joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x1003c2be
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax]
test esi, esi
je 0x1003c13c
cmp eax, esi
jae 0x1003c2b9
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x1003c2b9
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x10114d80]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1003c16e
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x1003c183
mov bh, byte [esi]
jmp 0x1003c185
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x1003c193
mov ch, byte [esi]
jmp 0x1003c195
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x1003c1a3
mov bl, byte [esi]
jmp 0x1003c1a5
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x10114da0]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10114dc8]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x10114db4]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x10114ddc]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1003c296
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x1003c29c
add eax, ebx
test esi, esi
je 0x1003c2b6
mov ecx, dword [ebp - 0x10]
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1003c130
jmp 0x1003c2b9
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x1003c2cc
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c890
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
or eax, 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], str.Window
mov cl, 0x57
mov esi, 0x10114e55
or edi, 0xffffffff
cmp cl, 0x23
jne 0x1003c8c2
cmp byte [esi], cl
jne 0x1003c8c2
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10114940]
test cl, cl
jne 0x1003c8b3
mov esi, dword [ebp + 8]
not eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x10047020
mov dword [ebp - 0x14], 0x10047170
mov edi, dword [esi + 0x2ecc]
mov ecx, dword [esi + 0x2ed0]
mov dword [ebp - 0x10], 0x100470a0
mov dword [ebp - 0xc], 0x10046f50
mov dword [ebp - 8], 0x100471b0
cmp edi, ecx
jne 0x1003c9b7
inc edi
test ecx, ecx
je 0x1003c92a
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1003c92f
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1003c9b7
mov eax, dword [0x10135110]
test eax, eax
je 0x1003c947
inc dword [eax + 0x370]
push ebx
push dword [0x10135118]
lea eax, [edi + edi*8]
shl eax, 2
push eax
call dword [0x101334f0]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2ed4]
test eax, eax
je 0x1003c9aa
mov ecx, dword [esi + 0x2ecc]
lea ecx, [ecx + ecx*8]
shl ecx, 2
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2ed4]
add esp, 0xc
test ecx, ecx
je 0x1003c99a
mov eax, dword [0x10135110]
test eax, eax
je 0x1003c99a
dec dword [eax + 0x370]
push dword [0x10135118]
push ecx
call dword [0x101334f4]
add esp, 8
mov dword [esi + 0x2ed4], ebx
mov dword [esi + 0x2ed0], edi
pop ebx
mov eax, dword [esi + 0x2ecc]
movups xmm0, xmmword [ebp - 0x24]
push esi
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2ed4]
movups xmmword [eax + ecx*4], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax + ecx*4 + 0x10], xmm0
mov dword [eax + ecx*4 + 0x20], 0
inc dword [esi + 0x2ecc]
call fcn.1005a0c0
add esp, 4
mov byte [esi], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d4c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x101134b0
push dword [ebp + 8]
call fcn.1003ba10
mov esi, eax
add esp, 8
test esi, esi
je 0x1003d5b2
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push edi
push esi
call ebx
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x1003d5a6
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1003d5a6
push esi
call ebx
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1003d5a6
push 0
push edi
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1003d5a6
mov eax, dword [0x10135110]
test eax, eax
je 0x1003d53e
inc dword [eax + 0x370]
push dword [0x10135118]
push ebx
call dword [0x101334f0]
mov edi, eax
add esp, 8
test edi, edi
je 0x1003d5a6
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x1003d572
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x1003d582
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push ebx
push edi
call fcn.1003d5c0
add esp, 0xc
mov eax, dword [0x10135110]
test eax, eax
je 0x1003d591
dec dword [eax + 0x370]
push dword [0x10135118]
push edi
call dword [0x101334f4]
add esp, 8
pop edi
pop ebx
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x1003d970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x10135110]
cmp byte [esi + 0x2efc], 0
je 0x1003da0b
cmp dword [esi + 0x2f04], 0
push edi
lea edi, [esi + 0x2f08]
je 0x1003d9fc
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1003d9b6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100478b0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.10047460
mov edx, dword [edi]
mov ecx, 0x10135114
push dword [esi + 0x2f04]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2f10]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.10047460
pop edi
pop esi
pop ebp
ret
Function at 0x100408a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10135110]
movss xmm0, dword [0x10114fac]
push ebx
mov ebx, eax
mov dword [ebp - 4], ebx
comiss xmm0, dword [ebx + 0x1cd8]
ja 0x10040b09
cmp dword [ebx + 0x1cd4], 0
push esi
push edi
jne 0x1004091d
or edx, 0xffffffff
mov al, 0x23
mov esi, 0x10114ef1
or edi, 0xffffffff
nop
cmp al, 0x23
jne 0x100408ee
cmp byte [esi], al
jne 0x100408ee
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10114940]
test al, al
jne 0x100408e0
not edx
push edx
call fcn.1003a6d0
mov dword [ebx + 0x1cd4], eax
add esp, 4
mov eax, dword [0x10135110]
movss xmm2, dword [ebx + 0x10]
movss xmm1, dword [ebx + 0x14]
or dword [eax + 0x1af0], 0x10
mulss xmm2, dword [0x10114fb4]
mulss xmm1, dword [0x10114fb4]
movss xmm3, dword [0x10115014]
movss dword [eax + 0x1b2c], xmm2
movss dword [eax + 0x1b30], xmm1
movss dword [eax + 0x1b34], xmm3
movss dword [eax + 0x1b38], xmm3
mov dword [eax + 0x1b3c], 0
mov dword [eax + 0x1b40], 0
movss xmm2, dword [ebx + 0x10]
movss xmm1, dword [ebx + 0x14]
mov eax, dword [0x10135110]
mulss xmm2, dword [0x100cf714]
mulss xmm1, dword [0x100cf714]
or dword [eax + 0x1af0], 1
movss dword [eax + 0x1b00], xmm2
mov dword [eax + 0x1b08], 0x3f000000
movss dword [eax + 0x1b04], xmm1
mov dword [eax + 0x1b0c], 0x3f000000
mov dword [eax + 0x1af4], 1
lea eax, [ebp - 0xc]
movss xmm0, dword [ebx + 0x151c]
addss xmm0, xmm0
push eax
push 1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [ebx + 0x1520]
addss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.10042300
push 0xc1347
push 0
push str.NavWindowingList
call fcn.10035310
mov edi, dword [ebx + 0x1a38]
add esp, 0x14
sub edi, 1
js 0x10040af8
nop
mov eax, dword [ebx + 0x1a40]
mov esi, dword [eax + edi*4]
cmp byte [esi + 0x83], 0
je 0x10040aef
cmp esi, dword [esi + 0x318]
jne 0x10040aef
test dword [esi + 8], 0x80000
jne 0x10040aef
mov ecx, dword [esi]
mov edx, ecx
cmp ecx, 0xffffffff
jae 0x10040a75
mov bl, byte [edx]
test bl, bl
je 0x10040a6e
cmp bl, 0x23
jne 0x10040a68
cmp byte [edx + 1], bl
je 0x10040a6e
inc edx
cmp edx, 0xffffffff
jb 0x10040a58
mov ebx, dword [ebp - 4]
cmp ecx, edx
jne 0x10040ac5
mov eax, dword [esi + 8]
test eax, 0x4000000
je 0x10040a86
mov ecx, str._Popup_
jmp 0x10040ac5
test eax, 0x400
je 0x10040ac0
mov eax, str.MainMenuBar
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10040ab2
test dl, dl
je 0x10040aae
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10040ab2
add ecx, 2
add eax, 2
test dl, dl
jne 0x10040a92
xor eax, eax
jmp 0x10040ab7
sbb eax, eax
or eax, 1
mov ecx, str._Main_menu_bar_
test eax, eax
je 0x10040ac5
mov ecx, str._Untitled_
cmp dword [ebx + 0x1ccc], esi
lea eax, [ebp - 0xc]
push eax
sete al
mov dword [ebp - 0xc], 0
push 0
movzx eax, al
push eax
push ecx
mov dword [ebp - 8], 0
call fcn.1006c870
add esp, 0x10
sub edi, 1
jns 0x10040a20
call fcn.100394d0
push 1
call fcn.10041d10
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101344c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10135110]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1a6c]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp - 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10114940]
sub esi, 1
jne 0x10041f80
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10041fc7
inc ecx
test esi, esi
je 0x10041fb5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10041fba
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.100479b0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c9684
mov esp, ebp
pop ebp
ret

Function at 0x10044780
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10135110]
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x2ebc], 0
test esi, esi
je 0x100447d9
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push edi
push eax
call fcn.100447e0
push 0x10114f30
push esi
mov edi, eax
call fcn.1003ba10
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100447d8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x10046400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10135110]
cmp byte [edi + 0x2eb9], 0
lea eax, [edi + 0x20]
jne 0x10046525
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x1004651d
push esi
push 0x101134b0
push ecx
call fcn.1003ba10
mov esi, eax
add esp, 8
test esi, esi
je 0x10046519
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x1004650f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1004650f
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x1004650f
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1004650f
mov eax, dword [0x10135110]
test eax, eax
je 0x100464a5
inc dword [eax + 0x370]
push dword [0x10135118]
push ebx
call dword [0x101334f0]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1004650f
push esi
push dword [ebp - 4]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x100464fb
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x10135110]
test eax, eax
je 0x100464e9
dec dword [eax + 0x370]
push dword [0x10135118]
push ebx
call dword [0x101334f4]
add esp, 8
jmp 0x10046519
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp - 4]
push ebx
call fcn.1003d5c0
add esp, 0xc
jmp 0x100464da
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x2eb9], 1
pop ebx
movss xmm0, dword [edi + 0x2ebc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x10046576
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x2ebc], xmm0
jb 0x10046576
mov eax, dword [eax]
test eax, eax
je 0x10046565
push eax
call fcn.10044780
add esp, 4
mov dword [edi + 0x2ebc], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x358], 1
mov dword [edi + 0x2ebc], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1004f850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x1004f877
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1004f89c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1004f8c1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x1004f902
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1004f927
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1004f94c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.1003dab0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1004abc0
Function at 0x10058550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x101344c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.1003b180
mov edi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x2c]
push eax
push dword [0x10135168]
movups xmmword [ebp - 0x2c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x2c]
movd xmm0, eax
lea eax, [ebp - 0x14]
cvtdq2ps xmm0, xmm0
push eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss dword [edi + 0xc], xmm0
xorps xmm0, xmm0
movss dword [edi + 8], xmm1
movlpd qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [0x10135170]
mov edx, dword [ebp - 0x10]
sbb edx, dword [0x10135174]
call fcn.100ca280
mov edx, dword [0x1013517c]
mov ecx, dword [0x10135178]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.100ca280
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [0x10135170], eax
mov dword [0x10135174], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf4], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf5], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xf7], 0
mov byte [edi + 0xf6], al
call fcn.1003b180
mov esi, eax
cmp byte [esi + 0x34f], 0
je 0x1005868a
cvttss2si ecx, dword [esi + 0xdc]
lea eax, [ebp - 0xc]
push eax
push dword [0x10135168]
mov dword [ebp - 0xc], ecx
cvttss2si ecx, dword [esi + 0xe0]
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1005868a
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xdc], 0xff7fffff
mov dword [esi + 0xe0], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10058700
mov ecx, dword [0x10135168]
cmp eax, ecx
je 0x100586be
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10058700
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10058700
lea eax, [ebp - 0x1c]
push eax
push dword [0x10135168]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10058700
movd xmm0, dword [ebp - 0x1c]
movd xmm1, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xdc], xmm0
movss dword [esi + 0xe0], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x10058710
or eax, 0xffffffff
jmp 0x10058715
call fcn.1003b260
cmp dword [0x101336b0], eax
je 0x10058727
mov dword [0x101336b0], eax
call fcn.100589e0
call fcn.10058740
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9684
mov esp, ebp
pop ebp
ret
Function at 0x10073cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ce25d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x101344c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push 0
push closesocket
push 0
push dword [ebp + 0x10]
push eax
call fcn.10074210
mov eax, dword [ebp - 0x18]
add esp, 0x1c
mov ebx, dword [ebp - 0x1c]
sub eax, ebx
sar eax, 2
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10073db0
xor edi, edi
test eax, eax
je 0x10073db0
cmp edi, dword [ebp + 0x18]
jge 0x10073db0
mov esi, dword [ebx + edi*4]
lea eax, [ebp - 0x20]
push eax
push 0x40
push dword [ebp + 0x14]
push esi
push dword [0x10134a60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x24]
push esi
push dword [0x10134a60]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x20]
push dword [ebp + 0x14]
push esi
push dword [0x10134a60]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc edi
cmp edi, dword [ebp - 0x28]
jb 0x10073d62
test ebx, ebx
je 0x10073de6
mov ecx, dword [ebp - 0x14]
mov eax, ebx
sub ecx, ebx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10073ddc
mov ebx, dword [eax - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10073ddc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push ebx
call fcn.100c9894
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100c9684
mov esp, ebp
pop ebp
ret

Function at 0x100740f0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x101344c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x130], eax
push esi
push 2
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10074135
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9684
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1007418d
push dword [ebp - 0x130]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1007417c
mov eax, dword [ebp - 0x118]
cmp eax, esi
jbe 0x1007417c
mov ebx, dword [ebp - 0x124]
mov esi, eax
lea eax, [ebp - 0x12c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10074150
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c9684
mov esp, ebp
pop ebp
ret
Function at 0x1007fac0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x1007fb4c
push esi
call fcn.100938a0
add esp, 4
test al, al
jne 0x1007fb4c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1007fae3
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1009ccb0
add esp, 0xc
test eax, eax
je 0x1007fb17
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1009ccb0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1007fb19
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x1007fb45
mov al, byte [esi]
push eax
call fcn.1008ebc0
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x1007fb27
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret