edx, edi
jne 0x43f5e0
jmp 0x43f60e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43f60e
push eax
push 1
push dword [0x451d04]
push edx
mov esi, ecx
call fcn.00441c30
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x43f620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
cmp dword [ecx + 8], 0
je 0x43f6a3
mov edx, dword [ecx]
test edx, edx
je 0x43f6a3
mov edi, dword [ebp + 0x10]
mov dword [esp + 4], 0x2c2d2e2f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xf8
xor bl, byte [esp + eax + 4]
add bl, 0x28
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 7
jne 0x43f660
mov eax, dword [esp + 4]
mov ebx, dword [0x451cfc]
test ebx, ebx
je 0x43f703
xor edi, edi
mov esi, dword [0x451d00]
nop
nop
nop
nop
cmp dword [esi + edi*8], 0xdef797a3
je 0x43f6df
inc edi
cmp ebx, edi
jne 0x43f690
mov edi, dword [ebp + 0x10]
jmp 0x43f703
mov dword [esp + 4], 0x4106070c
mov byte [esp + 8], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0x41
xor cl, byte [esp + eax + 4]
add cl, 0xbb
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 5
jne 0x43f6c0
mov eax, dword [esp + 4]
jmp 0x43f86b
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
mov edi, dword [ebp + 0x10]
je 0x43f703
push dword [ebp + 8]
push edx
push 2
push dword [0x451d04]
push esi
mov esi, ecx
call fcn.00441c30
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
cmp esi, 1
mov edx, edi
sbb edx, 0
jl 0x43f7c5
cmp eax, 0xc000010a
jne 0x43f7c5
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
imul esi, edi, 0xffffd8f0
add esi, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov edx, dword [ecx]
mov dword [esp + 4], 0x2c2d2e2f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0xf8
xor bl, byte [esp + eax + 4]
add bl, 0x28
mov byte [esp + eax + 4], bl
inc eax
cmp eax, 7
jne 0x43f760
mov eax, dword [esp + 4]
mov esi, dword [0x451cfc]
test esi, esi
je 0x43f7c5
xor edi, edi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x53f09cfa
je 0x43f7a0
inc edi
cmp esi, edi
jne 0x43f790
jmp 0x43f7c5
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43f7c5
lea eax, [esp + 0x10]
push eax
push 0
push edx
push 3
push dword [0x451d04]
push esi
mov esi, ecx
call fcn.00441c30
mov ecx, esi
add esp, 0x18
test eax, eax
js 0x43f86b
mov edx, dword [ecx]
test edx, edx
je 0x43f86b
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x2c2d2e2f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0xf8
xor dl, byte [esp + ebx + 4]
add dl, 0x28
mov byte [esp + ebx + 4], dl
inc ebx
cmp ebx, 7
jne 0x43f800
mov esi, dword [0x451cfc]
test esi, esi
je 0x43f865
mov edx, dword [esp + 4]
xor ebx, ebx
mov edi, dword [0x451d00]
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0x7e776f1
je 0x43f840
inc ebx
cmp esi, ebx
jne 0x43f830
jmp 0x43f865
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0x43f865
push dword [esp + 0xc]
push 1
push dword [0x451d04]
push esi
mov esi, ecx
mov edi, eax
call fcn.00441c30
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43f880
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x43f90a
push 0xf8eb88df
push dword [0x451cf0]
call fcn.004443c0
add esp, 8
test eax, eax
je 0x43f8d5
mov ecx, dword [esi]
test ecx, ecx
je 0x43f907
mov dword [esp], 0
mov edx, esp
push edx
push ecx
call eax
test eax, eax
je 0x43f8e3
cmp dword [esp], 0
je 0x43f8e3
mov dword [esi + 4], 3
jmp 0x43f907
mov dword [esi + 4], 1
mov ecx, dword [esi]
jmp 0x43f973
lea eax, [esp + 8]
push eax
call fcn.00444b80
add esp, 4
test al, al
je 0x43f907
mov eax, dword [esp + 8]
mov ecx, 2
cmp eax, 3
je 0x43f904
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, 2
jne 0x43f973
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xf8
xor dl, byte [esp + eax]
add dl, 0x28
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43f930
mov eax, dword [esp]
mov edx, dword [0x451cfc]
test edx, edx
je 0x43f9f4
xor esi, esi
mov ebx, dword [0x451d00]
nop
nop
nop
cmp dword [ebx + esi*8], 0x1cbb9425
je 0x43f9d0
inc esi
cmp edx, esi
jne 0x43f960
jmp 0x43f9f4
mov dword [esp], 0x2c2d2e2f
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xf8
xor dl, byte [esp + eax]
add dl, 0x28
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x43f990
mov eax, dword [esp]
mov edx, dword [0x451cfc]
test edx, edx
je 0x43f9f4
xor esi, esi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x62429966
je 0x43f9d0
inc esi
cmp edx, esi
jne 0x43f9c0
jmp 0x43f9f4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43f9f4
push dword [esp + 0x2c]
push edi
push ebp
push dword [esp + 0x2c]
push ecx
push 5
push dword [0x451d04]
push edx
call fcn.00441c30
add esp, 0x20
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43fd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x43fd29
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x43fd3a
cmp eax, 2
je 0x43fdb0
jmp 0x43fddd
push 0xf8eb88df
push dword [0x451cf0]
call fcn.004443c0
add esp, 8
test eax, eax
je 0x43fd7b
mov ecx, dword [esi]
test ecx, ecx
je 0x43fda8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x43fd84
cmp dword [esp + 4], 0
je 0x43fd84
mov dword [esi + 4], 3
jmp 0x43fda8
mov dword [esi + 4], 1
jmp 0x43fddd
lea eax, [esp + 0xc]
push eax
call fcn.00444b80
add esp, 4
test al, al
je 0x43fda8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x43fda5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x43fddd
mov ebx, dword [ebp + 0x18]
push 0x1e03da9a
push dword [0x459d10]
call fcn.004443c0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x43fe64
mov ecx, dword [esi]
mov dword [esp + 4], 0x2c2d2e2f
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0xf8
xor dl, byte [esp + eax + 4]
add dl, 0x28
mov byte [esp + eax + 4], dl
inc eax
cmp eax, 7
jne 0x43fe00
mov eax, dword [esp + 4]
mov edx, dword [0x451cfc]
test edx, edx
je 0x43fe64
xor esi, esi
mov ebx, dword [0x451d00]
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x64567875
je 0x43fe40
inc esi
cmp edx, esi
jne 0x43fe30
jmp 0x43fe64
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x43fe64
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x451d04]
push edx
call fcn.00441c30
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x441b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x44fe2c]
Function at 0x443ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 4], 0x595a5b34
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
xor eax, eax
nop
nop
nop
mov ecx, eax
add cl, 0x6f
xor cl, byte [esp + eax + 4]
add cl, 0xd5
mov byte [esp + eax + 4], cl
inc eax
cmp eax, 7
jne case.default.0x443f27
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor ecx, ecx
cmp dword [esp + 0x28], 0
sete cl
jmp dword [ecx*4 + 0x450720]
mov edx, dword [eax + 0xc]
add edx, 0xc
mov dword [esp], 0
mov eax, dword [0x450748]
mov dword [esp + 0xc], eax
mov edi, dword [edx]
xor eax, eax
cmp edi, edx
setne al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x450738]
mov eax, dword [edi + 0x30]
xor ecx, ecx
test eax, eax
setne cl
mov esi, 1
jmp dword [ecx*4 + 0x450740]
jmp dword [0x450734]
mov eax, dword [eax + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1008892c], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x1000292a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x10088928], eax
inc ebx
cmp ebx, 0x100
jb 0x10002890
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x10002956
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10088928]
sub edi, 1
jne 0x10002935
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002988
nop dword [eax]
cmp cl, 0x23
jne 0x1000296f
cmp byte [esi], cl
jne 0x1000296f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10088928]
test cl, cl
jne 0x10002960
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002b20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002b32
mov dword [edi], 0
mov edx, 0x1008480c
call fcn.10002990
mov esi, eax
test esi, esi
jne 0x10002b46
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002bf9
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10002bf9
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002bf9
mov eax, dword [0x10088d30]
test eax, eax
je 0x10002b93
inc dword [eax + 0x394]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10002bf9
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10002be2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10088d30]
add esp, 4
test eax, eax
je 0x10002bcf
dec dword [eax + 0x394]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002bf1
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10011440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x10088d30]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2c2c], 0
test eax, eax
je 0x1001153c
push edi
lea edi, [esi + 0x2c30]
mov dword [esi + 0x2c2c], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10011497
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10012200
mov ecx, dword [edi + 4]
xor edx, edx
mov dword [edi], 0
test ecx, ecx
jne 0x100114ae
push 8
mov ecx, edi
call fcn.10012200
mov edx, dword [edi]
mov eax, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [edx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2c3c], 0
jle 0x100114f5
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x2c44]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2c3c]
jl 0x100114d0
cmp dword [edi + 8], 0
je 0x10011500
mov edi, dword [edi]
dec edi
jmp 0x10011502
xor edi, edi
mov eax, dword [esi + 0x2c38]
mov ebx, 0x10088d2c
mov ecx, dword [ebp - 8]
test eax, eax
mov edx, 0x10084810
cmovne ebx, eax
call fcn.10002990
mov esi, eax
test esi, esi
je 0x1001153a
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f140
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [0x10089218], 0x10062490
mov ecx, 0x100624a0
mov dword [0x10089220], edi
mov dword [0x10089224], edi
lea ebx, [edi + 0x286ac]
mov dword [0x1008921c], ebx
call fcn.1001ed20
mov dword [ebp - 0x14], eax
cmp eax, 0x100624a0
je 0x1001f19d
cmp dword [0x10089224], ebx
ja 0x1001f30e
mov ecx, eax
mov esi, eax
call fcn.1001ed20
mov dword [ebp - 0x14], eax
cmp eax, esi
jne 0x1001f181
cmp byte [eax], 5
jne 0x1001f30e
cmp byte [eax + 1], 0xfa
jne 0x1001f30e
cmp dword [0x10089224], ebx
jne 0x1001f30e
mov dword [ebp - 0x10], 0x286ac
mov ecx, 1
xor esi, esi
mov dword [ebp - 4], 0x11bc
mov dword [ebp - 0xc], edi
xor ebx, ebx
movzx eax, byte [edi]
mov edx, edi
add ecx, eax
sub edx, dword [ebp - 0xc]
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
add edx, 0xf
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
add ebx, 8
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
add edi, 8
mov eax, dword [ebp - 4]
add esi, ecx
cmp edx, eax
jb 0x1001f1d6
xor edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], 0
cmp ebx, eax
jae 0x1001f29d
sub eax, ebx
cmp eax, 2
jb 0x1001f289
mov edx, dword [ebp - 4]
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov esi, ebx
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebx, ecx
add edi, 2
add ecx, eax
add esi, ecx
sub edx, 1
jne 0x1001f257
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jae 0x1001f295
movzx eax, byte [edi]
mov edx, dword [ebp - 8]
add ecx, eax
add esi, ecx
inc edi
jmp 0x1001f298
movzx eax, byte [edi]
mov ebx, edx
add ecx, eax
add esi, ecx
inc edi
jmp 0x1001f298
mov edx, dword [ebp - 8]
lea eax, [edx + ebx]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
add esi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0x15b0
jne 0x1001f1d1
mov edi, dword [ebp - 0x14]
shl esi, 0x10
add esi, ecx
movzx edx, byte [edi + 2]
movzx eax, byte [edi + 3]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 4]
shl edx, 8
add edx, eax
movzx eax, byte [edi + 5]
shl edx, 8
add edx, eax
cmp esi, edx
jne 0x1001f30e
pop edi
pop esi
mov eax, 0x286ac
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020140
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1008800c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x10088d30]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push dword [0x10089238]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
movd xmm1, eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x30]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x30]
mov ecx, edi
sub ecx, dword [0x10089240]
mov esi, dword [esp + 0x34]
mov edx, esi
sbb edx, dword [0x10089244]
call fcn.10061060
mov edx, dword [0x1008924c]
mov ecx, dword [0x10089248]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x28], xmm0
call fcn.10061060
movss xmm1, dword [esp + 0x28]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10089244], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10089240], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x10088d30]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [esi + 0x37b], 0
je 0x10020278
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x28], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
push dword [0x10089238]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [0x10089238]
jne 0x100202e0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x100202e0
lea eax, [esp + 0x10]
push eax
push dword [0x10089238]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x100202e0
movd xmm0, dword [esp + 0x10]
movd xmm1, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xbc], 0
je 0x100202ee
or eax, 0xffffffff
jmp 0x100202f9
mov eax, dword [0x10088d30]
mov eax, dword [eax + 0x1c58]
cmp dword [0x10088420], eax
je 0x1002030b
mov dword [0x10088420], eax
call fcn.10020020
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005cdd4
mov esp, ebp
pop ebp
ret