joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4273c5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0042067c
xor ebx, ebx
cmp dword [0x43f954], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42749b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42757b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42757b
push eax
call fcn.0042060e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43f954], eax
call esi
push eax
call fcn.0042060e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f958], eax
call esi
push eax
call fcn.0042060e
mov dword [0x43f95c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00421c3f
test eax, eax
pop ecx
pop ecx
je 0x427469
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041e891
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42749b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0042060e
cmp eax, ebx
pop ecx
mov dword [0x43f964], eax
je 0x42749b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042060e
pop ecx
mov dword [0x43f960], eax
mov eax, dword [0x43f960]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x427520
cmp dword [0x43f964], ecx
je 0x427520
push eax
call fcn.00420685
push dword [0x43f964]
mov esi, eax
call fcn.00420685
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x427520
cmp edi, ebx
je 0x427520
call esi
cmp eax, ebx
je 0x4274ed
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4274ed
test byte [ebp - 0x18], 1
jne 0x427520
lea eax, [ebp - 0x10]
push eax
call fcn.00421c76
test eax, eax
pop ecx
je 0x427508
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041e891
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x427517
or dword [ebp + 0x10], 0x200000
jmp 0x42755b
or dword [ebp + 0x10], 0x40000
jmp 0x42755b
mov eax, dword [0x43f958]
cmp eax, dword [ebp - 8]
je 0x42755b
push eax
call fcn.00420685
cmp eax, ebx
pop ecx
je 0x42755b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42755b
mov eax, dword [0x43f95c]
cmp eax, dword [ebp - 8]
je 0x42755b
push eax
call fcn.00420685
cmp eax, ebx
pop ecx
je 0x42755b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f954]
call fcn.00420685
cmp eax, ebx
pop ecx
je 0x42757b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42757d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a6cf
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43d8bc]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0042a60e
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041d8d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x42a71e
cmp dword [ebp - 0x1c], 5
jb 0x42a736
jmp 0x42a732
cmp dword [ebp - 0x10], 1
jne 0x42a736
cmp dword [ebp - 0x1c], 4
ja 0x42a732
jne 0x42a736
cmp dword [ebp - 0x18], 0
jbe 0x42a736
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x435e30
call fcn.00401550
test eax, eax
jge 0x42a757
mov byte [0x43ec28], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d071
add ebp, 0x78
leave
ret
Function at 0x100011c0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100011d5
xor eax, eax
jmp 0x1000124a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x10000
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
jmp 0x10001202
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x38d
jae 0x10001245
mov edx, dword [ebp - 4]
imul edx, edx, 0x48
mov eax, dword [ebp - 8]
cmp dword [eax + edx + 0x40], 0
je 0x10001243
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0xc]
jb 0x1000123f
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 0x10]
jb 0x10001243
xor eax, eax
jmp 0x1000124a
jmp 0x100011f9
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x100012b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x102b740c]
mov dword [ebp - 4], eax
jmp 0x100012c9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100012e6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100012c0
mov esp, ebp
pop ebp
ret
Function at 0x100012f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x102b741c], eax
je 0x1000130e
mov eax, 0x10dd
jmp 0x100013ef
mov eax, dword [0x102b742c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000138c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1000136a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1000136a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.100010a0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.100d770d
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10001316
mov dword [0x102b742c], 0
call fcn.10001250
mov ecx, dword [0x102b7428]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100013d9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100d770d
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x100013a4
mov dword [0x102b7428], 0
mov dword [0x102b741c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100018e0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x102b7420], 0
je 0x100018f9
mov eax, dword [0x102b7420]
jmp 0x10001999
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x1000190b
xor eax, eax
jmp 0x10001999
push 8
call fcn.100d7d4b
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001961
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1000194a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.100d770d
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x102b7420], eax
mov dword [0x102b7424], 0
mov eax, dword [ebp - 8]
jmp 0x10001999
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000197b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x1000192b
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x102b7428]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x102b7428], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10007b70
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
nop
xor eax, eax
test cl, 1
je 0x10007b8b
bts eax, 7
shr ecx, 1
test cl, 1
je 0x10007b96
bts eax, 6
shr ecx, 1
test cl, 1
je 0x10007ba1
bts eax, 5
shr ecx, 1
test cl, 1
je 0x10007bac
bts eax, 4
shr ecx, 1
test cl, 1
je 0x10007bb7
bts eax, 3
shr ecx, 1
test cl, 1
je 0x10007bc2
bts eax, 2
shr ecx, 1
test cl, 1
je 0x10007bcd
bts eax, 1
test cl, 2
je 0x10007bd6
bts eax, 0
shl eax, 0x18
mov ecx, eax
add eax, eax
sar ecx, 0x1f
and ecx, 0x4c11db7
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov edx, ecx
sar edx, 0x1f
and edx, 0x4c11db7
lea eax, [ecx + ecx]
xor edx, eax
mov ecx, edx
sar ecx, 0x1f
and ecx, 0x4c11db7
lea eax, [edx + edx]
xor ecx, eax
mov ebx, ecx
sar ebx, 0x1f
and ebx, 0x4c11db7
lea eax, [ecx + ecx]
xor ebx, eax
mov eax, dword [ebp - 4]
xor edx, edx
lea esi, [edi + eax*4]
lea ecx, [edx + 1]
test bl, 1
je 0x10007c72
mov eax, 0x20
sub eax, ecx
bts edx, eax
inc ecx
shr ebx, 1
cmp ecx, 0x21
jl 0x10007c63
mov ecx, dword [ebp - 4]
inc ecx
mov dword [esi], edx
mov dword [ebp - 4], ecx
cmp ecx, 0xff
jle 0x10007b80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007ca0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1012f394
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
mov dword [edi], 0xffffffff
mov dword [ebp - 8], 0
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10007cf1
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d7712
mov esp, ebp
pop ebp
ret 0xc
push ebx
push 0x400
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov ebx, eax
mov dword [ebp - 0x10], ebx
push dword [ebp - 8]
test ebx, ebx
jne 0x10007d29
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor al, al
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d7712
mov esp, ebp
pop ebp
ret 0xc
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x10007d80
push esi
nop
mov esi, ebx
test eax, eax
je 0x10007d67
mov ebx, dword [edi]
lea esi, [esi + 1]
movzx ecx, byte [esi - 1]
movzx edx, bl
xor edx, ecx
shr ebx, 8
mov ecx, dword [ebp - 0xc]
xor ebx, dword [ecx + edx*4]
mov dword [edi], ebx
sub eax, 1
jne 0x10007d46
mov ebx, dword [ebp - 0x10]
push dword [ebp - 8]
push 0x400
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10007d40
pop esi
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [ebp - 4]
add esp, 8
not dword [edi]
xor ecx, ebp
mov al, 1
pop ebx
pop edi
call fcn.100d7712
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b510
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0x1000b450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 1
push 0x1000b450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 2
push 0x1000b450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 3
push 0x1000b450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 4
push 0x1000b450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
test eax, eax
je 0x1000b5a3
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000c460
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf7], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ebf7
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
mov byte [0x62ee41], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62ee41
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee4
call esi
lea eax, [ebp - 8]
mov byte [0x62eee4], 0x69
push eax
push dword [ebp - 8]
push 1
push 0x62eee4
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
mov byte [0x62ebf8], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebf8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
mov byte [0x62ebfe], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ebfe
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
mov byte [0x62ee42], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee42
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
mov byte [0x62ee48], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62ee48
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
mov byte [0x62eee5], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eee5
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x62eeeb
call esi
lea eax, [ebp - 8]
mov byte [0x62eeeb], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x62eeeb
call esi
push 0x1000be50
push 0x520ecf
push 0xe8
call fcn.100c88d0
push 0x1000be50
push 0x520f1f
push 0xe8
call fcn.100c88d0
push 0x1000be50
push 0x63e743
push 0xe8
call fcn.100c88d0
push 0x1000be50
push 0x640eb2
push 0xe8
call fcn.100c88d0
push 0x1000be50
push 0x7d2dd9
push 0xe8
call fcn.100c88d0
push 0x1000be50
push 0x7e6c0f
push 0xe8
call fcn.100c88d0
add esp, 0x48
push 0x1000be50
push 0x84aef7
push 0xe8
call fcn.100c88d0
push 0x1000c2b0
push 0x4dada4
push 0xe8
call fcn.100c88d0
push 0x1000c1a0
push 0x63e71b
push 0xe8
call fcn.100c88d0
push 0x1000c1a0
push 0x63eeb6
push 0xe8
call fcn.100c88d0
push 0x1000c1a0
push 0x6410ee
push 0xe8
call fcn.100c88d0
push 0x1000bee0
push 0x47e15a
push 0xe8
call fcn.100c88d0
add esp, 0x48
push 0x1000c3e0
push 0x54ee78
push 0xe9
call fcn.100c88d0
push 0x1000c400
push 0x54ffb7
push 0xe9
call fcn.100c88d0
push 0x1000c420
push 0x5880ad
push 0xe9
call fcn.100c88d0
push 0x1000c440
push 0x560ce6
push 0xe9
call fcn.100c88d0
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
pop esi
call fcn.100d7712
mov esp, ebp
pop ebp
ret
Function at 0x10017d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0x791100
call eax
mov esi, eax
mov ebx, 0x102e59d0
sub ebx, esi
mov edi, 0x100
cmp byte [ebx + esi], 1
jne 0x10017de0
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [esi], 1
push eax
push dword [ebp - 8]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
sub edi, 1
jne 0x10017db8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d7712
mov esp, ebp
pop ebp
ret

Function at 0x10017e00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 0x791100
call eax
mov esi, eax
mov ebx, 0x102e59d0
sub ebx, esi
mov edi, 0x100
nop dword [eax + eax]
mov byte [ebx + esi], 0
cmp byte [esi], 1
jne 0x10017e5b
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov byte [esi], 0
push eax
push dword [ebp - 8]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
sub edi, 1
jne 0x10017e30
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d7712
mov esp, ebp
pop ebp
ret
Function at 0x10017ed0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x4da3c7
call esi
mov eax, 0x4da3c7
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push 0x4da3c7
call esi
push 0x10017ea0
push 0x4da3c7
push 0xe8
call fcn.100c88d0
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x4da3d8
call esi
mov eax, 0x4da3d8
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push 0x4da3d8
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x4da3dd
call esi
mov eax, 0x4da3dd
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push 0x4da3dd
call esi
push 0x100181e0
push 0x4d5ec3
push 0xff
call fcn.100c88d0
push 0x100180f0
push 0x4d79c3
push 0xff
call fcn.100c88d0
push 0x10017d50
push 0x4d9d59
push 0xe8
call fcn.100c88d0
add esp, 0x24
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd456a4
call esi
lea eax, [ebp - 8]
mov dword [0xd456a4], 0x10017ec0
push eax
push dword [ebp - 8]
push 4
push 0xd456a4
call esi
push 0x10017cf0
push 0x74cd7d
push 0xe9
call fcn.100c88d0
push 0x10017ca0
push 0x51e29d
push 0xe8
call fcn.100c88d0
push 0x10017be0
push 0x588357
push 0xff
call fcn.100c88d0
push 0x10017be0
push 0x5883f4
push 0xff
call fcn.100c88d0
push 0x10017be0
push 0x588505
push 0xff
call fcn.100c88d0
push 0x10017be0
push 0x588617
push 0xff
call fcn.100c88d0
add esp, 0x48
push 0x10017be0
push 0x588661
push 0xff
call fcn.100c88d0
push 0x10017be0
push 0x58876e
push 0xff
call fcn.100c88d0
push 0x10017be0
push 0x5887ad
push 0xff
call fcn.100c88d0
push 0x10017e80
push 0x4dac5c
push 0xe9
call fcn.100c88d0
push 0x10017d20
push 0x4d9f10
push 0xe9
call fcn.100c88d0
mov ecx, dword [ebp - 4]
add esp, 0x3c
xor ecx, ebp
pop esi
call fcn.100d7712
mov esp, ebp
pop ebp
ret
Function at 0x10018b20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movd xmm1, dword [0x879340c]
movaps xmm5, xmm2
cvtdq2ps xmm1, xmm1
movaps xmm4, xmm3
movss dword [ebp - 8], xmm5
comiss xmm1, xmm5
movss xmm3, dword [ebp + 0xc]
movss dword [ebp - 4], xmm4
jb 0x10018c53
movaps xmm0, xmm5
addss xmm0, xmm3
comiss xmm0, xmm1
jb 0x10018c53
movd xmm2, dword [0x8793410]
cvtdq2ps xmm2, xmm2
comiss xmm2, xmm4
jb 0x10018c53
movss xmm1, dword [ebp + 0x10]
movaps xmm0, xmm4
addss xmm0, xmm1
comiss xmm0, xmm2
jb 0x10018c53
movaps xmm0, xmm1
divss xmm0, dword [ebp + 0x18]
push 1
movss dword [ebp + 0x18], xmm0
movaps xmm0, xmm3
divss xmm0, dword [ebp + 0x14]
movss dword [ebp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetKeyState]
movss xmm2, dword [ebp + 0x18]
mov ecx, 0x8000
movss xmm0, dword [ebp + 0x14]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
test cx, ax
mov eax, 0x637c60
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x18], xmm0
je 0x10018bf1
cvtps2pd xmm1, xmm2
addsd xmm1, xmm1
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x14], xmm0
jmp 0x10018bf7
movss dword [esp + 0x14], xmm2
movss xmm0, dword [ebp + 0x10]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0xc]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push dword [ebp + 8]
call eax
add esp, 0x30
mov eax, 0x791050
push 1
call eax
add esp, 4
test al, al
je 0x10018cb9
push 0x102e5ae0
call dword [ebp + 0x1c]
add esp, 4
mov esp, ebp
pop ebp
ret 0x18
movss xmm1, dword [ebp + 0x10]
movaps xmm2, xmm3
divss xmm1, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
mov eax, 0x637c60
push 1
push 1
sub esp, 0x20
divss xmm2, dword [ebp + 0x14]
movss xmm0, dword [ebp + 0x10]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x18], xmm2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss dword [esp + 8], xmm3
movss dword [esp + 4], xmm4
movss dword [esp], xmm5
push dword [ebp + 8]
call eax
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10018cc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movd xmm1, dword [0x879340c]
movaps xmm4, xmm2
cvtdq2ps xmm1, xmm1
movss dword [ebp - 4], xmm3
comiss xmm1, xmm4
movss dword [ebp - 8], xmm4
jb 0x10018dec
movaps xmm0, xmm4
addss xmm0, dword [ebp + 0x20]
comiss xmm0, xmm1
jb 0x10018dec
movd xmm1, dword [0x8793410]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm3
jb 0x10018dec
movaps xmm0, xmm3
addss xmm0, dword [ebp + 0x24]
comiss xmm0, xmm1
jb 0x10018dec
movss xmm0, dword [ebp + 0x10]
divss xmm0, dword [ebp + 0x18]
push 1
movss dword [ebp + 0x10], xmm0
movss xmm0, dword [ebp + 0xc]
divss xmm0, dword [ebp + 0x14]
movss dword [ebp + 0x18], xmm0
call dword [sym.imp.USER32.dll_GetKeyState]
movss xmm2, dword [ebp + 0x10]
mov ecx, 0x8000
movss xmm0, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
test cx, ax
mov eax, 0x637c60
movss dword [esp + 0x1c], xmm2
movss dword [esp + 0x18], xmm0
je 0x10018d8a
cvtps2pd xmm1, xmm2
addsd xmm1, xmm1
cvtpd2ps xmm0, xmm1
movss dword [esp + 0x14], xmm0
jmp 0x10018d90
movss dword [esp + 0x14], xmm2
movss xmm0, dword [ebp + 0x24]
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0x20]
movss dword [esp + 8], xmm0
movss xmm0, dword [ebp - 4]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push dword [ebp + 8]
call eax
add esp, 0x30
mov eax, 0x791050
push 1
call eax
add esp, 4
test al, al
je 0x10018e59
push 0x102e5ae0
call dword [ebp + 0x1c]
add esp, 4
mov esp, ebp
pop ebp
ret 0x20
movss xmm1, dword [ebp + 0x10]
mov eax, 0x637c60
movss xmm2, dword [ebp + 0xc]
divss xmm1, dword [ebp + 0x18]
push ecx
mov dword [esp], 0
push 1
push 1
sub esp, 0x20
divss xmm2, dword [ebp + 0x14]
movss xmm0, dword [ebp + 0x24]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x18], xmm2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
movss dword [esp + 0xc], xmm0
movss xmm0, dword [ebp + 0x20]
movss dword [esp + 8], xmm0
movss dword [esp + 4], xmm3
movss dword [esp], xmm4
push dword [ebp + 8]
call eax
add esp, 0x30
mov esp, ebp
pop ebp
ret 0x20