joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c211
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000c23b
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000c31d
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000c2ba
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000c25d
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000c310
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000c2cc
movzx esi, byte [esi + 1]
jmp 0x1000c2ce
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000c306
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000c309
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000db92
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000ddd7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10036c78]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000eb8b
test eax, eax
jne 0x1000ded9
mov ecx, dword [0x10036c7c]
cmp ecx, 1
jl 0x1000ded6
cmp ecx, 0x80
jg 0x1000ded6
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000ded6
test cl, 3
jne 0x1000ded6
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x1003af08]
test edx, edx
je 0x1000de4f
push 0x10036d00
push 0x10036c80
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000ded9
cmp dword [ebp + 0xc], 0
je 0x1000ded2
mov edi, 0x10036c80
jmp 0x1000de62
mov esi, dword [0x10036c78]
xor edx, edx
test ecx, ecx
jle 0x1000de89
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x10036c80]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x10036c7c]
jl 0x1000de6d
mov esi, dword [0x10036c78]
imul esi, esi, 0x60
push 0x10036d00
push ebx
push edi
call dword [esi + 0x1003aeec]
add esp, 0xc
test eax, eax
jne 0x1000ded9
mov ecx, dword [0x10036c7c]
xor edx, edx
test ecx, ecx
jle 0x1000dec8
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x10036c80]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x10036c7c]
add edx, 4
cmp edx, ecx
jl 0x1000deb0
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000de5c
xor eax, eax
jmp 0x1000ded9
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000e218
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10032628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x10037da0]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000eb8b
test eax, eax
jne 0x1000e325
mov ecx, dword [0x10037da4]
cmp ecx, 1
jl 0x1000e322
cmp ecx, 0x80
jg 0x1000e322
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000e322
test cl, 3
jne 0x1000e322
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x1003af0c]
test ecx, ecx
je 0x1000e2a3
push 0x10037e28
push 0x10037da8
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000e325
cmp dword [ebp + 8], 0
je 0x1000e31e
jmp 0x1000e2b1
mov esi, dword [0x10037da0]
imul esi, esi, 0x60
push 0x10037e28
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x1003aef0]
add esp, 0xc
test eax, eax
jne 0x1000e325
mov eax, dword [0x10037da4]
xor edi, edi
test eax, eax
jle 0x1000e30e
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x10037da8
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x10037da8]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x10037da4]
add edi, 4
cmp edi, eax
jl 0x1000e2ea
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000e2ab
xor eax, eax
jmp 0x1000e325
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001d2ce
leave
ret
Function at 0x1000f272
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000f162
test eax, eax
jne 0x1000f3b2
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x1003bfd8]
push dword [esi + 0x1003bfdc]
mov dword [ebp - 8], edi
call fcn.100158cd
push edi
mov dword [ebp - 4], eax
call fcn.100158cd
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000f3a3
test edi, edi
je 0x1000f39a
push edi
push ebx
call dword [esi + 0x1003c02c]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000f378
cmp dword [esi + 0x1003bfdc], eax
jbe 0x1000f2fe
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003bfdc]
jb 0x1000f2e3
push ebx
call dword [esi + 0x1003c024]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000f378
push dword [esi + 0x1003bfdc]
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003c028]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000f378
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x1003c028]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000f378
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003c02c]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000f378
cmp dword [ebp - 8], ecx
jbe 0x1000f371
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000f371
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000f35a
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.100157f0
push dword [ebp - 0xc]
call fcn.100157f0
push dword [ebp - 4]
call fcn.100157f0
add esp, 0xc
mov eax, edi
jmp 0x1000f3b1
push dword [ebp - 4]
call fcn.100157f0
pop ecx
test edi, edi
je 0x1000f3ae
push edi
call fcn.100157f0
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000f3b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000f162
test eax, eax
jne 0x1000f3f0
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x1003bfd8]
push dword [esi + 0x1003bfdc]
mov dword [ebp - 4], eax
call fcn.100158cd
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000f3f3
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x1003bfdc]
call fcn.100158cd
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000f419
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.100157f0
pop ecx
mov eax, ebx
jmp 0x1000f3ef
mov ecx, dword [esi + 0x1003bfdc]
cmp ecx, 0x10
jae 0x1000f461
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x10039f80
mov eax, ebx
call fcn.1000e478
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000f4e1
mov eax, dword [esi + 0x1003bfdc]
cmp dword [ebp - 4], eax
jae 0x1000f491
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000f489
push 0x10
push 0x10039f80
push eax
call fcn.1001c2d0
mov eax, dword [esi + 0x1003bfdc]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000f491
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000f12f
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x1003bfdc], eax
jbe 0x1000f4b6
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003bfdc]
jb 0x1000f49b
push edi
call dword [esi + 0x1003c024]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000f4e1
push dword [esi + 0x1003bfdc]
push dword [ebp - 8]
push edi
call dword [esi + 0x1003c028]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000f40c
push dword [edi + 0xe8]
call fcn.100157f0
pop ecx
jmp 0x1000f40c
Function at 0x1001d2ce
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032628]
jne 0x1001d2d8
repz ret
jmp fcn.10020cb2

Function at 0x1001e235
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001a4e0
and dword [ebp - 4], 0
cmp dword [0x100367dc], 0
mov ebx, eax
jne 0x1001e2e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001e397
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001e397
push eax
call fcn.1001a46e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100367dc], eax
call esi
push eax
call fcn.1001a46e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100367e0], eax
call esi
push eax
call fcn.1001a46e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100367e4], eax
call esi
push eax
call fcn.1001a46e
pop ecx
mov dword [0x100367ec], eax
test eax, eax
je 0x1001e2e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001a46e
pop ecx
mov dword [0x100367e8], eax
mov eax, dword [0x100367e8]
cmp eax, ebx
je 0x1001e33e
cmp dword [0x100367ec], ebx
je 0x1001e33e
push eax
call fcn.1001a4e9
push dword [0x100367ec]
mov esi, eax
call fcn.1001a4e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001e33e
test edi, edi
je 0x1001e33e
call esi
test eax, eax
je 0x1001e335
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001e335
test byte [ebp - 0xc], 1
jne 0x1001e33e
or dword [ebp + 0x10], 0x200000
jmp 0x1001e377
mov eax, dword [0x100367e0]
cmp eax, ebx
je 0x1001e377
push eax
call fcn.1001a4e9
pop ecx
test eax, eax
je 0x1001e377
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001e377
mov eax, dword [0x100367e4]
cmp eax, ebx
je 0x1001e377
push eax
call fcn.1001a4e9
pop ecx
test eax, eax
je 0x1001e377
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100367dc]
call fcn.1001a4e9
pop ecx
test eax, eax
je 0x1001e397
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001e399
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x438c78
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
sub eax, eax
push edi
pop eax
sub edi, 1
call fcn.00438cbb
or eax, eax
sub eax, 0x71eccc53
add eax, 0x1c458def
xor dword [ecx], esi
sub edi, edi
inc ecx
add edi, edi
add eax, 0x9950fca0
cmp ecx, ebx
jne fcn.00438c78
add eax, 1
ret

Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0x100053c2
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x1001ac1b
call fcn.1001a456
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 1
ja 0x100053ea
mov ecx, dword [0x10029d48]
call fcn.100043a3
test al, al
jne 0x100053ea
xor cl, cl
jmp 0x100053ec
mov cl, 1
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x10], cl
test edx, edx
jne 0x1000542c
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
cmp dword [esi + 8], 0
je 0x1000541d
movzx eax, cl
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.1000c166
mov esi, dword [esi]
mov cl, byte [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
jne 0x10005403
jmp 0x10005550
mov edi, dword [ebx + 0xc]
xor cl, cl
mov esi, dword [edi]
jmp 0x1000543f
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x10]
je 0x10005445
mov esi, dword [esi]
cmp esi, edi
jne 0x10005435
jmp 0x10005492
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov eax, ecx
or eax, edx
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
je 0x10005477
call dword [sym.imp.kernel32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jne 0x10005473
cmp eax, 0x1388
jbe 0x10005477
mov edi, esi
jmp 0x1000548c
movzx eax, byte [ebp - 0x10]
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.1000c166
mov cl, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, eax
jne 0x100054c7
test cl, cl
jne 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
mov ecx, dword [esi + 8]
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.1000c166
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054ab
jmp 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x100054ec
mov ecx, dword [esi + 8]
cmp edx, dword [ecx + 0x10]
je 0x100054e5
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.1000c166
mov edx, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054cd
mov ecx, dword [edi + 8]
push 1
push dword [ebp - 0x10]
push 0x80043074
call fcn.1000c166
push 0
lea ecx, [ebx + 0x3c]
call fcn.1000c166
mov esi, 0x10029eb0
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10029d58]
test eax, eax
je 0x1000552b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x10029d58], 0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x10005550
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
xor eax, eax
call fcn.1001a427
ret 0xc
Function at 0x1000c166
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000c175
pop dword [ebp - 0x28]
mov eax, 0xaf582c69
add eax, 0x60a8950c
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xe2bbd126
sub dword [ebp - 0x38], 0x94698bdb
mov dword [ebp - 0x34], 0x4203877b
sub dword [ebp - 0x34], 0xfd03b36
mov dword [ebp - 0x30], 0x75f7d9dc
add dword [ebp - 0x30], 0xd6546a52
mov dword [ebp - 0x2c], 0xbb1e06e0
add dword [ebp - 0x2c], 0x44e1f920
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x620c870b
add dword [ebp - 0x38], 0x1265e24b
mov dword [ebp - 0x34], 0x1f2fc94
sub dword [ebp - 0x34], 0xc0869b1f
mov dword [ebp - 0x30], 0x9adb87ef
add dword [ebp - 0x30], 0xc893e47d
mov dword [ebp - 0x2c], 0xf86c35b5
add dword [ebp - 0x2c], 0x793ca4b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x9c4bb0a5
add eax, 0x73b61f87
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35973
push 0
call eax
mov ecx, 0x534395fc
add ecx, 0xacbc9f70
mov edi, eax
mov ebx, 0x1002e000
add ebx, dword [ebp - 0x28]
mov esi, 0xaf543865
sub esi, 0xd7e6a986
add dword [ebp - 0x20], edx
mov edx, dword [ebx]
xor dword [ebp - 0xc], 0xf5ee21b1
sub edx, esi
xor dword [ebp - 0x24], 0x8cce5836
mov dword [edi], edx
xor dword [ebp - 8], 0x86c9ceab
add edi, 0x462688d3
add edi, 0xb9d97731
add ebx, 4
loop 0x1000c28c
add eax, 0x338b5319
sub eax, 0x338a8a96
mov ebx, eax
add eax, 5
mov ecx, 0x6aea72e2
sub ecx, 0x5aea72e2
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1000ce6b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push dword [eax + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop ebp
ret 4
Function at 0x1000ddaa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1001b43b
call fcn.1001a456
and dword [ebp - 0x14], 0
xor ecx, ecx
and dword [ebp - 0x18], 0
inc ecx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xd], cl
test edi, edi
jne 0x1000ddd5
mov esi, 0x80070057
jmp 0x1000df49
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], 0x1b
jne 0x1000de05
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
lea ecx, [ebx - 0x14]
push eax
call fcn.1000c166
mov esi, eax
test esi, esi
js 0x1000de02
cmp byte [ebp + 0xf], 0
je 0x1000de02
mov byte [ebp - 0xd], 0
jmp 0x1000de64
xor ecx, ecx
inc ecx
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1000de33
sub eax, 1
je 0x1000de2c
sub eax, 3
je 0x1000de25
sub eax, 1
jne 0x1000de64
mov eax, dword [0x10029d28]
jmp 0x1000de38
mov eax, dword [0x10029d30]
jmp 0x1000de38
mov eax, dword [0x10029d24]
jmp 0x1000de38
mov eax, dword [0x10029d2c]
test eax, eax
je 0x1000de64
cmp dword [ebx + 0xc4], 0
jne 0x1000de4d
cmp dword [ebx + 0x18], 0
jne 0x1000de4d
xor cl, cl
push ecx
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push dword [edi + 8]
push eax
call fcn.1000d1e8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000dee1
cmp dword [ebx + 0xc4], 4
jne 0x1000de7a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1000dee1
cmp dword [edi + 4], 0x100
je 0x1000de8c
cmp dword [edi + 4], 0x101
jne 0x1000dea7
cmp dword [edi + 8], 0x1b
jne 0x1000dea7
cmp dword [ebx + 0xc4], 0
jne 0x1000dea7
cmp dword [ebx + 0x18], 0
jne 0x1000dea7
cmp byte [ebp - 0xd], 0
jne 0x1000dee1
mov ecx, dword [ebx + 0x34]
xor esi, esi
test ecx, ecx
je 0x1000dec0
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x1001d700
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x1000df49
cmp dword [ebp - 0x18], 0
jne 0x1000ded5
mov esi, 0x8000ffff
jmp 0x1000df49
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, 1
jne 0x1000df3e
cmp dword [edi + 4], 0x100
jne 0x1000df0c
cmp dword [edi + 8], 9
jne 0x1000df3e
push 0
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push 9
push dword [0x10029d40]
call fcn.1000d1e8
jmp 0x1000df41
cmp dword [edi + 4], 0x104
jne 0x1000df3e
cmp dword [edi + 8], 0x79
jne 0x1000df3e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x1000df3e
push 0x10
call edi
test bx, ax
je 0x1000df3e
xor eax, eax
xor esi, esi
jmp 0x1000df41
mov eax, dword [ebp - 0x14]
test eax, eax
push 1
pop eax
cmovne esi, eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000df5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1001a427
ret 8