joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d234
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44d24b
add esp, 0xfffffff0
call fcn.00403610
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041ad70
mov eax, dword [0x46b74c]
cmp word [eax + 2], 0
jne 0x44d273
mov eax, dword [0x46b74c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044e924
mov eax, dword [0x46b878]
cmp word [eax + 2], 0
jne 0x44d28d
mov eax, dword [0x46b878]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044eb1c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411b98]
call fcn.004032d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411b98]
call fcn.004032d4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cf44]
call fcn.00422b8c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44d414
mov eax, dword [0x46b5cc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00422f5c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44f0bc
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46b5cc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c5d8
test eax, eax
je 0x44d382
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408848
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c600
test eax, eax
je 0x44d396
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404330
mov eax, dword [0x46b3fc]
cmp byte [eax], 0
jne 0x44d3ca
mov eax, ebx
call fcn.0044d53c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044f298
mov eax, ebx
call fcn.0044fc5c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d40a
call fcn.00403668
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44d7bc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46cbb4]
cmp dword [eax + 0x30], 0
je 0x44d866
cmp dword [ebx + 0x94], 0
jne 0x44d860
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d74c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44d860
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44d826
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44d860
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414274
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44d835
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44e3c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44e3fd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041b0
jmp 0x44e40a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404114
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44f474
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f4b5
mov eax, esi
call fcn.00435e28
test al, al
je 0x44f4b5
mov eax, dword [ebx + 0x84]
call fcn.00435b50
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f4b5
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435b50
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4647e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x4647e8
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4649da
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x4649f0
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404114
lea ecx, [ebp - 0x10]
mov edx, 0x464a04
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404114
lea ecx, [ebp - 0x14]
mov edx, 0x464a1c
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404114
lea ecx, [ebp - 0x18]
mov edx, 0x464a38
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404114
lea ecx, [ebp - 0x1c]
mov edx, 0x464a54
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404114
lea ecx, [ebp - 0x24]
mov edx, 0x464a6c
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00407f88
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408268
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x464a84
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x28]
call fcn.004554b0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x464a94
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x2c]
call fcn.004554b0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x464aac
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408268
inc eax
je 0x46497d
lea ecx, [ebp - 0x34]
mov edx, 0x464aac
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x34]
call fcn.0040822c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.004097a4
fstp qword [ebp - 0x3c]
wait
call fcn.00409b08
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x464998
lea ecx, [ebp - 0x40]
mov edx, 0x464aac
mov eax, esi
call fcn.004610a0
mov eax, dword [ebp - 0x40]
call fcn.004554b0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x464abc
mov eax, esi
call fcn.004610a0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4649e1
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004040e4
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.004040e4
ret

Function at 0x468bfc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, eax
call fcn.00454e18
mov ebx, eax
jmp 0x468c15
mov eax, dword [0x46b838]
mov eax, dword [eax]
call fcn.0044e678
call fcn.00454e18
sub eax, ebx
cmp esi, eax
jge 0x468c09
xor eax, eax
pop esi
pop ebx
ret
Function at 0x468da4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x468e33
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404158
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402cf8
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404580
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468e3a
lea eax, [ebp - 4]
call fcn.004040c0
ret
Function at 0x10001da0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 5
jae 0x10001dae
xor al, al
pop ebx
ret
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push 0x90
push edi
call fcn.1004ecf0
mov eax, dword [esp + 0x1c]
add esp, 0xc
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov al, 1
pop ebx
ret

Function at 0x10001e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
mov edi, dword [esp + 0x10]
cmp edi, 5
jae 0x10001e0e
xor eax, eax
pop edi
ret
push ebx
push ebp
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, dword [esp + 0x10]
mov ebp, eax
test ebp, ebp
je 0x10001e46
push edi
test ebx, ebx
je 0x10001e3b
push ebx
push ebp
call fcn.1004e3c0
add esp, 0xc
jmp 0x10001e56
push 0
push ebp
call fcn.1004ecf0
add esp, 0xc
call fcn.10055e67
mov dword [eax], 0x16
call fcn.10055b40
mov eax, ebx
mov byte [edi + ebp], 0xe9
sub eax, ebp
sub eax, 5
mov dword [edi + ebp + 1], eax
lea eax, [esp + 0x18]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0x90
push ebx
call fcn.1004ecf0
mov eax, dword [esp + 0x20]
add esp, 0xc
sub eax, ebx
mov byte [ebx], 0xe9
sub eax, 5
mov dword [ebx + 1], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, ebp
pop ebp
pop ebx
pop edi
ret

Function at 0x100021c0
Capabilities:
Enumerate process modules

Disassembly:
sub esp, 0x42c
mov eax, dword [0x100a9570]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x43c]
xor ebx, ebx
push ebx
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x1000222d
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x428
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x1000222d
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.10055ef6
add esp, 8
test eax, eax
je 0x10002229
lea eax, [esp + 0xc]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10002206
jmp 0x1000222d
mov ebx, dword [esp + 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x434]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004d4b3
add esp, 0x42c
ret

Function at 0x10002250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.1004e3c0
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret
Function at 0x100058c0
Capabilities:
Load windows common language runtime

Disassembly:
sub esp, 0x10
mov byte [0x100aaca8], 1
cmp word [0x100aa898], 0
je 0x100059ea
push str.mscoree.dll
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x100059ea
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100059ea
lea ecx, [esp + 8]
push ecx
push 0x1006d2c0
push 0x1006d2d0
call eax
test eax, eax
jne 0x100059e4
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push 0x1006d2e0
push str.v4.0.30319
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x100059da
mov ecx, dword [esp + 4]
lea edx, [esp]
push edx
push 0x1006d2b0
push 0x1006d2a0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
test eax, eax
jne 0x100059d0
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, dword [esp]
lea edx, [esp + 0xc]
push edx
push 0x1006d938
push str.prejit_all
push str.Freedom.PreJit
mov dword [esp + 0x1c], 0
mov eax, dword [ecx]
push 0x100aa898
push ecx
call dword [eax + 0x2c]
test eax, eax
je 0x100059be
push eax
push 0x27
push str.bool___cdecl_prejit_all_void_
push str.ERROR:__s:_d:_pClrRuntimeHost__ExecuteInDefaultAppDomain_failed__error_code:_0x_X_n
push 0x100a91b8
call fcn.10002120
add esp, 0x14
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov al, 1
add esp, 0x10
ret
xor al, al
add esp, 0x10
ret
Function at 0x100059f0
Capabilities:
Load windows common language runtime

Disassembly:
sub esp, 0x10
cmp word [0x100aa898], 0
je 0x10005b19
push str.mscoree.dll
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10005b19
push str.CLRCreateInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10005b19
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
push ecx
push 0x1006d2c0
push 0x1006d2d0
call eax
test eax, eax
jne 0x10005b0d
mov ecx, dword [esp + 8]
lea edx, [esp + 4]
push edx
push 0x1006d2e0
push str.v4.0.30319
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x10005b03
mov ecx, dword [esp + 4]
lea edx, [esp]
push edx
push 0x1006d2b0
push 0x1006d2a0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x24]
test eax, eax
jne 0x10005af9
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ecx, dword [esp]
lea edx, [esp + 0xc]
push edx
push 0x1006d938
push str.prejit_all_f
mov eax, dword [ecx]
push str.Freedom.PreJit
push 0x100aa898
push ecx
call dword [eax + 0x2c]
test eax, eax
je 0x10005ae7
push eax
push 0x50
push str.bool___cdecl_prejit_all_f_void_
push str.ERROR:__s:_d:_pClrRuntimeHost__ExecuteInDefaultAppDomain_failed__error_code:_0x_X_n
push 0x100a91b8
call fcn.10002120
add esp, 0x14
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [esp]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esp + 0xc], 1
sete al
add esp, 0x10
ret
xor al, al
add esp, 0x10
ret

Function at 0x10005d20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
cmp byte [0x100aadc0], 0
je 0x10005d4a
push dword [0x100aadac]
push 0x100aadb0
push dword [0x100aada0]
call fcn.10002250
add esp, 0xc
mov byte [0x100aadc0], 0
call fcn.1000a6c0
call fcn.1000a810
call fcn.1000a920
cmp byte [0x100aad9c], 0
je 0x10005d82
push dword [0x100aad88]
push 0x100aad8c
push dword [0x100aad7c]
call fcn.10002250
add esp, 0xc
mov byte [0x100aad9c], 0
cmp byte [0x100aade4], 0
je 0x10005dab
push dword [0x100aadd0]
push 0x100aadd4
push dword [0x100aadc4]
call fcn.10002250
add esp, 0xc
mov byte [0x100aade4], 0
call fcn.1000b590
call fcn.1000bdb0
call fcn.1000b940
call fcn.1000ae40
call fcn.1000ba60
call fcn.1000af80
mov eax, dword [0x100aad70]
test eax, eax
je 0x10005e16
cmp dword [0x100aad74], 0
je 0x10005e16
lea ecx, [esp]
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x100aad70]
mov byte [eax], 0xe9
mov ecx, dword [0x100aad70]
mov eax, dword [0x100aad74]
mov dword [ecx + 1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push dword [0x100aad70]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x10005ea0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, dword [0x100aad70]
test eax, eax
je 0x10005eee
cmp dword [0x100aad74], 0
je 0x10005eee
lea ecx, [esp]
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x100aad70]
mov byte [eax], 0xe9
mov ecx, dword [0x100aad70]
mov eax, dword [0x100aad74]
mov dword [ecx + 1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push dword [0x100aad70]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10005f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov eax, dword [0x100aad70]
test eax, eax
je 0x10005fe3
cmp byte [eax], 0xe9
jne 0x10005fe3
lea ecx, [esp]
push ecx
push 0x40
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x100aad70]
mov eax, dword [ecx + 1]
mov dword [0x100aad74], eax
mov byte [ecx], 0xb8
mov ecx, dword [0x100aad70]
mov eax, dword [0x100a91d4]
mov dword [ecx + 1], eax
lea eax, [esp]
push eax
push dword [esp + 4]
push 5
push dword [0x100aad70]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x100078d0
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push eax
push 0x10007630
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 2
push 0x14
push 0x10
push 8
push 0x440
push 0x3780
push str.1.89.9
mov dword [0x100aadf0], eax
call fcn.10013070
push 0
call fcn.10012d20
call fcn.10015540
mov esi, eax
call fcn.10001830
push dword [0x100ac074]
call fcn.10001730
push eax
mov dword [esi + 0x18], eax
call fcn.10017dd0
call fcn.100077a0
call fcn.100076f0
push dword [0x100ac070]
call fcn.1004ae10
add esp, 0x2c
pop esi
jmp 0x100493b0
sub esp, 8
push esi
call fcn.10015540
push 0x18
mov esi, eax
call fcn.10018460
add esp, 4
mov dword [esp + 8], eax
test eax, eax
je 0x100493e8
xorps xmm0, xmm0
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x10], 0x1388
mov dword [eax + 0x14], 0x2710
jmp 0x100493ea
xor eax, eax
mov ecx, dword [esp + 0x10]
or dword [esi + 4], 8
mov dword [esi + 0x6c], eax
mov dword [esi + 0x64], str.imgui_impl_dx9
mov dword [eax], ecx
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov al, 1
pop esi
add esp, 8
ret
Function at 0x1000a200
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 8], 1
jne 0x1000a225
push 0
push 0
push dword [esp + 0xc]
push 0x10009da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
ret 0xc
Function at 0x10011300
Capabilities:
Hash data with crc32

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x100ac57c]
push edi
mov edi, dword [esp + 0x28]
mov ebp, dword [esi + 0x3e60]
mov ecx, ebp
mov eax, dword [ebp + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebp + 0x190], 0
mov dword [esp + 0x28], edi
jne 0x1001133f
cmp dword [esi + 0x4a28], 0
mov eax, 0x228
je 0x10011344
mov eax, 0x1f8
movss xmm4, dword [eax + ebp]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebp + 4]
mov edx, 1
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [esp + 0x20]
mov ebx, 2
movss xmm2, dword [0x100942b0]
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
cmovnp ecx, edx
ucomiss xmm0, xmm3
lahf
xor edx, edx
test ah, 0x44
cmovnp edx, ebx
or edx, ecx
comiss xmm3, xmm1
mov dword [esp + 0x10], edx
jb 0x100113be
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x100113be
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x100113cf
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x100113cf
movaps xmm0, xmm2
or dword [esi + 0x4714], ebx
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movss dword [esi + 0x4734], xmm1
movss dword [esi + 0x4738], xmm0
mov dword [esi + 0x471c], 1
mov eax, dword [ebp + 4]
push ebx
test ecx, ecx
je 0x10011417
push ecx
push eax
push str._s__s__08X
lea eax, [esp + 0x30]
push 0
push eax
call fcn.10016010
add esp, 0x18
jmp 0x1001142c
push eax
push str._s__08X
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.10016010
add esp, 0x14
cmp byte [esp + 0x24], 0
movss xmm0, dword [esi + 0x37b8]
movss dword [esp + 0x18], xmm0
jne 0x1001144b
mov dword [esi + 0x37b8], 0
push edi
push 0
push dword [esp + 0x28]
call fcn.1000eea0
mov edi, dword [esi + 0x3e60]
add esp, 0xc
movss xmm0, dword [esp + 0x18]
movss dword [esi + 0x37b8], xmm0
mov byte [esp + 0x24], al
cmp word [edi + 0xb6], 1
mov eax, dword [esp + 0x10]
mov dword [edi + 0x74], ebx
mov byte [edi + 0xc6], al
jne 0x1001149b
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebp + 0xf0], ecx
mov dword [ebp + 0xf4], eax
mov ebp, ebx
mov edx, 0x10093bb1
not ebp
mov al, 0x23
mov ebx, ebp
cmp al, 0x23
jne 0x100114b6
cmp byte [edx], al
jne 0x100114b6
cmp byte [edx + 1], al
cmove ebx, ebp
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x10092af8]
test al, al
jne 0x100114a8
not ebx
cmp dword [esi + 0x3eac], ebx
jne 0x100114e5
push 0
push 0
call fcn.10020700
add esp, 8
mov eax, dword [esp + 0x1c]
cmp dword [esi + 0x47fc], eax
jne 0x10011534
test dword [esp + 0x28], 0x800000
jne 0x10011534
cmp word [edi + 0x14c], 0
jne 0x1001150e
cmp byte [edi + 0x152], 0
je 0x10011534
push 0
push edi
call fcn.10014ea0
push 0
push edi
call fcn.10018790
push edi
push ebx
call fcn.10020700
mov eax, dword [esi + 0x4820]
add esp, 0x18
mov dword [esi + 0x3ecc], eax
mov al, byte [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100153e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea edx, [esp + 0x10]
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10092af8]
sub esi, 1
jne 0x10015400
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e94], ebx
jne 0x10015436
push esi
push dword [esp + 0x14]
push 4
push ebx
call fcn.10013100
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x100154a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov edx, ecx
push esi
push edi
lea esi, [esp + 8]
mov edi, 0x10
movss xmm1, dword [edx + 0x100]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x104]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe4]
movss dword [esp + 8], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [esp + 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [esp + 0x10], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xec]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [esp + 0x14], xmm0
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10092af8]
sub edi, 1
jne 0x10015511
not edx
pop edi
mov eax, edx
pop esi
add esp, 0x10
ret 4

Function at 0x10016190
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
test edi, edi
je 0x100161f2
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100161d6
cmp edi, 2
jb 0x100161d6
cmp byte [esi], cl
jne 0x100161d6
cmp byte [esi + 1], cl
jne 0x100161d6
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10092af8]
jmp 0x100161a7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10092af8]
test edi, edi
jne 0x100161a7
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10016228
nop dword [eax]
cmp cl, 0x23
jne 0x1001620f
cmp byte [esi], cl
jne 0x1001620f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10092af8]
test cl, cl
jne 0x10016200
pop edi
pop esi
not eax
pop ebx
ret