joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439990
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x4399b5
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x4399bb
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x439ad0
push edi
lea ecx, [ecx]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x439a0d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x439a66
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x439a50
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x439a30
mov esi, dword [esp + 0x14]
test esi, esi
je 0x439ab1
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x439a90
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x439a90
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x4399f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402c00
pop dword [ebp - 0x50]
mov eax, 0x402c00
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xd78c4a3b
add dword [ebp - 0x60], 0x76c5fb10
mov dword [ebp - 0x5c], 0x7af72318
sub dword [ebp - 0x5c], 0x48c3d6d3
mov dword [ebp - 0x58], 0xd71d4bb
add dword [ebp - 0x58], 0x3eda6f73
mov dword [ebp - 0x54], 0x10bec55d
add dword [ebp - 0x54], 0xef413aa3
lea eax, [ebp - 0x60]
push eax
mov eax, 0xf694c23c
add eax, 0x9abae28
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xa4cd69bb
sub dword [ebp - 0x60], 0x305b0065
mov dword [ebp - 0x5c], 0x9d947cd2
sub dword [ebp - 0x5c], 0x5c281b5d
mov dword [ebp - 0x58], 0x7784f58e
add dword [ebp - 0x58], 0xebea76de
mov dword [ebp - 0x54], 0x52a74200
sub dword [ebp - 0x54], 0x52a74200
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c5ca
push 0
call eax
mov ecx, 0xe770110e
add ecx, 0x18904da3
xor edx, edx
add edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x50]
mov edi, 0xffe8a3c
sub edi, 0x54aac75
sub dword [ebp - 0x24], 0x9c5a33a2
mov esi, dword [ebx]
add dword [ebp - 0x40], ebx
xor esi, edi
mov dword [ebp - 0x38], 0x4e767f7e
mov dword [edx], esi
mov dword [ebp - 0x3c], 0xb329a610
add edx, 0xc9b958c2
sub edx, 0xc9b958be
add ebx, 0xeb9959b3
add ebx, 0x1466a651
loop 0x402d14
add eax, 0xba1da0d2
sub eax, 0xba1c333b
mov ebx, eax
add eax, 0x572f759a
add eax, 0xa8d08a6b
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x348bcc34
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
test edi, edi
je 0x348bcd92
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x348bcd92
mov esi, dword [ebp]
test esi, esi
je 0x348bcd92
push ebx
mov ebx, dword [esp + 0x20]
cmp ebx, 1
jne 0x348bcc75
cmp esi, 2
jae 0x348bcc75
pop ebx
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ebp
push edi
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [esp + 0x24], eax
jne 0x348bcd87
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x348bccc2
cmp ebx, 1
jne 0x348bccaf
cmp ecx, 2
je 0x348bcccb
pop ebx
pop edi
mov dword [esp + 0x1c], 0x65d
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
ret 0x18
cmp ebx, 1
jne 0x348bcd87
mov eax, dword [ebp]
cmp eax, esi
jae 0x348bcce0
shr eax, 1
mov word [edi + eax*2], 0
mov ecx, dword [esp + 0x28]
jmp 0x348bcceb
mov edx, esi
shr edx, 1
mov word [edi + edx*2 - 2], 0
cmp ecx, 2
jne 0x348bcd87
push esi
call dword [sym.imp.msvcr80.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x348bcd10
pop ebx
pop edi
pop esi
mov eax, 0xe
pop ebp
ret 0x18
shr esi, 1
push esi
push ebx
push edi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
test eax, eax
jbe 0x348bcd69
cmp esi, eax
lea ecx, [eax + eax]
mov dword [ebp], ecx
jae 0x348bcd4b
push ebx
mov word [edi], 0
mov dword [esp + 0x28], 0xea
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
push esi
push edi
push ebx
call dword [sym.imp.MSO.dll_Ordinal_6877]
push ebx
call dword [sym.imp.msvcr80.dll_free]
mov eax, dword [esp + 0x28]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
mov word [edi], 0
push ebx
mov dword [ebp], 0
mov dword [esp + 0x28], 0x57
call dword [sym.imp.msvcr80.dll_free]
add esp, 4
mov eax, dword [esp + 0x24]
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
pop edi
pop esi
mov eax, 0x57
pop ebp
ret 0x18
Function at 0x348bd622
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x34895250]
jne 0x348bdbed
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x348c5630], eax
mov dword [0x348c562c], ecx
mov dword [0x348c5628], edx
mov dword [0x348c5624], ebx
mov dword [0x348c5620], esi
mov dword [0x348c561c], edi
mov word [0x348c5648], ss
mov word [0x348c563c], cs
mov word [0x348c5618], ds
mov word [0x348c5614], es
mov word [0x348c5610], fs
mov word [0x348c560c], gs
pushfd
pop dword [0x348c5640]
mov eax, dword [ebp]
mov dword [0x348c5634], eax
mov eax, dword [ebp + 4]
mov dword [0x348c5638], eax
lea eax, [ebp + 8]
mov dword [0x348c5644], eax
mov eax, dword [ebp - 0x320]
mov dword [0x348c5580], 0x10001
mov eax, dword [0x348c5638]
mov dword [0x348c5534], eax
mov dword [0x348c5528], 0xc0000409
mov dword [0x348c552c], 1
mov eax, dword [0x34895250]
mov dword [ebp - 0x328], eax
mov eax, dword [0x348c1c78]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x348c5578], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34895290
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x348c5578], 0
jne 0x348bdcdd
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x10031e3d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10031dbf

Function at 0x10032729
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10043738
push 0x10043730
push str.FlsAlloc
push 0x1e
call fcn.100325c7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003275d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c110]
call esi
jmp 0x10032763
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100327a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10043748
push 0x10043740
push str.FlsGetValue
push 0x20
call fcn.100325c7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100327de
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c110]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100350de
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003517b
push ebx
push esi
call fcn.100350a7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10034ff0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10035128
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003517a
push edi
push eax
call fcn.1002fff8
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10035148
call fcn.1002ffbe
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035179
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10034ff0
add esp, 0x20
test eax, eax
jne 0x10035167
push edi
call fcn.1002ffbe
jmp 0x1003516f
push ebx
call fcn.1002ffbe
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1003aaf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003ab1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003ab1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401260
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x78
call sym.___main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x4012ed
cmp al, 9
je 0x4012e0
cmp al, 0x20
je 0x4012e0
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp al, 0x5c
je 0x401348
cmp al, 0x22
je 0x401350
mov dword [ebp - 0x6c], 0
movzx eax, byte [ebx + 1]
inc ebx
test al, al
je 0x4012ed
cmp al, 9
sete cl
cmp al, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x4012a0
test edi, 1
jne 0x4012a0
lea esi, [esi]
movzx eax, byte [ebx + 1]
inc ebx
cmp al, 9
je 0x4012e0
cmp al, 0x20
je 0x4012e0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x401308
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
inc dword [ebp - 0x6c]
jmp 0x4012b7
and dword [ebp - 0x6c], 1
jne 0x4012b0
xor edi, 1
jmp 0x4012b7

Function at 0x401ef4
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 4
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edx
jle 0x401f46
mov eax, dword [ebp + 8]
mov ebx, edx
mov cl, 7
and bl, 7
sub cl, bl
mov byte [ebp - 2], cl
movzx ecx, cl
mov cl, byte [ecx + 0x40b030]
xor cl, byte [edx + eax]
mov byte [ebp - 1], cl
mov byte [ebp - 3], cl
mov cl, byte [ebp - 2]
ror byte [ebp - 1], cl
mov cl, byte [ebp - 3]
movzx ecx, bl
mov cl, byte [ecx + 0x40b030]
xor byte [ebp - 1], cl
mov bl, byte [ebp - 1]
mov byte [edx + eax], bl
inc edx
cmp esi, edx
jg 0x401f08
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001731
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10001740
pop dword [ebp - 0xc]
mov eax, 0x6d480d68
sub eax, 0x5d47f628
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x37f9220e
sub dword [ebp - 0x1c], 0xe9a6dcc3
mov dword [ebp - 0x18], 0xed29ff48
sub dword [ebp - 0x18], 0xbaf6b303
mov dword [ebp - 0x14], 0xcc81df89
add dword [ebp - 0x14], 0x7fca64a5
mov dword [ebp - 0x10], 0x6b11431f
sub dword [ebp - 0x10], 0x6b11431f
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9c1d90f9
sub eax, 0x8c1bc0f1
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8b12d1fb
add dword [ebp - 0x1c], 0xe95f975b
mov dword [ebp - 0x18], 0xe47838a7
add dword [ebp - 0x18], 0x5cf428ce
mov dword [ebp - 0x14], 0x16a83bb1
add dword [ebp - 0x14], 0x4cc730bb
mov dword [ebp - 0x10], 0x9e0cc0c9
add dword [ebp - 0x10], 0x61f33f37
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x998909c9
add eax, 0x7678c663
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3d9cb
push 0
call eax
mov ecx, 0x8004d0cf
add ecx, 0x7ffb8490
mov esi, eax
mov edx, 0xbac2c1d4
add edx, 0x55401e2c
add edx, dword [ebp - 0xc]
mov edi, 0x53411f85
add edi, 0xf8ea088e
add dword [ebp - 4], eax
mov ebx, dword [edx]
xor dword [ebp - 8], 0x8bc545fb
sub ebx, edi
sub dword [ebp - 4], edx
mov dword [esi], ebx
xor dword [ebp - 8], ecx
add esi, 0xae701041
add esi, 0x518fefc3
add edx, 0x7894486b
sub edx, 0x78944867
loop 0x10001862
add eax, 0x1484f
xor ebx, ebx
add ebx, eax
add eax, 0xd0a53993
add eax, 0x2f5ac672
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x100053c2
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x1001ac1b
call fcn.1001a456
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 1
ja 0x100053ea
mov ecx, dword [0x10029d48]
call fcn.100043a3
test al, al
jne 0x100053ea
xor cl, cl
jmp 0x100053ec
mov cl, 1
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x10], cl
test edx, edx
jne 0x1000542c
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
cmp dword [esi + 8], 0
je 0x1000541d
movzx eax, cl
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.10001731
mov esi, dword [esi]
mov cl, byte [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
jne 0x10005403
jmp 0x10005550
mov edi, dword [ebx + 0xc]
xor cl, cl
mov esi, dword [edi]
jmp 0x1000543f
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x10]
je 0x10005445
mov esi, dword [esi]
cmp esi, edi
jne 0x10005435
jmp 0x10005492
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov eax, ecx
or eax, edx
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
je 0x10005477
call dword [sym.imp.kernel32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jne 0x10005473
cmp eax, 0x1388
jbe 0x10005477
mov edi, esi
jmp 0x1000548c
movzx eax, byte [ebp - 0x10]
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.10001731
mov cl, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, eax
jne 0x100054c7
test cl, cl
jne 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
mov ecx, dword [esi + 8]
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.10001731
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054ab
jmp 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x100054ec
mov ecx, dword [esi + 8]
cmp edx, dword [ecx + 0x10]
je 0x100054e5
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.10001731
mov edx, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054cd
mov ecx, dword [edi + 8]
push 1
push dword [ebp - 0x10]
push 0x80043074
call fcn.10001731
push 0
lea ecx, [ebx + 0x3c]
call fcn.10001731
mov esi, 0x10029eb0
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10029d58]
test eax, eax
je 0x1000552b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x10029d58], 0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x10005550
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
xor eax, eax
call fcn.1001a427
ret 0xc
Function at 0x1000ddaa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1001b43b
call fcn.1001a456
and dword [ebp - 0x14], 0
xor ecx, ecx
and dword [ebp - 0x18], 0
inc ecx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xd], cl
test edi, edi
jne 0x1000ddd5
mov esi, 0x80070057
jmp 0x1000df49
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], 0x1b
jne 0x1000de05
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
lea ecx, [ebx - 0x14]
push eax
call fcn.10001731
mov esi, eax
test esi, esi
js 0x1000de02
cmp byte [ebp + 0xf], 0
je 0x1000de02
mov byte [ebp - 0xd], 0
jmp 0x1000de64
xor ecx, ecx
inc ecx
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1000de33
sub eax, 1
je 0x1000de2c
sub eax, 3
je 0x1000de25
sub eax, 1
jne 0x1000de64
mov eax, dword [0x10029d28]
jmp 0x1000de38
mov eax, dword [0x10029d30]
jmp 0x1000de38
mov eax, dword [0x10029d24]
jmp 0x1000de38
mov eax, dword [0x10029d2c]
test eax, eax
je 0x1000de64
cmp dword [ebx + 0xc4], 0
jne 0x1000de4d
cmp dword [ebx + 0x18], 0
jne 0x1000de4d
xor cl, cl
push ecx
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push dword [edi + 8]
push eax
call fcn.1000d1e8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000dee1
cmp dword [ebx + 0xc4], 4
jne 0x1000de7a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1000dee1
cmp dword [edi + 4], 0x100
je 0x1000de8c
cmp dword [edi + 4], 0x101
jne 0x1000dea7
cmp dword [edi + 8], 0x1b
jne 0x1000dea7
cmp dword [ebx + 0xc4], 0
jne 0x1000dea7
cmp dword [ebx + 0x18], 0
jne 0x1000dea7
cmp byte [ebp - 0xd], 0
jne 0x1000dee1
mov ecx, dword [ebx + 0x34]
xor esi, esi
test ecx, ecx
je 0x1000dec0
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x1001d700
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x1000df49
cmp dword [ebp - 0x18], 0
jne 0x1000ded5
mov esi, 0x8000ffff
jmp 0x1000df49
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, 1
jne 0x1000df3e
cmp dword [edi + 4], 0x100
jne 0x1000df0c
cmp dword [edi + 8], 9
jne 0x1000df3e
push 0
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push 9
push dword [0x10029d40]
call fcn.1000d1e8
jmp 0x1000df41
cmp dword [edi + 4], 0x104
jne 0x1000df3e
cmp dword [edi + 8], 0x79
jne 0x1000df3e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x1000df3e
push 0x10
call edi
test bx, ax
je 0x1000df3e
xor eax, eax
xor esi, esi
jmp 0x1000df41
mov eax, dword [ebp - 0x14]
test eax, eax
push 1
pop eax
cmovne esi, eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000df5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1001a427
ret 8
Function at 0x411e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x510a08
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp dword [edi + 0x44], 0
je 0x411f6f
cmp byte [edi + 0x4a], 0
je 0x411f6f
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
jne 0x411e8a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
lea esi, [ebp - 0x2c]
call fcn.00411770
mov dword [ebp - 4], 0
push ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x411ead
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x10]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x411ef1
dec eax
je 0x411ef5
sub eax, 2
je 0x411f4e
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.004150e0
pop ebx
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x4a], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x411f05
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, ecx
je 0x411f2f
cmp edx, 0x10
jae 0x411f14
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x411ed0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], 0
je 0x411f4e
test esi, esi
jne 0x411ea1
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.00411840
jmp 0x411e9b
mov dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x2c]
call fcn.004150e0
pop ebx
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret