joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c5240
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d6a18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.004147e0
push 0x100
mov dword [ebp - 4], 0
mov dword [esi], vtable.Poco::BasicBufferedStreamBuf_char__struct_std::char_traits_char___class_Poco::BufferAllocator_char__.0
mov dword [esi + 0x38], 0x100
mov dword [esi + 0x3c], 0
call fcn.005021d8
mov dword [esi + 0x40], eax
add esp, 4
mov dword [esi + 0x44], 1
lea ecx, [eax + 4]
mov eax, dword [esi + 0xc]
mov dword [eax], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
sub ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x40]
mov edx, dword [esi + 0x38]
add edx, ecx
mov dword [eax], ecx
sub edx, ecx
mov eax, dword [esi + 0x20]
mov dword [eax], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, esi
mov dword [esi], vtable.Poco::RandomBuf.0
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5c5710
Capabilities:
Generate random numbers via winapi

Disassembly:
push ecx
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push dword [esp + 8]
push dword [esp + 0x10]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0xc]
pop ecx
ret 0xc

Function at 0x5c5be0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
jmp 0x5c5bf0
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x5c5c0f
push 0
push 0x5e
push str.c:projectsgitpoco_build_foundation_srcFile_WIN32U.cpp
push str.__path.empty__
call fcn.00510790
add esp, 0x10
cmp dword [esi + 0x30], 8
lea eax, [esi + 0x1c]
jb 0x5c5c1a
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x5c5c46
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 0x13
ja case.0x5c5c3b.4
movzx eax, byte [eax + 0x5c5c5c]
jmp dword [eax*4 + 0x5c5c54]
xor al, al
pop esi
ret
mov al, 1
pop esi
ret
lea eax, [esi + 4]
push eax
call fcn.005c5c80
nop
inc edx
pop esp
pop esp
add byte [edx + 0x5c], cl
pop esp
add byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add bh, bh
invalid
je 0x5c5c97
add al, 0xe8
pop es
add byte [eax], al
add ah, cl
int3
add byte [ecx + 0x84ec], al
add byte [esi - 1], dl
adc eax, sym.imp.KERNEL32.dll_GetLastError
Function at 0x5c5c80
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d6f88
push eax
mov dword fs:[0], esp
sub esp, 0x84
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x10b
ja 0x5c5e58
je case.0x5c5cce.123
lea eax, [esi - 2]
cmp eax, 0xcc
ja case.0x5c5cce.4
movzx eax, byte [eax + 0x5c5ef4]
jmp dword [eax*4 + 0x5c5eb8]
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00503920
push 0x63cc58
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00503800
push 0x63cd30
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005038d0
push 0x63cc10
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005033c0
push 0x63cd78
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00503490
push 0x63ce98
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.005042b0
push 0x63ce08
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.00503ef0
push 0x63ce50
lea eax, [ebp - 0x38]
push eax
call fcn.005879e4
push str.sharing_violation
lea ecx, [ebp - 0x24]
call fcn.0040e5f0
mov dword [ebp - 4], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x64]
call fcn.00503850
push 0x63cbcc
lea eax, [ebp - 0x64]
push eax
call fcn.005879e4
push str.lock_violation
lea ecx, [ebp - 0x24]
call fcn.0040e5f0
mov dword [ebp - 4], 1
jmp 0x5c5d9f
push str.EOF_reached
lea ecx, [ebp - 0x24]
call fcn.0040e5f0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x64]
call fcn.00503ec0
push 0x63ce50
jmp 0x5c5db4
push str.disk_is_full
lea ecx, [ebp - 0x24]
call fcn.0040e5f0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x64]
call fcn.00504280
push 0x63ce08
jmp 0x5c5db4
push str.negative_seek
lea ecx, [ebp - 0x24]
call fcn.0040e5f0
mov dword [ebp - 4], 4
jmp 0x5c5d9f
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00503db0
push 0x63cb44
jmp 0x5c5db4
cmp esi, 0x781
je case.0x5c5cce.3
cmp esi, 0x1779
je 0x5c5e87
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x90]
call fcn.00503880
push 0x63cbcc
lea eax, [ebp - 0x90]
jmp 0x5c5db7
push 0x1779
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00503970
push 0x63cce8
jmp 0x5c5db4
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x64]
call fcn.00503d60
push 0x63cca0
jmp 0x5c5db4
Function at 0x5c77c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7121
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
xor ecx, ecx
mov dword [ebp - 0x10], 0
mov eax, 0x7fff
mov dword [ebp - 4], 0
mov edx, 2
mov dword [ebp - 0x20], 0x7fff
mul edx
push esi
push edi
seto cl
mov dword [ebp - 0x1c], 0x7fff
neg ecx
mov byte [ebp - 0x14], 1
or ecx, eax
push ecx
call fcn.005021d8
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push 0x7fff
push edi
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x5c78f5
push 0x7fff
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x5c7879
push str.Cannot_get_system_directory_long_path_name
lea ecx, [ebp - 0x38]
call fcn.0040e5f0
mov byte [ebp - 4], 2
push 0
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x64]
call fcn.00504110
push 0x63c9bc
lea eax, [ebp - 0x64]
push eax
call fcn.005879e4
mov esi, dword [ebp + 8]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], 0
jb 0x5c78a2
mov eax, dword [esi]
jmp 0x5c78a4
mov eax, esi
mov byte [eax], 0
push esi
push edi
mov dword [ebp - 0x10], 1
call fcn.0050bef0
mov ecx, dword [esi + 0x10]
add esp, 8
cmp dword [esi + 0x14], 0x10
jb 0x5c78c5
mov eax, dword [esi]
jmp 0x5c78c7
mov eax, esi
cmp byte [eax + ecx - 1], 0x5c
je 0x5c78da
push 0x5e7210
mov ecx, esi
call fcn.0040e470
push edi
call fcn.00501fb5
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x23
push str.Cannot_get_temporary_directory_path
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x38], 0
call fcn.0040e960
mov byte [ebp - 4], 3
jmp 0x5c785d

Function at 0x5c7cc0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 8], 0
cmp dword [esi + 0x14], 0x10
jb 0x5c7cdb
mov eax, dword [esi]
jmp 0x5c7cdd
mov eax, esi
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test ebx, ebx
je 0x5c7d54
push edi
push ebx
call fcn.005021d8
add esp, 4
mov edi, eax
cmp dword [esi + 0x14], 0x10
jb 0x5c7d02
mov esi, dword [esi]
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [esp + 0x40]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edi], 0
jne 0x5c7d29
xor ecx, ecx
jmp 0x5c7d39
mov ecx, edi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c7d30
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.0040e960
push edi
call fcn.00501fb5
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x30
ret
push 0
push esi
lea ecx, [esp + 0x14]
call fcn.00503be0
push 0x6340e8
lea eax, [esp + 0x10]
push eax
call fcn.005879e4
int3
Function at 0x10001c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x30
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x47
ja case.0x10001c49.10
mov edx, dword [ebp - 4]
movzx eax, byte [edx + 0x10001cc0]
jmp dword [eax*4 + 0x10001cb4]
mov dword [ebp + 0xc], 0
jmp 0x10001c69
mov dword [ebp + 0xc], 4
jmp 0x10001c69
mov dword [ebp + 0xc], 0xffffffff
cmp dword [ebp + 0xc], 0xffffffff
jne 0x10001c71
jmp 0x10001cad
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x10001c94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.10003640
mov dword [eax], esi
jmp 0x10001cad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
lea eax, [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x18
call fcn.10003640
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x1000f6c0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0xff
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0xff
push 0
push 0x102b3a1c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000f6fe
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100119a0
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 8]
test ecx, ecx
jne 0x10011a55
mov edx, dword [ebp - 4]
mov byte [edx + 8], 1
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100119f5
push str.Winsock_DLL_Initialize_error._r_n
push 0x1855d10
mov ecx, 0xf598fb
call ecx
add esp, 8
xor eax, eax
jmp 0x10011a5a
movzx edx, word [ebp - 0x198]
and edx, 0xff
movzx eax, dl
cmp eax, 2
jne 0x10011a22
movzx ecx, word [ebp - 0x198]
shr ecx, 8
and ecx, 0xff
movzx edx, cl
cmp edx, 2
je 0x10011a40
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.Winsock_version_low._r_n
push 0x1855d10
mov eax, 0xf598fb
call eax
add esp, 8
xor eax, eax
jmp 0x10011a5a
mov dword ds:[0xa6a1774], 0
movzx eax, word [ebp - 0x12]
mov dword ds:[0xa6a1770], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10011b50
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 4], ecx
xor eax, eax
mov word [ebp - 0x128], ax
push 0x7e
push 0
lea ecx, [ebp - 0x126]
push ecx
call fcn.10293870
add esp, 0xc
xor edx, edx
mov word [ebp - 0xa8], dx
push 0x7e
push 0
lea eax, [ebp - 0xa6]
push eax
call fcn.10293870
add esp, 0xc
mov dword [ebp - 0x20], 0x80
mov dword [ebp - 0x1c], 0x80
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0
mov byte [ebp - 0x10], 0
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0xff
mov byte [ebp - 0xd], 0xff
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 9]
test edx, edx
je 0x10011c14
push 4
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
push 0x1b
push 0x29
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10011c14
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10011d0e
push 0
push 0
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call sub.WS2_32.dll_WSAConnectByNameA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x10011c5f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10011d0e
push 0
push 0
push 0x7010
push 0xffff
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10011c94
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10011d0e
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + 9]
test edx, edx
je 0x10011cd4
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x28], eax
push 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x28]
add edx, 8
push edx
call fcn.10293afd
add esp, 0xc
test eax, eax
jne 0x10011cc7
mov byte [ebp - 5], 0
jmp 0x10011ccb
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 5]
mov byte [eax + 0x10], cl
push 0x23
push 0x400
mov edx, dword [0x102ca630]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x10011d09
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10011d0e
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x10015720
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102b2988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x38], 0
je 0x10015753
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1001575f
mov al, 1
jmp 0x10015902
mov dword [ebp - 0x2c], 8
call fcn.1000c5f0
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x20], eax
call fcn.1000c5f0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.1000c650
add esp, 8
movzx eax, al
test eax, eax
je 0x100157a2
xor al, al
jmp 0x10015902
push 0
push 8
lea ecx, [ebp - 0x54]
call fcn.10007330
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x54]
call fcn.100160a0
mov ecx, eax
call fcn.10015250
mov esi, eax
lea ecx, [ebp - 0x54]
call fcn.10016c00
add esi, eax
push esi
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x54]
call fcn.100160a0
mov ecx, eax
call fcn.10015250
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x38]
call fcn.100180f0
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1001581d
cmp dword [ebp - 0x1c], 1
je 0x10015824
cmp dword [ebp - 0x1c], 3
je 0x100158be
jmp 0x100158d6
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x3d], 0
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x54]
call fcn.100160a0
mov ecx, eax
call fcn.10015250
mov edx, dword [ebp - 0x28]
sub edx, eax
mov dword [ebp - 0x18], edx
je 0x10015887
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 1
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x54]
call fcn.100160a0
mov ecx, eax
call fcn.10015250
push eax
call fcn.1029c382
add esp, 0x10
cmp dword [ebp - 0x18], eax
je 0x10015887
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100080e0
mov al, byte [ebp - 0xd]
jmp 0x10015902
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x100158aa
mov byte [ebp - 0xe], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100080e0
mov al, byte [ebp - 0xe]
jmp 0x10015902
cmp dword [ebp - 0x18], 0
jne 0x100158bc
push 0
push 8
lea ecx, [ebp - 0x54]
call fcn.1000b380
jmp 0x100158ee
mov byte [ebp - 0xf], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100080e0
mov al, byte [ebp - 0xf]
jmp 0x10015902
mov byte [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.100080e0
mov al, byte [ebp - 0x10]
jmp 0x10015902
jmp 0x100157b5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b1a0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001b1f1
mov ecx, dword [ebp - 4]
cmp dword [ecx + 8], 0
jne 0x1001b1ef
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov edx, dword [0x102cb0d4]
push edx
push 0x1001b270
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x1001b1ef
xor eax, eax
jmp 0x1001b205
jmp 0x1001b200
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
jmp 0x1001b205
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x102629d0
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x102cb3c4], 0x11223344
jne 0x102629e7
call fcn.1001c290
push 0
push str.ScreenShots
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0xc], 0
jmp 0x10262a06
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xc
jge 0x10262a2a
mov ecx, dword [ebp - 0xc]
movzx edx, byte [ecx + 0x102b3f4c]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x12441fd
push eax
call fcn.10267fe0
add esp, 8
jmp 0x102629fd
mov dword [ebp - 0x10], 0
jmp 0x10262a3c
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx*8 + 0x102c90a0], 0
je 0x10262a6a
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax*8 + 0x102c90a4]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx*8 + 0x102c90a0]
push eax
call fcn.10267fe0
add esp, 8
jmp 0x10262a33
mov dword [ebp - 0x14], 0
jmp 0x10262a7c
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx*8 + 0x102c9290], 0
je 0x10262aa9
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax*8 + 0x102c9294]
push ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx*8 + 0x102c9290]
push eax
call fcn.10268070
add esp, 8
jmp 0x10262a73
mov dword [ebp - 4], 0
jmp 0x10262abb
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
imul edx, dword [ebp - 4], 0xc
cmp dword [edx + 0x102b3f58], 0
je 0x10262af3
imul eax, dword [ebp - 4], 0xc
mov ecx, dword [eax + 0x102b3f60]
push ecx
imul edx, dword [ebp - 4], 0xc
mov eax, dword [edx + 0x102b3f5c]
push eax
imul ecx, dword [ebp - 4], 0xc
mov edx, dword [ecx + 0x102b3f58]
push edx
call fcn.10268220
add esp, 0xc
jmp 0x10262ab2
mov dword [ebp - 8], 0
jmp 0x10262b05
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
imul ecx, dword [ebp - 8], 0xc
cmp dword [ecx + 0x102b3fac], 0
je 0x10262b3d
imul edx, dword [ebp - 8], 0xc
mov eax, dword [edx + 0x102b3fb4]
push eax
imul ecx, dword [ebp - 8], 0xc
mov edx, dword [ecx + 0x102b3fb0]
push edx
imul eax, dword [ebp - 8], 0xc
mov ecx, dword [eax + 0x102b3fac]
push ecx
call fcn.102681d0
add esp, 0xc
jmp 0x10262afc
push fcn.1000f710
push 0xceb249
push 0xff
call fcn.10268130
add esp, 0xc
push fcn.1000f710
push 0xceb37c
push 0xff
call fcn.10268130
add esp, 0xc
push fcn.1000f710
push 0xceb415
push 0xff
call fcn.10268130
add esp, 0xc
push fcn.102647c0
push 0xd5dd56
push 0xff
call fcn.10268130
add esp, 0xc
call fcn.1000f400
call fcn.1001b4a0
call fcn.10264680
call fcn.10266a00
call fcn.100183f0
call fcn.10263270
mov ecx, 0x102ca538
call fcn.10001a20
call fcn.10263270
mov dword [0x181d390], 0x4e4
mov ecx, 0x102cb000
call fcn.10010fd0
push 0
push 0
push 0
push 0x10262880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x10265710
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x102ce13c]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [0x102cdc64]
cmp eax, dword [edx + 4]
jle 0x10265760
push 0x102cdc64
call fcn.1029163e
add esp, 4
cmp dword [0x102cdc64], 0xffffffff
jne 0x10265760
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102cdc60], eax
push 0x102cdc64
call fcn.102915ff
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x102cdc60]
cmp eax, 0x2710
jbe 0x102657ad
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x102cdc60], eax
mov ecx, 0x102ca644
call fcn.1000fac0
push eax
mov ecx, 0x102ca644
call fcn.1000f9b0
push eax
lea ecx, [ebp - 0xc]
call fcn.102661e0
movzx ecx, byte [ebp - 0xb]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.10265580
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x10267fe0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 1
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10268070
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10268130
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, byte [ebp + 8]
cmp edx, 0xff
je 0x1026815c
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp + 8]
mov byte [eax], cl
lea edx, [ebp + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
add eax, 5
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 1], edx
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
push 5
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x102681d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10292d70
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x10268220
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10293870
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret