joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x30b46701
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x536f1e89
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x319f4d76
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x107b5366
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40b801
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x411a00
cmp edx, dword [eax]
je 0x40b823
add eax, 8
inc ecx
cmp eax, 0x411a90
jl 0x40b814
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x411a00]
jne 0x40b951
mov eax, dword [0x41911c]
cmp eax, 1
je 0x40b92b
test eax, eax
jne 0x40b854
cmp dword [0x411488], 1
je 0x40b92b
cmp edx, 0xfc
je 0x40b951
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b88b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408740
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00408910
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b8ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.00408910
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41050c
push edi
call fcn.00408fa0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408740
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408750
lea eax, [ebp - 0xa0]
push 0x4104ec
push eax
call fcn.00408750
push dword [esi + 0x411a04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408750
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e2c6
add esp, 0x2c
pop edi
jmp 0x40b951
lea eax, [ebp + 8]
lea esi, [esi + 0x411a04]
push 0
push eax
push dword [esi]
call fcn.00408910
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x70506b96
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x49428f1
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x64ea28d0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2e144ed6
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x43ae02a9
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3f337154
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10004e30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031c20
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10072170]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0x1006d370
call sub.SHELL32.dll_SHGetKnownFolderPath
lea esi, [edi + 0x24]
test eax, eax
js 0x10004f08
push dword [ebp - 0x34]
lea ecx, [ebp - 0x28]
call fcn.10001c70
mov edi, eax
mov dword [ebp - 4], 0
cmp esi, edi
je 0x10004ec4
mov ecx, esi
call fcn.10005b30
movups xmm0, xmmword [edi]
xor eax, eax
movups xmmword [esi], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005b30
push dword [ebp - 0x38]
lea ecx, [ebp - 0x28]
call fcn.10001e30
mov dword [ebp - 4], 2
mov ecx, esi
push eax
call fcn.10002760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005b30
push dword [ebp - 0x34]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [ebp - 0x2c]
push 0x100725f8
push 0x10002480
push 0x100725f4
call sub.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag___int____stdcall___void___void___void_____void__
add esp, 0xc
test eax, eax
jne 0x10004f29
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.10007a70
add esp, 0xc
cmp dword [ebp - 0x30], 2
je 0x10004f4f
push esi
call fcn.10007260
push esi
call fcn.100063c0
add esp, 8
mov byte [ebp - 0x2c], 0
lea eax, [edi + 0x3c]
push dword [ebp - 0x2c]
push eax
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0x2c], esp
call fcn.10003020
mov dword [ebp - 4], 4
sub esp, 0x48
mov ecx, esp
mov dword [ebp - 0x38], esp
push esi
call fcn.10002ed0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], 0xffffffff
call fcn.100029a0
add esp, 0x9c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
Function at 0x100053d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10072170]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x10005473
cmp byte [esi + 0x3d], 0
je 0x10005473
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10005428
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1000543a
sub eax, 1
je 0x1000543e
sub eax, 2
je 0x10005473
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1000545c
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10005428
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret
Function at 0x10006e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10072170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x10006e30
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10006e60
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10006e60
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x10006f5a
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10006e89
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10006ebd
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x10006f5a
cmp eax, 1
jle 0x10006f1b
cmp eax, 3
jne 0x10006f5a
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10002440
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10006f39
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10006f5a
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x10006f5a
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002f7ae
mov esp, ebp
pop ebp
ret 4
Function at 0x10007ec0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x10007ee5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10007f06
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x10007f08
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x10007f91
jg 0x10007f1b
test esi, esi
je 0x10007f91
test ecx, ecx
jl 0x10007f5d
jg 0x10007f25
test eax, eax
je 0x10007f5d
cmp ebx, ecx
jg 0x10007f37
jl 0x10007f2f
cmp esi, eax
jae 0x10007f37
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10007f63
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x10007f91
jg 0x10007f6d
test esi, esi
je 0x10007f91
cmp dword [edi + 0x4c], 0
je 0x10007f91
mov ecx, edi
call fcn.10005b00
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10007fb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10007fd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x10007ff6
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x10007ff8
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x10008076
jg 0x1000800b
test esi, esi
je 0x10008076
test ecx, ecx
jl 0x1000804f
jg 0x10008015
test eax, eax
je 0x1000804f
cmp edi, ecx
jg 0x10008027
jl 0x1000801f
cmp esi, eax
jae 0x10008027
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10008052
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10008076
jg 0x1000805c
test esi, esi
je 0x10008076
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10008076
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10008870
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100321e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x10072170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
cmp byte [0x10072014], 0
je 0x10008a31
mov al, byte [0x10072620]
mov byte [ebp - 0x12], al
mov al, byte [0x10072610]
mov byte [ebp - 0x11], al
push 0x7b
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
movzx ecx, byte [0x10072610]
mov edx, 1
test ax, ax
cmovne ecx, edx
mov byte [0x10072610], cl
push 0x7a
call esi
movzx ecx, byte [0x10072610]
xor edx, edx
test ax, ax
cmovne ecx, edx
mov byte [0x10072610], cl
push 0x79
call esi
test ax, ax
je 0x10008913
mov byte [0x10072620], 1
push 0x10072614
mov ecx, dword [0x10072628]
call fcn.100083d0
push 0x78
call esi
test ax, ax
je 0x1000892d
mov byte [0x10072620], 0
mov dword [0x10072624], 0
push 0x71
call esi
mov ecx, dword [0x10072618]
test ax, ax
cmovne ecx, dword [0x10072614]
mov dword [0x10072618], ecx
mov esi, dword [ebp + 8]
cmp byte [ebp - 0x11], 0
je 0x100089cd
movss xmm0, dword [esi + 0xc]
movss dword [ebp - 0x34], xmm0
movss xmm0, dword [esi + 0x10]
movss dword [ebp - 0x30], xmm0
movss xmm0, dword [esi + 0x18]
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [esi + 0x1c]
movss dword [ebp - 0x28], xmm0
movss xmm0, dword [esi + 0x20]
movss dword [ebp - 0x24], xmm0
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x20], eax
mov al, byte [esi + 0x28]
mov byte [ebp - 0x1c], al
movzx eax, word [esi + 0x38]
mov word [ebp - 0x1a], ax
movzx eax, word [esi + 0x3a]
mov word [ebp - 0x18], ax
cmp dword [0x1007261c], ecx
je 0x100089be
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [ecx + 0x10], xmm0
add dword [0x10072618], 0x20
jmp 0x100089cd
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, 0x10072614
call fcn.10008190
cmp byte [ebp - 0x12], 0
je 0x10008a31
mov edi, dword [0x10072624]
mov dword [ebp - 4], 0
push esi
push edi
mov ecx, 0x10072614
call fcn.10008ba0
mov ecx, eax
call fcn.10008a70
mov ecx, dword [0x10072c24]
mov eax, dword [ecx]
mov edx, dword [eax + 0x50]
lea eax, [esi + 0xc]
push eax
call edx
lea ecx, [edi + 1]
mov eax, dword [0x10072618]
sub eax, dword [0x10072614]
sar eax, 5
cmp ecx, eax
jne 0x10008a45
mov byte [0x10072620], 0
mov dword [0x10072624], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [0x10072624], ecx
jmp 0x10008a2a
Function at 0x10009cd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032476
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10072170]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x44], 0x7f7fffff
mov dword [ecx + 0x48], 0x7f7fffff
mov dword [ecx + 0x4c], 0xff7fffff
mov dword [ecx + 0x50], 0xff7fffff
mov dword [ecx + 0x54], 0x7f7fffff
mov dword [ecx + 0x58], 0x7f7fffff
mov dword [ecx + 0x5c], 0xff7fffff
mov dword [ecx + 0x60], 0xff7fffff
mov dword [ecx + 0x84], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x88], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0xa8], 0
mov dword [ecx + 0xa4], 0
mov dword [ecx + 0xac], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0xb4], 0
mov dword [ecx + 0xb0], 0
mov dword [ecx + 0xb8], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0xbc], 0
mov dword [ecx + 0xc4], 0
mov byte [ebp - 4], 3
mov dword [ecx + 0xcc], 0
mov dword [ecx + 0xc8], 0
mov dword [ecx + 0xd0], 0
mov byte [ebp - 4], 4
movaps xmm0, xmmword [0x100690b0]
mov dword [ecx + 0x18], 0
mov eax, dword [ecx + 0x18]
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x1c], 0
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0x14], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 0x1c]
mov dword [ecx + 0xc], eax
mov eax, dword [ecx + 0x18]
mov dword [ecx], eax
mov eax, dword [ecx + 0x1c]
movups xmmword [ecx + 0x54], xmm0
mov dword [ecx + 4], eax
movups xmmword [ecx + 0x44], xmm0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x20], 0
xorps xmm0, xmm0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x30], 0xbf800000
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov word [ecx + 0x64], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x6c], 1
mov byte [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x8c], 0
mov dword [ecx + 0x94], 0
mov dword [ecx + 0x90], 0
mov dword [ecx + 0x9c], 0
mov dword [ecx + 0x98], 1
mov dword [ecx + 0xa0], 0xbf800000
movups xmmword [ecx + 0xd4], xmm0
movq qword [ecx + 0xe4], xmm0
mov dword [ecx + 0xec], 0
mov dword [ecx + 0xf0], 0
mov dword [ecx + 0xf4], 0
mov dword [ecx + 0xf8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret