joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074930
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
test byte [edi], 4
jne 0x10074af0
mov eax, dword [edi + 0x46c]
mov ecx, dword [edi + 0x50]
mov dword [esp + 0x10], ecx
lea edx, [eax*8]
sub edx, eax
lea eax, [edi + 0x60]
mov dword [esp + 0x18], edx
xor ebx, ebx
mov dword [esp + 0x14], eax
nop dword [eax]
movzx ebp, word [ecx + edx*4]
movzx ecx, word [ecx + edx*4 + 6]
mov esi, ebp
mov eax, dword [esp + 0x10]
add ecx, ebx
imul ecx, dword [edi + 0x24]
sub esi, ebx
shr esi, 1
sub ebp, esi
movzx eax, word [eax + edx*4 + 4]
sub ebp, ebx
add ecx, eax
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x100749d8
lea edi, [eax + ecx]
test esi, esi
je 0x100749ae
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add edi, esi
test ebx, ebx
je 0x100749c3
push ebx
push 0xff
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test ebp, ebp
je 0x10074a0e
push ebp
lea eax, [edi + ebx]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10074a0e
mov eax, dword [edi + 0x20]
lea edx, [eax + ecx*4]
test esi, esi
je 0x100749ed
mov ecx, esi
mov eax, 0xffffff
mov edi, edx
rep stosd dword es:[edi], eax
test ebx, ebx
je 0x100749fb
lea edi, [edx + esi*4]
mov ecx, ebx
or eax, 0xffffffff
rep stosd dword es:[edi], eax
test ebp, ebp
je 0x10074a0e
lea eax, [esi + ebx]
mov ecx, ebp
lea edi, [edx + eax*4]
mov eax, 0xffffff
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
movzx edx, word [ebp + ecx*4 + 4]
movzx ecx, word [ebp + ecx*4 + 6]
add ecx, ebx
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1025c3e0]
lea eax, [edx - 1]
add eax, esi
cvtpd2ps xmm2, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
mulss xmm2, dword [edi + 0x30]
addsd xmm0, qword [ecx*8 + 0x1025c3e0]
mov ecx, ebp
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x30]
addss xmm2, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
mulss xmm2, dword [0x1025afcc]
addsd xmm0, qword [eax*8 + 0x1025c3e0]
lea eax, [edx + 1]
mov edx, dword [esp + 0x18]
add eax, esi
movss dword [esp + 0x24], xmm2
add eax, ebx
movss dword [esp + 0x2c], xmm2
inc ebx
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2c]
movss dword [esp + 0x20], xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1025c3e0]
mov eax, dword [esp + 0x14]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [edi + 0x2c]
movss dword [esp + 0x28], xmm0
movups xmm0, xmmword [esp + 0x20]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [esp + 0x14], eax
cmp ebx, 0x40
jb 0x10074970
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x1008b540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1008b56c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1008b58e
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1008b590
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1008b615
jg 0x1008b5a5
test esi, esi
je 0x1008b615
test ecx, ecx
jl 0x1008b5f8
jg 0x1008b5af
test eax, eax
je 0x1008b5f8
cmp edi, ecx
jg 0x1008b5c3
jl 0x1008b5b9
cmp esi, eax
jae 0x1008b5c3
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov eax, dword [ebx + 0x30]
sub esi, ecx
mov edx, dword [ebp + 8]
sbb edi, dword [esp + 0x10]
add edx, ecx
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
test edi, edi
jl 0x1008b615
jg 0x1008b5fb
test esi, esi
je 0x1008b615
jmp 0x1008b5fb
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1008b615
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1008b630
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0xc], esi
test eax, eax
jg 0x1008b65b
jl 0x1008b650
test ebp, ebp
jne 0x1008b65b
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
pop ecx
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1008b671
push eax
push ebp
push esi
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x1008b6b4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1008b6b4
mov edi, dword [esp + 0x10]
cmp eax, ebp
mov esi, ebp
cmovb esi, eax
push esi
push ecx
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x1c], edi
add esp, 0xc
mov edi, ebp
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x10]
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x1008b72a
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1008b6dd
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1008b716
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1008b73d
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1008b6f0
test ecx, ecx
je 0x1008b72a
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov edx, dword [esp + 0x20]
sub ebp, ecx
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x20]
sub ebp, edi
pop edi
pop esi
mov eax, ebp
sbb edx, 0
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x1008bab0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x30
mov eax, dword [0x1026a5dc]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1008bae0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e8209
add esp, 0x30
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1008bb11
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1008bb11
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e8209
add esp, 0x30
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1008bbf5
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1008bb3a
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1008bb46
movsx eax, bl
jmp 0x1008bb86
lea eax, [esp + 0xc]
mov byte [esp + 0x17], bl
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x2b]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1008bbb1
sub eax, 1
je 0x1008bbb1
sub eax, 2
jne 0x1008bbf5
movsx eax, byte [esp + 0x17]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e8209
add esp, 0x30
ret 4
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
sub edi, eax
je 0x1008bbd1
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1008bbf5
lea eax, [esp + 0x17]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
je 0x1008bbf5
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100e8209
add esp, 0x30
ret 4
mov ecx, dword [esp + 0x38]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e8209
add esp, 0x30
ret 4
Function at 0x1008be10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x1026a5dc]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1008bed2
cmp byte [esi + 0x3d], 0
je 0x1008bed2
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1008bebf
mov ecx, dword [esi + 0x38]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1008be83
sub eax, 1
je 0x1008be87
sub eax, 2
jne 0x1008bebf
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e8209
add esp, 0x28
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x1008bea7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1008bebf
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e8209
add esp, 0x28
ret
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100e8209
add esp, 0x28
ret
mov ecx, dword [esp + 0x28]
mov al, 1
pop esi
xor ecx, esp
call fcn.100e8209
add esp, 0x28
ret

Function at 0x10091450
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101365b5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1026a5dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x100914f0
push 4
call fcn.100e8420
mov dword [ebp - 0x1c], eax
mov dword [eax], 0x10091430
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x10095720
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100914e1
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
jne 0x100914cb
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
je 0x100914f0
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e8209
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10093360
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013678d
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x1026a5dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.100e8420
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x10095720
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x100933e2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100e8209
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x100977b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3e], 0
je 0x100977d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 8]
inc eax
xor byte [edx], cl
cmp eax, 0x3d
jb 0x100977c0
mov byte [esi + 0x3e], 0
mov eax, esi
pop esi
ret

Function at 0x100977e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x10097802
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 8]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x100977f0
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret
Function at 0x100a3750
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x15c
mov eax, dword [0x1026a5dc]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [esp + 0x38], 0x128
lea eax, [esp + 0x38]
mov dword [esp + 0x20], ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32First]
lea eax, [esp + 0x38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x100a385a
mov ebx, dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
nop
mov dword [esp + 0x10], 0x6e47404f
xor eax, eax
mov dword [esp + 0x14], 0x1b514b57
mov dword [esp + 0x18], 0x5d4f53
mov byte [esp + 0x1c], 1
nop
lea ecx, [eax + 0x2e]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0xb
jb 0x100a37d0
lea eax, [esp + 0x10]
mov byte [esp + 0x1c], 0
push eax
lea eax, [esp + 0x60]
push eax
call ebx
add esp, 8
test eax, eax
je 0x100a3835
movaps xmm0, xmmword [0x1025c970]
xor ecx, ecx
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x34], 0x1005a46
nop dword [eax + eax]
lea eax, [ecx + 0x2e]
xor byte [esp + ecx + 0x24], al
inc ecx
cmp ecx, 0x12
jb 0x100a3810
lea eax, [esp + 0x24]
mov byte [esp + 0x37], 0
push eax
lea eax, [esp + 0x60]
push eax
call ebx
add esp, 8
test eax, eax
jne 0x100a3843
mov eax, dword [esp + 0x4c]
cmp eax, esi
jle 0x100a3843
mov edi, dword [esp + 0x40]
mov esi, eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x100a37b0
mov ecx, dword [esp + 0x164]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e8209
mov esp, ebp
pop ebp
ret

Function at 0x100a7b60
Capabilities:
Log keystrokes via polling

Disassembly:
mov al, byte [0x102c2cf0]
push ebx
push esi
push edi
mov edi, ecx
test al, al
jne 0x100a7b8f
mov eax, dword [edi]
push ecx
mov ecx, dword [eax*4 + 0x102555f0]
call fcn.1007b150
add esp, 4
test al, al
je 0x100a7bcf
mov byte [0x102c2cf0], 1
pop edi
pop esi
pop ebx
ret
cmp al, 1
jne 0x100a7bcf
push ecx
mov ecx, 0x10257d60
call fcn.1007b150
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 4
mov esi, 0x10255888
nop dword [eax]
push dword [esi]
call ebx
test ax, ax
je 0x100a7bc4
mov eax, dword [esi]
mov dword [edi], eax
mov byte [0x102c2cf0], 0
add esi, 4
cmp esi, 0x10255b20
jne 0x100a7bb0
pop edi
pop esi
pop ebx
ret
Function at 0x100b9c00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x47], 0
je 0x100b9c22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x43]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x100b9c10
mov byte [esi + 0x47], 0
mov eax, esi
pop esi
ret

Function at 0x100b9c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 0xa], 0
je 0x100b9c58
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x100b9c46
mov byte [edi + 0xa], 0
lea ecx, [edi + 9]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100b9c80
push 9
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100b9c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 6], 0
je 0x100b9cb8
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 5
jb 0x100b9ca6
mov byte [edi + 6], 0
lea ecx, [edi + 5]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100b9ce0
push 5
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100b9de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 7], 0
je 0x100b9e08
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x100b9df6
mov byte [edi + 7], 0
lea ecx, [edi + 6]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100b9e30
push 6
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100b9f30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x136], 0
je 0x100b9f57
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax + 0x43]
inc eax
xor byte [edx], cl
cmp eax, 0x135
jb 0x100b9f40
mov byte [esi + 0x136], 0
mov eax, esi
pop esi
ret

Function at 0x100ba070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 0xc], 0
je 0x100ba098
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 0xb
jb 0x100ba086
mov byte [edi + 0xc], 0
lea ecx, [edi + 0xb]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100ba0c0
push 0xb
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100ba0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 0xe], 0
je 0x100ba0f8
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 0xd
jb 0x100ba0e6
mov byte [edi + 0xe], 0
lea ecx, [edi + 0xd]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100ba120
push 0xd
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100ba130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 4], esi
cmp byte [edi + 0xd], 0
je 0x100ba158
xor edx, edx
lea ecx, [edi + edx]
lea eax, [edx + 0x2e]
inc edx
xor byte [ecx], al
cmp edx, 0xc
jb 0x100ba146
mov byte [edi + 0xd], 0
lea ecx, [edi + 0xc]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
cmp edi, ecx
je 0x100ba180
push 0xc
push edi
mov ecx, esi
call fcn.10016340
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100ddbb0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x102bf9d8], 0
jne 0x100ddbc9
push 0
push 0x10001
call fcn.100de0a0
add esp, 8
ret
jmp fcn.100e0000

Function at 0x100dfaa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x14]
push ebx
push esi
call fcn.100e0bc0
add esp, 0xc
test eax, eax
je 0x100dfaea
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0
je 0x100dfb3e
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x100dfaf1
call fcn.100e5f20
test eax, eax
je 0x100dfaea
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
call fcn.100e5a90
add esp, 0xc
test eax, eax
jne 0x100dfb30
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
cmp eax, 0x36002
jne 0x100dfb0e
call fcn.100e7220
test eax, eax
je 0x100dfaea
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
call fcn.100e6ce0
jmp 0x100dfae3
cmp eax, 0x36003
jne 0x100dfb30
call fcn.100e7dd0
test eax, eax
je 0x100dfaea
mov eax, dword [ebp + 0x14]
push eax
push edi
push esi
call fcn.100e7b80
add esp, 0xc
test eax, eax
je 0x100dfaea
push edi
push esi
call fcn.100dcb50
add esp, 8
test eax, eax
je 0x100dfaea
cmp dword [esi + 0x3c], 0
je 0x100dfb9e
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.100e0990
push esi
call fcn.100e12a0
add esp, 8
cmp dword [ebx + 0x28], 0
je 0x100dfbc1
push esi
call fcn.100de780
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
cmp dword [ebx + 0x10], 0
je 0x100dfbc1
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebx + 0x18], 0
je 0x100dfbc1
push esi
call fcn.100dfc80
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x100e0190
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x100e01fe
push esi
lea ecx, [edi + edi]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x100e01d9
push str.Win32:_Failed_to_allocate_global_handle_for_clipboard
push 0x10008
call fcn.100e3070
add esp, 8
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x100e0201
push str.Win32:_Failed_to_lock_global_handle
push 0x10008
call fcn.100e3070
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebp
ret
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x102c0cdc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x100e0233
push str.Win32:_Failed_to_open_clipboard
jmp 0x100e01e9
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x100e0350
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [0x102c1a90], eax
jne 0x100e03ad
cmp dword [ebp + 0xc], 0
je 0x100e0374
push eax
call fcn.100e1250
add esp, 4
mov esp, ebp
pop ebp
ret
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x100e03ad
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.100e3070
add esp, 8
mov esp, ebp
pop ebp
ret