joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4033d0
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x40ffe0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], ebx
lea eax, [esp + 0xc]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
mov dword [esp + 0x98], ebx
call dword [0x415f24]
cmp eax, ebx
jne 0x4034e7
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.00403e30
mov edx, dword [esp + 0xc]
mov edi, dword [0x415f18]
lea ecx, [esp + 0x14]
add esi, 0xc
push ecx
push ebx
push ebx
push ebx
push esi
push edx
mov byte [esp + 0x8c], 1
call edi
cmp eax, ebx
je 0x403487
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], bl
call fcn.00403e40
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4034f6
push eax
call dword [0x415f20]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
mov eax, dword [esp + 0x14]
push ebp
push eax
lea ecx, [esp + 0x18]
call fcn.00403f00
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
mov ebp, eax
push ecx
push ebp
push ebx
push ebx
push esi
push edx
call edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
push eax
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebp
push ebx
mov dword [esp + 0x54], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop ebp
jne 0x40350a
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], bl
call fcn.00403e40
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x4034f6
push eax
call dword [0x415f20]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
add esp, 0x6c
ret
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [0x415f1c]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
lea ecx, [esp + 0x10]
mov byte [esp + 0x74], bl
call fcn.00403e40
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x403546
push eax
call dword [0x415f20]
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret
Function at 0x403588
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x40fff8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.00402480
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.00402a30
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ebp, [eax + eax + 1]
test bp, bp
mov edi, ebp
je 0x40360f
lea ebx, [esi + 0xc]
add esi, 0x1c
mov eax, edi
and eax, 0xffff
push eax
push str.SEPS_04X
push 0xd
push ebx
call fcn.004094df
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00403e50
push ebx
mov ecx, esi
call fcn.00402940
mov eax, dword [esi]
test eax, eax
jne 0x4035f4
mov eax, 0x415f40
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40360a
add edi, ebp
test di, di
jne 0x4035bd
jmp 0x40360f
test di, di
jne 0x40363d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.00402490
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, esi
call fcn.004028b0
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00402490
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403c70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.00402480
xor ebx, ebx
lea ecx, [ebp - 0x10]
push ebx
mov dword [ebp - 4], ebx
call fcn.00402a90
lea ecx, [ebp - 0x14]
call fcn.00403e30
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.00403e50
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402530
lea ecx, [ebp - 0x14]
push ecx
mov ecx, 0x415f48
call fcn.00403e50
mov eax, dword [ebp - 0x10]
cmp eax, ebx
jne 0x403ce2
mov eax, 0x415f40
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x403d2b
add eax, 3
and al, 0xfc
call fcn.00409760
mov eax, dword [ebp - 0x10]
mov edi, esp
cmp eax, ebx
jne 0x403d07
mov eax, 0x415f40
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, ebx
je 0x403d2b
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x1c]
push edx
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
jne 0x403d4c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00402490
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.00402490
xor eax, eax
jmp 0x403e0e
lea ecx, [ebp - 0x18]
call fcn.00403e30
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
xor edx, edx
mov byte [ebp - 4], 3
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xFileDescription
push 0x80
push 0x80
lea ecx, [ebp - 0x18]
call fcn.00403f00
push eax
call fcn.004094df
add esp, 0x14
or esi, 0xffffffff
lea ecx, [ebp - 0x18]
push esi
call fcn.00403fa0
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x403da0
mov eax, 0x415f40
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x20]
push ecx
push edx
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
cmp eax, ebx
jne 0x403dd9
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00403e40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00402490
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00402490
xor eax, eax
jmp 0x403e0e
mov eax, dword [ebp - 0x20]
mov ecx, 0x415f48
push eax
call fcn.00403ea0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00403e40
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00402490
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00402490
mov eax, 1
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x34]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4052e7
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x405322
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x4052ff
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x40533e
dec esi
je 0x405337
dec esi
jne 0x405343
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x8de06c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de072
pop ebp
sub ebp, 6
sub ebp, 0x4de06c
jmp 0x8de0d0
mov esi, 0x1eaf093
add byte [eax], al
add byte [edx + 0x6b], dh
add byte [eax], al
jb 0x8de11d
sub ah, byte [edx + 0x200f4e81]
fist dword [ebp + 0x6a56d85a]
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
mov bh, 5
leave
lea edi, [eax + 0x4de06c]
jmp 0x8de0d9
mov eax, 0x4de06c
add eax, ebp
add eax, 0x93
mov ecx, 0x635
mov edx, 0xeb26d2fd
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de0f0
jmp 0x8de103
xchg edi, eax
mov ebp, 0xfdedfd95
std
xchg ebp, eax
std
xor ecx, edx
std
jl 0x8de11e
js 0x8de0a8
mov ah, 0xd2
jl 0x8de124
js 0x8de0ae
mov ah, 0xd2
into
cmp eax, 0xc16802ad
lodsd eax, dword [esi]
add ch, byte [eax - 0x3f]
fdivr qword [ecx + 0x3076adfd]
lodsd eax, dword [esi]
jbe 0x8de157
jbe 0x8de19d
sar ebp, 0xfd
std
jl 0x8de16b
add eax, 0xfefdfdfd
xor byte [ebp - 5], al
std
std
std
inc edi
aad 0xfd
std
std
or bl, byte [edi]
invalid
rcr ecx, 1
xchg ebp, eax
std
std
std
std
adc eax, 0xfdfdfdf8
adc al, 0xd7
std
std
std
test al, 0x70
xchg ecx, eax
fscale
jbe 0x8de1e7
cmc
std
std
std
jbe 0x8de1dd
int1
std
std
std
jbe 0x8de1eb
in eax, dx
std
std
std
cmp al, 0x14
dec esp
invalid
retf
std
xchg ebp, eax
hlt
cld
rcr ecx, 1
lodsb al, byte [esi]
adc eax, 0xfdfdfdf8
adc al, 0xb6
invalid
ljmp 0xea99:0xc7c6216
pop ds
imul eax, dword [ebx + 0x1f0f7cbd], 0xcebd8369
das
jle 0x8de1f8
cmp dword [ebp + 0x157e2fce], 0xfffffff8
adc eax, 0x79f2b5f8
clc
mov ch, 0xf2
jns 0x8de19b
mov bl, 0xfd
std
std
std
bnd jne 0x8de1a3
std
std
std
wait
jbe 0x8de1d5
les edi, [ebp + 6]
adc eax, 0xfde779f2
bnd jns 0x8de1e2
std
std
std
jge 0x8de206
adc al, 0xf2
jns 0x8de1f0
std
std
std
wait
jl 0x8de210
add bl, al
bnd jns 0x8de1f7
std
std
std
mov esp, 0x2023114
add dl, ah
mov cl, 0xc4
cld
jle 0x8de25a
clc
jle 0x8de236
stc
adc al, 0x40
add al, byte [edx]
add dl, ah
test eax, 0x3c7effc4
sti
jle 0x8de247
stc
jle 0x8de248
clc
adc al, 0x56
add al, byte [edx]
add ah, byte [eax - 0x57020ec1]
jbe 0x8de251
stosd dword es:[edi], eax
stosb byte es:[edi], al
test al, 0x76
mov cl, dh
jbe 0x8de1c8
xor ch, 1
dec edi
jge 0x8de2c4
cmc
add dword [edi + 0x7d], ecx
ja 0x8de249
sti
jl 0x8de28b
cmp edi, esp
cld
std
std
std
jne 0x8de250
jl 0x8de292
cld
std
std
std
inc esi
invalid
mov ebx, 0x7ef22fef
xchg edi, eax
std
std
std
into
cmp eax, 0x78f22fff
clc
bnd js 0x8de286
std
std
std
ja 0x8de27e
jmp 0x8de24f
mov ebx, 0x7ef22fef
xlatb
cld
std
std
jmp [edi]
mov ebx, 0x3dee2fef
jmp [edi]
Function at 0x10002aa0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10002aec
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10002acf
cmp edi, 2
jb 0x10002acf
cmp byte [esi], cl
jne 0x10002acf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10043828]
test edi, edi
jne 0x10002ab5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10002b1b
cmp cl, 0x23
jne 0x10002b02
cmp byte [esi], cl
jne 0x10002b02
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10043828]
test cl, cl
jne 0x10002af3
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10002c70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10002c82
mov dword [edi], 0
mov edx, 0x10043698
call fcn.10002b30
mov esi, eax
test esi, esi
jne 0x10002c96
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d53
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10002d53
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10002d53
mov eax, dword [0x1010e708]
test eax, eax
je 0x10002ce3
inc dword [eax + 0x370]
push dword [0x1010e700]
push ebx
call fcn.10002550
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10002d53
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10002d3c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x1010e708]
add esp, 4
test eax, eax
je 0x10002d24
dec dword [eax + 0x370]
push dword [0x1010e700]
push dword [ebp + 8]
call fcn.10002570
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10002d4b
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10005380
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041e93
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x1004c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x1010e708]
test eax, eax
je 0x100053b8
inc dword [eax + 0x370]
push dword [0x1010e700]
push 0x3b30
call fcn.10002550
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xd]
add esp, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x100053f1
push esi
mov ecx, eax
call fcn.10001620
mov edi, eax
mov dword [ebp - 0x14], eax
jmp 0x100053f6
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0xffffffff
mov esi, 0x100435e1
mov eax, dword [0x1010e708]
test eax, eax
mov dword [ebp - 0x20], 0
cmove eax, edi
mov dword [ebp - 0x34], str.Window
mov dword [0x1010e708], eax
or edx, 0xffffffff
mov al, 0x57
or edi, 0xffffffff
cmp al, 0x23
jne 0x10005435
cmp byte [esi], al
jne 0x10005435
cmp byte [esi + 1], al
cmove edx, edi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10043828]
test al, al
jne 0x10005427
mov edi, dword [ebp - 0x14]
not edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 0x100112e0
mov dword [ebp - 0x28], 0x10011380
mov esi, dword [edi + 0x2cf4]
mov ecx, dword [edi + 0x2cf8]
mov dword [ebp - 0x24], 0x10011450
cmp esi, ecx
jne 0x1000551c
inc esi
test ecx, ecx
je 0x1000548f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x10005494
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1000551c
mov eax, dword [0x1010e708]
test eax, eax
je 0x100054ac
inc dword [eax + 0x370]
push dword [0x1010e700]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.10002550
mov edx, dword [edi + 0x2cfc]
add esp, 8
mov dword [ebp - 0x14], eax
test edx, edx
je 0x10005510
mov ecx, dword [edi + 0x2cf4]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x2cfc]
add esp, 0xc
test ecx, ecx
je 0x100054fe
mov eax, dword [0x1010e708]
test eax, eax
je 0x100054fe
dec dword [eax + 0x370]
push dword [0x1010e700]
push ecx
call fcn.10002570
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi + 0x2cfc], eax
mov dword [edi + 0x2cf8], esi
mov eax, dword [edi + 0x2cf4]
movups xmm0, xmmword [ebp - 0x34]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2cfc]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 0x24]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2cf4]
mov byte [edi], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007d90
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x10007dcf
cmp bl, 0x23
jne 0x10007db1
cmp byte [esi], bl
jne 0x10007db1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10043828]
test bl, bl
jne 0x10007da2
mov ebx, dword [0x1010e708]
not eax
mov esi, dword [ebx + 0x198c]
mov edi, dword [ebx + 0x1994]
mov ecx, edi
test esi, esi
je 0x10007e14
nop dword [eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10007e08
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10007e0a
mov esi, edx
test esi, esi
jne 0x10007df0
mov ecx, dword [ebx + 0x1994]
mov edx, dword [ebx + 0x198c]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x10007e2c
cmp dword [edi], eax
jne 0x10007e2c
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10010df0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [0x1010e708]
push esi
mov esi, ebx
mov dword [ebp - 4], ecx
push edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov ecx, dword [esi + 0x2d00]
mov eax, dword [esi + 0x2d04]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 8], 0
cmp ecx, eax
jne 0x10010efe
lea edi, [ecx + 1]
test eax, eax
je 0x10010e5c
cdq
sub eax, edx
mov edx, dword [esi + 0x2d04]
sar eax, 1
add eax, edx
jmp 0x10010e67
mov edx, dword [esi + 0x2d04]
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, edx
jle 0x10010efe
push dword [0x1010e700]
inc dword [esi + 0x370]
lea eax, [edi*8]
sub eax, edi
shl eax, 2
push eax
call fcn.10002550
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d08]
test eax, eax
je 0x10010ee6
mov ecx, dword [esi + 0x2d00]
lea edx, [ecx*8]
sub edx, ecx
shl edx, 2
push edx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2d08]
add esp, 0xc
test ecx, ecx
je 0x10010ed7
mov eax, dword [0x1010e708]
test eax, eax
je 0x10010ed7
dec dword [eax + 0x370]
push dword [0x1010e700]
push ecx
call fcn.10002570
add esp, 8
mov ecx, dword [esi + 0x2d00]
mov dword [esi + 0x2d08], ebx
mov ebx, dword [0x1010e708]
mov dword [esi + 0x2d04], edi
movups xmm0, xmmword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [esi + 0x2d08]
movups xmmword [ecx + edx*4], xmm0
movq xmm0, qword [ebp - 0x10]
movq qword [ecx + edx*4 + 0x10], xmm0
mov dword [ecx + edx*4 + 0x18], eax
inc dword [esi + 0x2d00]
mov eax, dword [esi + 0x2d00]
lea ecx, [eax*8]
sub ecx, eax
mov eax, dword [esi + 0x2d08]
mov esi, dword [ebp - 4]
lea edi, [eax + ecx*4]
lea ecx, [esi + 1]
nop dword [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x10010f50
sub esi, ecx
test ebx, ebx
je 0x10010f63
inc dword [ebx + 0x370]
push dword [0x1010e700]
inc esi
push esi
call fcn.10002550
mov ebx, dword [ebp - 4]
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov dword [edi - 0x1c], eax
lea esi, [ebx + 1]
mov al, byte [ebx]
add esp, 0x14
or edx, 0xffffffff
test al, al
je 0x10010fb7
or ebx, 0xffffffff
cmp al, 0x23
jne 0x10010f9e
cmp byte [esi], al
jne 0x10010f9e
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10043828]
test al, al
jne 0x10010f90
not edx
lea eax, [edi - 0x1c]
mov dword [edi - 0x18], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100111e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [0x1010e708]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [esi + 0x2ce4], 0
test eax, eax
je 0x100112da
push edi
lea edi, [esi + 0x2ce8]
mov dword [esi + 0x2ce4], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x10011234
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.10012000
xor ecx, ecx
mov dword [edi], 0
cmp dword [edi + 4], ecx
jne 0x1001124c
push 8
mov ecx, edi
call fcn.10012000
mov ecx, dword [edi]
mov eax, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2cf4], 0
mov ebx, dword [edi]
jle 0x10011297
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x2cfc]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2cf4]
jl 0x10011270
mov ebx, dword [edi]
mov ecx, dword [ebp - 8]
lea eax, [ebx - 1]
neg ebx
mov edi, 0x1010e704
mov edx, 0x1004369c
sbb ebx, ebx
and ebx, eax
mov eax, dword [esi + 0x2cf0]
test eax, eax
cmovne edi, eax
call fcn.10002b30
mov esi, eax
test esi, esi
je 0x100112d8
push esi
push ebx
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020b80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x1004c00c]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
mov ebx, dword [0x1010e708]
lea eax, [esp + 0x24]
push esi
push edi
push eax
push dword [0x10110cf8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
movd xmm1, eax
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x30]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [esp + 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [esp + 0x20]
mov ecx, edi
sub ecx, dword [0x10110d00]
mov esi, dword [esp + 0x24]
mov edx, esi
sbb edx, dword [0x10110d04]
call fcn.10041a00
mov edx, dword [0x10110d0c]
mov ecx, dword [0x10110d08]
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
call fcn.10041a00
movss xmm1, dword [esp + 0x10]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x10110d04], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10110d00], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf8], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf9], al
call esi
mov esi, dword [0x1010e708]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xfb], 0
mov byte [ebx + 0xfa], al
cmp byte [esi + 0x357], 0
je 0x10020cb8
cvttss2si eax, dword [esi + 0xe0]
mov dword [esp + 0x10], eax
cvttss2si eax, dword [esi + 0xe4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
push eax
push dword [0x10110cf8]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x14]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe0], 0xff7fffff
mov dword [esi + 0xe4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10020d32
mov ecx, dword [0x10110cf8]
cmp eax, ecx
je 0x10020cec
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10020d32
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10020d32
lea eax, [esp + 0x18]
push eax
push dword [0x10110cf8]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10020d32
movd xmm0, dword [esp + 0x18]
movd xmm1, dword [esp + 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe0], xmm0
movss dword [esi + 0xe4], xmm1
cmp byte [ebx + 0xac], 0
je 0x10020d40
or eax, 0xffffffff
jmp 0x10020d4b
mov eax, dword [0x1010e708]
mov eax, dword [eax + 0x1d04]
cmp dword [0x1010df0c], eax
je 0x10020d5d
mov dword [0x1010df0c], eax
call fcn.100207e0
call fcn.10020900
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003d6f0
mov esp, ebp
pop ebp
ret