joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4168ac
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
test esi, esi
push ebp
mov ebp, esp
push ecx
je 0x416906
cmp byte [esi], 0
je 0x416906
push 0x425d68
push esi
call fcn.00409260
or eax, eax
pop ecx
pop ecx
je 0x416906
push 0x425d64
push esi
call fcn.00409260
test eax, eax
pop ecx
pop ecx
jne 0x4168fa
push 2
lea eax, [ebp - 4]
push eax
push 0x2000000b
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41691e
mov eax, dword [ebp - 4]
leave
ret
push esi
call fcn.00412eb5
pop ecx
mov dword [ebp - 4], eax
jmp 0x4168f5
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or eax, eax
jne 0x416922
xor eax, eax
leave
ret
cmp dword [ebp - 4], 0
jne 0x4168f5
call dword [sym.imp.KERNEL32.dll_GetACP]
leave
ret

Function at 0x416a48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
push ecx
push esi
mov esi, eax
lea eax, [ebp - 4]
push 2
push eax
mov eax, esi
and eax, 0x3ff
push 0x20000001
or eax, 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
or eax, eax
jne 0x416a77
xor eax, eax
jmp 0x416aa0
cmp esi, dword [ebp - 4]
je 0x416a9d
cmp dword [ebp + 8], 0
je 0x416a9d
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
push edi
mov edx, esi
call fcn.00416986
push esi
mov edi, eax
call fcn.00408d00
pop ecx
cmp edi, eax
pop edi
je 0x416a73
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x41fa58
Capabilities:
Read file on windows

Disassembly:
push ebp
mov edi, edi
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
or esi, esi
jne 0x41fa7a
call fcn.0040b4a3
mov dword [eax], 0x16
call fcn.0040ad62
jmp 0x41fb74
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x41fb74
test al, 0x40
jne 0x41fb74
test al, 2
je 0x41fa9c
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x41fb74
or eax, 1
test eax, 0x10c
mov dword [esi + 0xc], eax
jne 0x41fab2
push esi
call fcn.0041fd04
pop ecx
jmp 0x41fab7
mov eax, dword [esi + 8]
mov dword [esi], eax
push dword [esi + 0x18]
push dword [esi + 8]
push esi
call fcn.0041fb7a
pop ecx
push eax
call fcn.00421337
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
je 0x41fb63
cmp eax, 0xffffffff
je 0x41fb63
test byte [esi + 0xc], 0x82
jne 0x41fb38
push esi
call fcn.0041fb7a
cmp eax, 0xffffffff
pop ecx
je 0x41fb23
push esi
call fcn.0041fb7a
cmp eax, 0xfffffffe
pop ecx
je 0x41fb23
push edi
push esi
call fcn.0041fb7a
push esi
sar eax, 5
lea edi, [eax*4 + 0x5ad720]
call fcn.0041fb7a
and eax, 0x1f
pop ebp
shl eax, 6
pop ecx
add eax, dword [edi]
pop edi
jmp 0x41fb28
mov eax, 0x42a090
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x41fb38
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x41fb56
mov eax, dword [esi + 0xc]
test al, 8
je 0x41fb56
test eax, 0x400
jne 0x41fb56
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x41fb77
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
and dword [esi + 4], 0
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x42b624
Capabilities:
Packed with generic packer

Disassembly:
adc byte [eax], al
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
add esi, edi
push edi
call dword [ebx + 0x1100013e]
mov edi, 0x93ff5714
dec esi
add dword [eax], eax
xor dword [esi], ecx
push 0x57285a21
call dword [ebx + 0x142]
test eax, eax
je 0x42b65b
sub dword [ebx + 0xc], ebp
cmp edi, esi
jl 0x42b622
add eax, 0x61086f
popal
add byte [eax], al
bound eax, qword [eax + eax]
add dword [ecx], eax
and byte [ebp + 0x5a], cl
add byte [edx + 4], ah
add byte [ecx], al
add dword [eax], esp
dec ebp
pop edx
nop
add byte [ebx], al
add byte [eax], al
add byte [ecx], al
sub eax, 0xff0c
mov eax, 0xc1501
add byte [eax], al
inc eax
add dword [0x2100017a], eax
lahf
loopne 0x42b692
pop ds
mov edx, 0x9b4000e
int 0x21
mov eax, 0x21cd4c01
add dword [ebp + ecx*8 + 0x21], ecx
push esp
push 0x70207369
jb 0x42b708
jb 0x42b6fd
insd dword es:[edi], dx
and byte [ebx + 0x61], ah
outsb dx, byte [esi]
outsb dx, byte [esi]
outsd dx, dword [esi]
je 0x42b6c5
bound esp, qword [ebp + 0x20]
jb 0x42b71f
outsb dx, byte [esi]
and byte [ecx + 0x6e], ch
and byte [edi + ecx*2 + 0x53], al
and byte [ebp + 0x6f], ch
or eax, 0xd240a0d
pop esp
sbb al, 0x97
invalid
inc ebp
jmp 0xc872badc
mov ecx, gs
rol byte [0x5d80030], cl
or byte [edx + edx*2], cl
imul esp, dword [ebx + 0x68], 0x670d5401
xor byte [eax], al
push eax
inc ebp
add byte [eax], al
dec esp
add dword [0xeebe700], eax
push ebx
adc dword [esp], edx
loopne 0x42b722
and al, 0xe0
add byte [edx], al
add dword [ebx], ecx
add dword [edx], ecx
add byte [eax], al
fisub word [ecx]
pop ebp
add byte [ecx], al
add eax, 0x51042417
add al, byte [ecx]
or eax, dword [ecx]
or al, byte [eax]
add dh, bl
and dword [ebp], ebx
add dword [0x51042417], eax
add dword [eax], eax
add byte [eax], dl
add byte [eax], al
add al, dh
add dword [eax], edx
add byte [eax + 9], al
or al, 0x10
add al, byte [eax]
add byte [0x19100100], al
or byte [eax], cl
add byte [eax + 0x352903], al
add byte [ecx], ah
add byte [eax + eax*2], 0x81
add eax, 0x1380129
add eax, 0xa050805
adc eax, 0x4f1c1001
add al, byte [eax]
sub al, 1
inc ebx
or al, 0x40
add eax, dword [eax]
loopne 0x42b793
jno 0x42b7b2
add dword [eax], eax
sub al, 0x50
add eax, dword [eax]
insb byte es:[edi], dx
sbb al, 0
add al, ah
hlt
add ah, ah
dec esi
push eax
add byte [0x742e2401], cl
js fcn.0042b814
add byte [eax], al
add byte [edx + 0x1d80ddd], cl
in al, dx
and ebp, ebp
sbb eax, 0x203401
add byte [eax + 0x2e], ah
jb 0x42b819
jb 0x42b819
popal
je 0x42b819
add byte [eax], al
ret 0xd75
add dh, bh
add dword [eax], eax
inc byte [ecx]
add dh, bh
add dword [eax], eax
inc byte [ecx]
add byte [esi + 1], cl
add al, dh
cmp al, 0x55
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push ebx
push edi
push eax
call dword [0x41f398]
movzx eax, ax
xor edi, edi
mov dword [ebp - 4], eax
cmp dword [esi + 0x880], edi
jle 0x42b879
lea ebx, [esi + 6]
mov ax, word [ebp - 4]
cmp word [ebx - 2], ax
jne 0x42b86d
mov eax, dword [ebp + 8]
push ebx
add eax, 2
push eax
call dword [0x8141f2b8]
jno 0x42b87f
invalid
Function at 0x4372aa
Capabilities:
Encode data using xor

Disassembly:
add al, 0x2b
push eax
push edi
call 0xc555bd20
sub dword [eax + ebp], ebp
movsx eax, byte [ebx + ebp + 1]
push eax
push edi
call 0xe43bd1f
or al, 0x45
or al, 0x83
jl 0x43720d
and byte [esi], cl
stosd dword es:[edi], eax
pop ss
adc al, 0x28
je 0x12437384
push ebp
or al, 0xe
stosb byte es:[edi], al
and eax, 0xe0aa50e
jg 0x437274
and ecx, edx
sbb al, 0x2b
ret
adc byte [eax], bl
sar dword [esp + 0x28], 4
call esi
add eax, 0xc88b601c
sub ecx, ebx
shl ecx, 2
or ecx, dword [esp + 0x24]
test ebp, ebp
jne 0x437245
mov eax, 0x103
sub eax, ecx
lea edx, [eax - 4]
push cs
sbb dword [edx], ebp
or al, 0x6a
add esi, dword [ebx]
rol byte [ecx + 0x3a], cl
or byte [ebx - 9], bl
push cs
dec eax
das
mov eax, dword [0x44ff2cf2]
sub al, 0xff
inc esp
and al, 0x14
mov byte [esp + eax + 0x30], cl
lea eax, [ebp + 2]
cmp ecx, dword [esi]
sub dword [ebx], 0
xchg dword [esi], ecx
lock or dword [ebx + ecx*4], eax
test byte [0xbe0f30b3], al
inc esp
sub byte [edx], al
push eax
push edi
call fcn.0043bd12
pop ecx
push cs
adc byte [edx + edx], dh
lahf
daa
push cs
loop 0x4372c9
sbb eax, 0x528008a
mov al, byte [ebx + eax]
add ecx, dword [esi]
cli
and byte ss:[eax - 0x7fe8dbbc], cl
and al, 0x17
movups xmmword [ebp + 0x14244c34], xmm1
sub al, bl
shl al, 4
and al, 0xf0
or al, byte [esp + 0x13]
add eax, 0xc44146c
xor byte [ebp + 0x6c010345], cl
add al, 0x77
push 0x1d
push 0x57500310
call 0xab83f4
sub byte [esi], cl
inc edi
or eax, 0x550e9500
or eax, 0x20247408
or eax, 0x12330e4c
add dword [eax + eax + 6], ecx
dec esp
add byte [esi], al
adc dword [ebp], esp
ror byte [0x4650919], 0x24
aas
adc dword [edx + 0x18], esp
add ebp, 4
inc dword [esp + 0x2c]
add dword [ecx + 0x14], ebp
cmp ebp, dword [esp + 0x18]
jb 0x44ba28fc
cmp dword [esp + 0x1c], 0
je 0x43733a
mov eax, 0x3ff
cmp dword [esp + 0x1c], eax
jb 0x437304
and dword [eax], ecx
and al, 0x8b
je 0x43732a
sbb al, 0x33
rol byte [ebp + 0x11d74f6], 0x45
push 0x2f0c4c8d
mov dl, byte [ecx]
mov edi, dword [esp + 0x438]
xor dl, 0x5a
mov byte [eax + edi], dl
inc eax
dec ecx
cmp eax, esi
jb 0x437314
mov eax, dword [ebp + eax + 0x4c60813]
test byte [0x4c60813], al
push es
sbb ah, byte [edx]
adc byte [edi + ebx*2], dl
pop esi
pop ebp
pop ebx
add esp, 0x981a1d41
adc edx, dword [esi]
xlatb
and dword [edx + ebp*2], ebx
les eax, [ecx + 0x1d]
sbb bl, byte [eax + 0x21d71613]
sbb al, 0x6a
jmp [eax + 0x5d]

Function at 0x43a27e
Capabilities:
Parse pe header

Disassembly:
add dword [edi], eax
adc ah, byte [eax + 0x17]
xor al, 0x83
cmp eax, 0x42a068
add dword [ebp + 5], esi
call fcn.0043c2dd
push cs
sub dword [eax], ebx
sub al, 0x94
push ds
Function at 0x3000b65f
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x3000f398
call fcn.3000b6c4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x30011cd4
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x3000b402
cmp eax, esi
jne 0x3000b3f5
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x3000b405
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x3000b3dc
xor esi, esi
inc esi
mov eax, dword [0x30011cd0]
cmp eax, esi
jne 0x3000b418
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x3000b447
mov eax, dword [0x30011cd0]
test eax, eax
jne 0x3000b441
mov dword [0x30011cd0], esi
push 0x30001360
push 0x30001354
call fcn.30179000
pop ecx
pop ecx
test eax, eax
je 0x3000b447
jmp 0x3000b56b
mov dword [0x30011940], esi
mov eax, dword [0x30011cd0]
cmp eax, esi
jne 0x3000b46b
push 0x30001350
push 0x30001334
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x30011cd0], 2
cmp dword [ebp - 0x20], ebx
jne 0x3000b478
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x30011ce0], ebx
je 0x3000b499
push 0x30011ce0
call fcn.3000bbe4
pop ecx
test eax, eax
je 0x3000b499
push ebx
push 2
push ebx
call dword [0x30011ce0]
mov eax, dword [sym.imp.MSVCR80.dll__wcmdln]
cmp dword [eax], ebx
je 0x3000b56b
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x3000b503
cmp cx, bx
je 0x3000b4be
cmp dword [ebp - 0x1c], ebx
jne 0x3000b503
movzx ecx, word [eax]
cmp cx, bx
je 0x3000b4d3
cmp cx, 0x20
ja 0x3000b4d3
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x3000b4be
test byte [ebp - 0x40], 1
je 0x3000b4df
movzx ecx, word [ebp - 0x3c]
jmp 0x3000b4e2
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x30000000
call main
mov dword [0x3001193c], eax
cmp dword [0x30011930], ebx
jne 0x3000b548
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp cx, 0x22
jne 0x3000b514
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x3000b4a8
cmp dword [0x30011940], ebx
jne 0x3000b556
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3001193c]
jmp 0x3000b577
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.3000b709
ret
call fcn.3000ad02
jmp 0x3000b39f
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
xchg byte es:[esi + 0x32df76bb], al
cmp al, 0x73
push cs
or ebp, dword [ebp + 0x17634db1]
test edi, esp
sbb dword [eax - 0x6acc0f73], edi
xlatb
leave
popfd
or dl, 0xf
cmp dword [edi], 0x73
mov ch, 0x67
popfd
xor dword [edi], ecx
fisttp dword [ebp + 0x13]
dec esi
arpl word [ebp - 0x7d630fdd], dx
wait
push esp
pushfd
or byte [edi + esi*4 + 0xf321d73], 0x8b
lodsb al, byte [esi]
cmc
invalid
Function at 0x1000ba80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bb8e
call fcn.10099450
test al, al
je 0x1000bb8e
push esi
push dword [0x102b18b4]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
test ax, ax
je 0x1000bac8
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test byte [eax], 1
jne 0x1000bb8d
cmp byte [0x102b1b8b], 0
je 0x1000bb8d
push dword [0x102b1b8c]
call esi
test ax, ax
je 0x1000bb8d
mov eax, dword [0x102b16b4]
push edi
mov ecx, dword [eax]
call fcn.10099bc0
mov edi, dword [ebp + 8]
mov esi, eax
mov ecx, dword [0x102b2260]
push edi
call fcn.10030840
mov ecx, dword [0x102b2260]
call fcn.100307f0
mov ecx, dword [0x102b16b4]
mov ecx, dword [ecx]
call fcn.10099bc0
cmp esi, 9
jne 0x1000bb58
cmp eax, esi
je 0x1000bb58
mov eax, dword [0x102b16ac]
mov ecx, dword [eax + 0x1c]
mov eax, dword [edi + 0x30]
and eax, 0xfffff9e7
mov dword [edi + 0x24], 0
or eax, 2
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], eax
mov dword [0x102b22b8], ecx
mov byte [0x102b22a9], 1
jmp 0x1000bb5e
mov ecx, dword [0x102b22b8]
mov eax, dword [0x102b16ac]
mov eax, dword [eax + 0x1c]
sub eax, ecx
sub eax, 2
cmp eax, 0xc
ja 0x1000bb8c
mov eax, dword [edi + 0x30]
and eax, 0xfffff9e7
mov dword [edi + 0x24], 0
or eax, 4
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], eax
pop edi
pop esi
pop ebp
ret

Function at 0x1000bb90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b16ac]
push esi
mov esi, dword [ebp + 8]
movss xmm0, dword [eax + 0x10]
comiss xmm0, dword [0x102b2308]
jbe 0x1000bbb1
mov byte [0x102b22ae], 0
mov eax, dword [0x102b16b4]
cmp dword [eax], 0
jne 0x1000bbc5
mov dword [0x102b2308], 0
cmp byte [0x102b18ae], 0
je 0x1000bcb3
push dword [0x102b18b4]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000bcb3
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bcb3
call fcn.10099450
test al, al
je 0x1000bcb3
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.10099bc0
cmp eax, 9
je 0x1000bcb3
cmp eax, 8
je 0x1000bcb3
test byte [ebp + 0xc], 1
je 0x1000bc56
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test byte [eax], 1
jne 0x1000bc56
or dword [esi + 0x30], 2
mov eax, dword [0x102b16ac]
mov byte [0x102b2310], 1
mov ecx, dword [eax + 0x1c]
add ecx, 2
mov dword [0x102b230c], ecx
jmp 0x1000bc6a
cmp byte [0x102b2310], 0
je 0x1000bcb3
mov eax, dword [0x102b16ac]
mov ecx, dword [0x102b230c]
mov byte [0x102b22ae], 1
movss xmm0, dword [eax + 0x10]
addss xmm0, dword [0x100ce53c]
movss dword [0x102b2308], xmm0
cmp dword [eax + 0x1c], ecx
jge 0x1000bcaa
or dword [esi + 0x30], 4
mov eax, dword [esi + 0x30]
and eax, 0xfffffff7
mov byte [0x102b2310], 1
and eax, 0xffffffef
mov dword [esi + 0x30], eax
mov eax, dword [0x102b16ac]
cmp dword [eax + 0x1c], ecx
jle 0x1000bcb3
mov byte [0x102b2310], 0
pop esi
pop ebp
ret
Function at 0x1000bdd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push dword [0x102b1900]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1000bea9
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bea9
call fcn.10099450
test al, al
je 0x1000bea9
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.10099bc0
cmp eax, 9
je 0x1000bea9
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.10099bc0
cmp eax, 8
je 0x1000bea9
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test dword [eax], 0x400
jne 0x1000bea9
cmp byte [0x102b22b5], 0
jne 0x1000be60
cmp byte [0x102b22b6], 0
je 0x1000be60
mov eax, dword [ebp + 8]
mov byte [0x102b22b6], 0
or dword [eax + 0x30], 2
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
test byte [esi + 0x30], 2
je 0x1000be9a
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test byte [eax], 1
je 0x1000be8c
mov al, 1
mov byte [0x102b22b6], 1
mov byte [0x102b22b5], al
pop esi
pop ebp
ret
and dword [esi + 0x30], 0xfffffffd
xor al, al
mov byte [0x102b22b5], al
pop esi
pop ebp
ret
mov byte [0x102b22b5], 0
mov byte [0x102b22b6], 0
pop esi
pop ebp
ret
Function at 0x1000de00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x102b16ac]
movss xmm0, dword [ecx + 0x10]
comiss xmm0, dword [0x102b22ec]
jbe 0x1000de1e
mov byte [0x102b2239], 0
mov eax, dword [0x102b16b4]
cmp dword [eax], 0
je 0x1000de95
cmp byte [0x102b1b8a], 0
je 0x1000de95
test byte [0x102b222c], 1
jne 0x1000de48
mov eax, dword [ecx + 0x1c]
add eax, dword [0x102b1bf8]
mov dword [0x102b223c], eax
push dword [0x102b1ba0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000de95
test byte [0x102b222c], 1
je 0x1000de95
mov ecx, dword [0x102b16ac]
mov eax, dword [0x102b223c]
movss xmm0, dword [ecx + 0x10]
addss xmm0, dword [0x100ce53c]
mov byte [0x102b2239], 1
movss dword [0x102b22ec], xmm0
cmp eax, dword [ecx + 0x1c]
jl 0x1000de95
mov eax, dword [ebp + 8]
and dword [eax + 0x30], 0xfffffffd
pop ebp
ret
Function at 0x1000f470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102b1b46], 0
je 0x1000f607
push dword [0x102b18f8]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1000f607
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000f607
call fcn.10099450
test al, al
jne 0x1000f4be
mov dword [0x102b22fc], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.10099bc0
cmp eax, 8
je 0x1000f607
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.10099bc0
cmp eax, 9
je 0x1000f607
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test byte [eax], 1
jne 0x1000f607
cmp byte [0x102b22ac], 0
mov eax, dword [0x102b229c]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [edi + 0x30]
mov dword [ebp - 4], ecx
jne 0x1000f614
push esi
xor esi, esi
dec eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
push eax
mov eax, dword [section..data]
push 0
mov eax, dword [eax + 4]
call eax
mov ecx, dword [edi + 0x30]
mov eax, ecx
or eax, 4
and ecx, 0xfffffffb
test esi, esi
cmovne ecx, eax
xor esi, esi
mov dword [edi + 0x30], ecx
nop dword [eax + eax]
mov ecx, dword [0x102b2260]
push edi
call fcn.10030840
mov ecx, dword [0x102b2260]
call fcn.100307f0
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000ef00
test byte [eax], 1
jne 0x1000f5bf
mov eax, dword [0x102b16b4]
mov ecx, dword [eax]
call fcn.1000f210
movss xmm0, dword [0x100d2f08]
comiss xmm0, dword [0x102b2230]
movss xmm1, dword [eax + 8]
jbe 0x1000f5b2
movss xmm0, dword [0x102b22b0]
xorps xmm0, xmmword [0x100ce570]
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jnp 0x1000f5d6
inc esi
mov byte [0x102b22ac], 0
cmp esi, 4
jl 0x1000f550
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, 2
jge 0x1000f60b
mov eax, dword [ebp - 0xc]
jmp 0x1000f526
cmp dword [ebp - 8], 0
mov byte [0x102b22ac], 1
je 0x1000f5f8
mov eax, dword [edi + 8]
add eax, 0x10
add eax, esi
mov dword [0x102b22fc], eax
mov eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
jmp 0x1000f5c2
mov ecx, dword [ebp - 4]
mov byte [0x102b22ac], 0
mov dword [edi + 0x30], ecx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
pop esi
mov dword [edi + 0x30], eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
or ecx, 4
mov dword [edi + 0x30], ecx
cmp eax, dword [0x102b22fc]
jle 0x1000f606
movss xmm1, dword [0x102b22b0]
xorps xmm1, xmmword [0x100ce570]
movss xmm0, dword [0x102b2230]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x1000f606
mov byte [0x102b22ac], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10028070
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x100d421c
push dword [ebp + 8]
lea eax, [ebp + 8]
mov edi, ecx
push eax
call fcn.100a9672
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x1002816c
push 2
push 0
push eax
call fcn.100a9e45
push dword [ebp + 8]
call fcn.100aa569
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
je 0x1002816c
mov esi, dword [ebp + 0xc]
xor ebx, ebx
cmp esi, 2
je 0x100280c7
cmp esi, 1
jne 0x100280cc
mov ebx, 2
test esi, esi
jne 0x100280d5
lea ebx, [esi + 1]
jmp 0x100280e4
cmp esi, 4
je 0x100280df
cmp esi, 3
jne 0x100280e4
mov ebx, 4
add eax, ebx
push eax
call fcn.1009ea7e
push 0
push 0
push dword [ebp + 8]
mov dword [ebp + 0xc], eax
call fcn.100a9e45
push dword [ebp + 8]
push dword [ebp - 4]
push 1
push dword [ebp + 0xc]
call fcn.100a99e7
mov ecx, dword [ebp - 4]
add esp, 0x20
cmp eax, ecx
jne 0x1002816c
test ebx, ebx
je 0x1002812d
push ebx
mov ebx, dword [ebp + 0xc]
push 0
lea eax, [ebx + ecx]
push eax
call fcn.100a06d0
add esp, 0xc
jmp 0x10028130
mov ebx, dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100a97de
add esp, 4
mov ecx, edi
push esi
push ebx
call fcn.10025d50
push ebx
call fcn.1009ea87
mov eax, dword [edi + 0x28]
add esp, 4
mov ecx, dword [eax]
test ecx, ecx
je 0x10028165
cmp ecx, 0x20
jne 0x10028177
mov ecx, dword [eax + 4]
add eax, 4
test ecx, ecx
jne 0x10028156
mov dword [edi + 0x2c], 0
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x2c], eax
test eax, eax
je 0x1002816c
push 0x20
call fcn.1009e5f2
mov ecx, eax
add esp, 4
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x100281d4
xorps xmm0, xmm0
movq qword [ecx], xmm0
mov dword [ecx + 8], 0
mov dword [ecx + 4], 1
mov dword [ecx + 8], 1
mov dword [ecx], vtable.std::_Ref_count_obj2_class_valve_parser::node_.0
mov dword [ecx + 0xc], vtable.valve_parser::node.0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x10], edi
jmp 0x100281d6
xor ecx, ecx
mov esi, dword [edi + 0x34]
lea eax, [ecx + 0xc]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
test esi, esi
je 0x10028207
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x10028207
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10028207
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [edi + 0x30]
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8