joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002213b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
sub esp, 0x74
mov eax, 0x100c863d
call fcn.1009a804
sub esp, 0x170
mov ecx, dword [0x101156c0]
lea eax, [ebp + 0x60]
push eax
call fcn.1000da75
and dword [ebp - 4], 0
lea ecx, [ebp + 0x48]
push str..kf
call fcn.10001866
lea eax, [ebp + 0x48]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp]
push eax
call fcn.10007f42
add esp, 0xc
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.1000ff35
cmp dword [eax + 0x14], 0x10
jb 0x1002219e
mov eax, dword [eax]
push esi
lea ecx, [ebp - 0x17c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp + 0x18]
mov esi, eax
call fcn.1000b31a
lea ecx, [ebp]
call fcn.1000b340
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 0
call fcn.1000b340
cmp esi, 0xffffffff
je 0x10022259
push str.Initializing_plugins...
call fcn.10080919
pop ecx
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp + 0x30]
call fcn.10001866
lea eax, [ebp + 0x30]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10007f42
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.1000ff35
cmp dword [eax + 0x14], 0x10
jb 0x1002221d
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x24]
call fcn.1000b31a
lea ecx, [ebp - 0x3c]
call fcn.1000b340
lea ecx, [ebp + 0x30]
mov byte [ebp - 4], 0
call fcn.1000b340
lea eax, [ebp - 0x17c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x100221df
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp + 0x60]
call fcn.1000b340
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
add ebp, 0x78
leave
ret
Function at 0x10027208
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100c899d
call fcn.1009a804
push ecx
push ebx
xor ebx, ebx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 0x20], ebx
lea edi, [esi + 0x40]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x38], ebx
mov byte [esi + 0x3c], 1
mov dword [esi + 4], 1
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
lea ecx, [esi + 0x50]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CDXUTEditBox.0
call fcn.100275af
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 1
mov dword [esi + 0x30], 6
mov dword [esi + 0x18], eax
mov dword [esi + 0x64], 5
mov dword [esi + 0x68], 4
mov byte [esi + 0x120], 1
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100cf600]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100d0cf4]
cvtps2pd xmm0, xmm0
movsd qword [esi + 0x110], xmm0
call fcn.1002e02a
mov ecx, eax
call fcn.1002e04f
mov ecx, dword [ebp - 0xc]
mov eax, esi
fstp qword [esi + 0x118]
mov byte [0x1011607c], bl
or dword [esi + 0x138], 0xffffffff
mov dword [esi + 0x130], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x124], ebx
mov byte [esi + 0x144], bl
pop edi
mov dword [esi + 0x134], 0xff101010
mov dword [esi + 0x13c], 0xff28325c
mov dword [esi + 0x140], 0xff000000
mov byte [esi + 0x128], 1
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100280b2
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x124]
cmp eax, dword [edi + 0x12c]
je 0x1002816f
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002816f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [edi + 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100280e4
sub ecx, edx
push esi
lea eax, [ecx + 1]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1002815d
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x10028153
mov ecx, dword [edi + 0x12c]
push ebx
mov ebx, dword [edi + 0x124]
cmp ebx, ecx
mov edx, ebx
cmovle ebx, ecx
cmovge edx, ecx
mov eax, ebx
mov dword [esp + 0x10], edx
sub eax, edx
test eax, eax
jle 0x10028145
push eax
mov eax, dword [edi + 0x50]
add eax, edx
push eax
push ebp
call fcn.1009dca0
mov edx, dword [esp + 0x1c]
add esp, 0xc
sub ebx, edx
push esi
mov byte [ebx + ebp], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
test esi, esi
je 0x1002816e
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ecx
ret
Function at 0x100281c4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
lea ecx, [edi + 8]
call fcn.100266c1
mov esi, dword [eax]
cmp byte [esi], 0
jne 0x100281f0
push str.CDXUTDialogResourceManager::CreateTexture_BAD_TEXFILE_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10028249
push esi
lea eax, [ebp - 0x120]
push 0x104
push eax
call fcn.1002dbdb
add esp, 0xc
test eax, eax
js 0x1002824b
xor ecx, ecx
lea eax, [esi + 0x104]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
push ecx
or eax, 0xffffffff
push eax
push eax
push 1
push ecx
push ecx
push eax
push eax
push eax
lea eax, [ebp - 0x120]
push eax
push dword [edi + 0x20]
call sub.d3dx9_43.dll_D3DXCreateTextureFromFileExA
test eax, eax
js 0x1002824b
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x108], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x10c], eax
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x100294b7
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x10029692
cmp byte [esi + 4], 0
je 0x10029692
push ebx
xor ebx, ebx
cmp dword [esp + 0xc], 0x100
jne 0x1002968d
mov ecx, dword [esp + 0x10]
push edi
cmp ecx, 0x26
ja 0x10029584
je 0x1002968a
mov eax, ecx
sub eax, 9
je 0x1002968c
sub eax, 0x1a
je 0x10029572
sub eax, 1
je 0x1002954e
sub eax, 1
jne 0x100295a2
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
lea edi, [esi + 0x124]
mov ecx, dword [edi]
test ax, ax
jns 0x10029536
push edi
push ecx
lea ecx, [esi + 0x50]
call fcn.100292fd
push dword [edi]
jmp 0x1002953e
test ecx, ecx
jle 0x10029545
lea eax, [ecx - 1]
push eax
mov ecx, esi
call fcn.1002bec2
push 0x10
call ebx
jmp 0x10029676
push ebx
mov ecx, esi
call fcn.1002bec2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x10029683
mov eax, dword [esi + 0x124]
jmp 0x1002967d
mov ecx, dword [esi + 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10029578
sub ecx, edx
push ecx
jmp 0x1002954f
mov eax, ecx
sub eax, 0x27
je 0x1002962d
sub eax, 1
je 0x1002968a
sub eax, 5
je 0x100295ef
sub eax, 1
je 0x100295ad
cmp ecx, 0x1b
setne bl
jmp 0x1002968c
mov eax, dword [esi + 0x124]
xor ebx, ebx
inc ebx
cmp eax, dword [esi + 0x12c]
je 0x100295c7
mov ecx, esi
call fcn.10028251
jmp 0x100295d4
push eax
lea ecx, [esi + 0x50]
call fcn.1002c234
test al, al
je 0x100295e3
mov ecx, dword [esi + 0x18]
push esi
push ebx
push 0x602
call fcn.1002d02d
mov ecx, esi
call fcn.1002cff2
jmp 0x1002968c
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jns 0x1002960a
mov ecx, esi
call fcn.100280b2
jmp 0x1002968c
push 0x10
call edi
test ax, ax
jns 0x1002961c
mov ecx, esi
call fcn.1002be49
jmp 0x1002968c
cmp byte [esi + 0x128], bl
sete al
mov byte [esi + 0x128], al
jmp 0x1002968c
push 0x11
lea ebx, [esi + 0x50]
lea edi, [esi + 0x124]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x10029651
push edi
push dword [edi]
mov ecx, ebx
call fcn.10029239
push dword [edi]
jmp 0x10029667
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10029656
mov eax, dword [edi]
sub ecx, edx
cmp eax, ecx
jge 0x1002966e
inc eax
push eax
mov ecx, esi
call fcn.1002bec2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x10029683
mov eax, dword [edi]
mov dword [esi + 0x12c], eax
mov ecx, esi
call fcn.1002cff2
mov bl, 1
pop edi
mov al, bl
pop ebx
jmp 0x10029694
xor al, al
pop esi
ret 0xc
Function at 0x10029698
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x3c], 0
je 0x10029836
cmp byte [esi + 4], 0
je 0x10029836
push dword [esp + 0x18]
mov edi, dword [esp + 0x18]
lea ebp, [esi + 0x70]
mov eax, dword [ebp]
mov ecx, ebp
push edi
push dword [esp + 0x18]
call dword [eax + 0x14]
test al, al
jne 0x10029832
cmp dword [esp + 0x10], 0x100
jne 0x10029836
cmp edi, 0x21
jb 0x10029836
cmp edi, 0x24
jbe 0x100296fb
cmp edi, 0x26
je 0x100296fb
cmp edi, 0x28
jne 0x10029836
mov edx, dword [esi + 0x14c]
test edx, edx
je 0x10029832
push ebx
mov ebx, dword [esi + 0x13c]
mov ecx, ebx
sub edi, 0x21
je 0x1002974c
sub edi, 1
je 0x10029741
sub edi, 1
je 0x1002973c
sub edi, 1
je 0x1002975d
dec edi
sub edi, 1
je 0x10029737
dec edi
sub edi, 1
jne 0x10029759
lea ecx, [ebx + 1]
jmp 0x10029753
lea ecx, [ebx - 1]
jmp 0x10029753
lea ecx, [edx - 1]
jmp 0x10029753
lea ecx, [ebx - 1]
add ecx, dword [esi + 0x108]
jmp 0x10029753
sub ecx, dword [esi + 0x108]
inc ecx
mov dword [esi + 0x13c], ecx
test ecx, ecx
jns 0x10029766
and dword [esi + 0x13c], 0
xor ecx, ecx
cmp ecx, edx
jl 0x10029773
lea ecx, [edx - 1]
mov dword [esi + 0x13c], ecx
cmp ebx, ecx
je 0x10029831
test byte [esi + 0x138], 1
je 0x10029813
xor edi, edi
test edx, edx
jle 0x100297ac
push edi
lea ecx, [esi + 0x148]
call fcn.100266c1
inc edi
mov eax, dword [eax]
mov byte [eax + 0x114], 0
cmp edi, dword [esi + 0x14c]
jl 0x1002978e
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x13c]
test ax, ax
jns 0x100297f8
mov edi, dword [esi + 0x140]
cmp edi, ecx
mov ebx, edi
cmovle ebx, ecx
cmovge edi, ecx
cmp edi, ebx
jg 0x10029819
push edi
lea ecx, [esi + 0x148]
call fcn.100266c1
inc edi
mov eax, dword [eax]
mov byte [eax + 0x114], 1
cmp edi, ebx
jle 0x100297d3
mov ecx, dword [esi + 0x13c]
lea ebp, [esi + 0x70]
jmp 0x10029819
push ecx
lea ecx, [esi + 0x148]
call fcn.100266c1
mov eax, dword [eax]
mov byte [eax + 0x114], 1
mov ecx, dword [esi + 0x13c]
mov dword [esi + 0x140], ecx
push ecx
mov ecx, ebp
call fcn.1002d614
mov ecx, dword [esi + 0x18]
push esi
push 1
push 0x702
call fcn.1002d02d
pop ebx
mov al, 1
jmp 0x10029838
xor al, al
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1002ae6c
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x10116078], 0
jne 0x1002afc5
push 0x105
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002afc5
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x108]
push edi
push eax
call esi
mov ebx, str.usp10.dll
mov edi, eax
push ebx
call esi
add eax, edi
mov ecx, 0x104
cmp eax, ecx
jg 0x1002afc2
push ebx
push ecx
lea eax, [ebp - 0x108]
push eax
call fcn.10026d8d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10116078], eax
test eax, eax
je 0x1002afc2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ScriptApplyDigitSubstitution
push eax
call esi
mov ecx, dword [0x1010ea18]
test eax, eax
push str.ScriptStringAnalyse
push dword [0x10116078]
cmovne ecx, eax
mov dword [0x1010ea18], ecx
call esi
mov ecx, dword [0x1010ea1c]
test eax, eax
push str.ScriptStringCPtoX
push dword [0x10116078]
cmovne ecx, eax
mov dword [0x1010ea1c], ecx
call esi
mov ecx, dword [0x1010ea20]
test eax, eax
push str.ScriptStringXtoCP
push dword [0x10116078]
cmovne ecx, eax
mov dword [0x1010ea20], ecx
call esi
mov ecx, dword [0x1010ea24]
test eax, eax
push str.ScriptStringFree
push dword [0x10116078]
cmovne ecx, eax
mov dword [0x1010ea24], ecx
call esi
mov ecx, dword [0x1010ea28]
test eax, eax
push str.ScriptString_pLogAttr
push dword [0x10116078]
cmovne ecx, eax
mov dword [0x1010ea28], ecx
call esi
mov ecx, dword [method.std::_Ref_count_obj_class_OptionsDialog_.virtual_12]
test eax, eax
push str.ScriptString_pcOutChars
push dword [0x10116078]
cmovne ecx, eax
mov dword [method.std::_Ref_count_obj_class_OptionsDialog_.virtual_12], ecx
call esi
mov ecx, dword [method.std::_Ref_count_obj_class_OptionsDialog_.virtual_12]
test eax, eax
cmovne ecx, eax
mov dword [method.std::_Ref_count_obj_class_OptionsDialog_.virtual_12], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002be49
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
call fcn.10028251
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1002bec0
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x1002beb8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x1002beb7
push 0xffffffffffffffff
push ebx
push dword [esi + 0x124]
lea ecx, [esi + 0x50]
call fcn.1002b180
test al, al
je 0x1002bea4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [esi + 0x124]
mov ecx, esi
push eax
call fcn.1002bec2
mov eax, dword [esi + 0x124]
push edi
mov dword [esi + 0x12c], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x1002ddc2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x108]
push edi
xor esi, esi
push esi
push eax
call fcn.1009e7a0
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.1009e7a0
push edi
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.1009e7a0
add esp, 0x24
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
push dword [ebp + 0x10]
jmp 0x1002de80
cmp byte [eax], 0
je 0x1002de89
push dword [ebp + 0x14]
lea eax, [ebp - 0x108]
push eax
push 0x100d0d40
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.10026e31
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1002de8f
lea eax, [ebp - 0x108]
push eax
push str._s..
lea eax, [ebp - 0x310]
push edi
push eax
call fcn.10026e31
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
lea eax, [ebp - 0x310]
push eax
call esi
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1002de1b
xor al, al
pop edi
pop esi
leave
ret
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10026dfe
mov al, 1
jmp 0x1002de8b

Function at 0x1002dea5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
push edi
push ebx
push esi
call fcn.10026dfe
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push str..._s
push ebx
push esi
call fcn.10026e31
add esp, 0x10
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push str....._s
push ebx
push esi
call fcn.10026e31
add esp, 0x10
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push str....._s
push ebx
push esi
call fcn.10026e31
add esp, 0x10
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push dword [esp + 0x24]
push 0x100d0d40
push ebx
push esi
call fcn.10026e31
add esp, 0x14
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push dword [esp + 0x24]
push str._s.._s
push ebx
push esi
call fcn.10026e31
add esp, 0x14
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push dword [esp + 0x24]
push str._s...._s
push ebx
push esi
call fcn.10026e31
add esp, 0x14
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push dword [esp + 0x28]
push dword [esp + 0x28]
push str._s.._s_s
push ebx
push esi
call fcn.10026e31
add esp, 0x18
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
push edi
push dword [esp + 0x28]
push dword [esp + 0x28]
push str._s...._s_s
push ebx
push esi
call fcn.10026e31
add esp, 0x18
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
cmp byte [0x101170d8], 0
je 0x1002dfe5
push edi
push 0x101170d8
push str._s_s
push ebx
push esi
call fcn.10026e31
add esp, 0x14
push esi
call ebp
cmp eax, 0xffffffff
jne 0x1002dfe9
xor al, al
jmp 0x1002dfeb
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1002eb1e
Capabilities:
Create thread

Disassembly:
mov eax, 0x100c8a1e
call fcn.1009a804
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0xf
pop eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], eax
mov byte [edi], bl
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], eax
mov byte [edi + 0x18], bl
or dword [edi + 0x30], 0xffffffff
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.100078dc
lea eax, [ebp + 0x20]
push eax
lea ecx, [edi + 0x18]
call fcn.100078dc
push edi
push ebx
push 0x1002ed42
call fcn.100b27ea
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.1000b31a
lea ecx, [ebp + 0x20]
call fcn.1000b31a
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x30

Function at 0x1002ed7e
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100c8a84
call fcn.1009a804
push ecx
push ecx
xor eax, eax
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov byte [esi + 4], al
mov word [esi + 0xc], ax
mov dword [esi + 0x10], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [ebp - 4], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ecx
call fcn.10010b71
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0xc17044
mov dword [esi + 0x14], 0xc9c040
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100307cf
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x10117304]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
test al, 1
jne 0x100307f1
or eax, 1
mov dword [0x10117304], eax
call esi
mov dword [0x10117300], eax
inc dword [0x10117308]
call esi
sub eax, 0xf0
cmp eax, dword [0x10117300]
jbe 0x10030874
mov eax, dword [0x10117308]
movss xmm1, dword [0x101172f0]
movss xmm2, dword [0x101172f4]
movss xmm3, dword [0x101172f8]
shl eax, 2
and dword [0x10117308], 0
movss dword [0x101172fc], xmm3
movss dword [0x101172f8], xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x101172f4], xmm1
movss dword [0x101172f0], xmm0
addss xmm0, xmm1
addss xmm0, xmm2
addss xmm0, xmm3
mulss xmm0, dword [0x100d0fa8]
movss dword [edi + 8], xmm0
call esi
mov dword [0x10117300], eax
pop edi
pop esi
ret
Function at 0x10037581
Capabilities:
Enumerate process modules

Disassembly:
mov eax, 0x100c8b36
call fcn.1009a804
sub esp, 0x230
xor eax, eax
push esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x100375f1
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x224
push eax
push esi
call sub.KERNEL32.dll_Module32First
jmp 0x100375e6
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x18]
call fcn.100373b5
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x100375ca
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.100373e6
lea ecx, [ebp - 0x18]
call fcn.100376c6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100389f0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
jne 0x10038a09
xor al, al
leave
ret
mov word [ebp - 0x16], ax
xor ecx, ecx
movzx eax, byte [ebp + 0xc]
inc ecx
xor eax, ecx
mov dword [ebp - 0x1c], ecx
add eax, eax
or eax, 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push ecx
call dword [sym.imp.USER32.dll_SendInput]
neg eax
sbb al, al
inc al
leave
ret

Function at 0x1003915f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100391d3
cmp dword [ebp + 0xc], 0
je 0x100391d3
cmp dword [ebp + 0x10], 0
je 0x100391d3
push esi
push 0x1c
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1009dca0
add esp, 0xc
mov esi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, esi
pop esi
jmp 0x100391d5
xor eax, eax
pop ebx
leave
ret

Function at 0x1003b222
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x18]
sub esp, 0x18
push ebx
push esi
push edi
push eax
call fcn.1003bd71
mov esi, dword [eax + 8]
add esi, dword [eax]
mov edx, dword [eax + 0xc]
adc edx, dword [eax + 4]
xor edi, edi
push edi
push 0x10
push edx
push esi
call fcn.1009ad90
mov esi, dword [ebp + 0xc]
mov bl, al
mov ecx, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push esi
call fcn.1003b12a
cmp dword [ebp + 0x10], edi
jbe 0x1003b280
movzx eax, bl
mov al, byte [eax + 0x1010f7bc]
xor byte [edi + esi], al
lea eax, [ebx + 1]
inc edi
cmp al, 0x10
sbb bl, bl
and bl, al
cmp edi, dword [ebp + 0x10]
jb 0x1003b265
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1003b287
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
lea eax, [esp - 0x18]
sub esp, 0x18
push ebx
push ebp
push esi
push edi
push eax
call fcn.1003bd71
mov esi, dword [eax + 8]
add esi, dword [eax]
mov edx, dword [eax + 0xc]
adc edx, dword [eax + 4]
xor edi, edi
push edi
push 0x10
push edx
push esi
call fcn.1009ad90
imul ebp, dword [esp + 0x34], 0x1f84
mov bl, al
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edi
push ebp
push esi
call fcn.1003b12a
test ebp, ebp
je 0x1003b2eb
movzx eax, bl
mov al, byte [eax + 0x1010f7ac]
xor byte [edi + esi], al
lea eax, [ebx + 1]
inc edi
cmp al, 0x10
sbb bl, bl
and bl, al
cmp edi, ebp
jb 0x1003b2d1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc

Function at 0x10044be0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push ebx
push edi
call fcn.100449e1
pop ecx
pop ecx
test al, al
jne 0x10044c00
mov eax, dword [esp + 0xc]
and dword [eax], 0
jmp 0x10044c72
call fcn.1004495f
test al, al
jne 0x10044c1d
push 0x7a
push str.d:dev_sources_sampfuncsgame_api_sdk_sharedutil.memaccess.hpp
push str.IsMainThread__
call fcn.100af561
add esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x14]
lea eax, [ebx - 1]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, edi
mov edx, 0xfffff000
mov ecx, edi
and ecx, edx
and eax, edx
sub eax, ecx
mov dword [esi], ecx
mov ebp, 0x1000
add eax, ebp
mov dword [esi + 4], eax
lea eax, [esi + 8]
push eax
push 0x40
push ebp
push ecx
call ebx
mov edi, ebp
cmp dword [esi + 4], ebp
jbe 0x10044c6e
mov ecx, dword [esi]
lea eax, [esp + 0x14]
push eax
push 0x40
push ebp
add ecx, edi
push ecx
call ebx
add edi, ebp
cmp edi, dword [esi + 4]
jb 0x10044c58
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
ret