joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf03a76c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03a7b6
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03a7b6
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03a7a2
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b0d8], esi
je 0xf03a7be
call fcn.0f03a69a
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0xf03a7c4
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03a824
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03a7d5
mov ebx, dword [ebp + 0x10]
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xf03a823
cmp dword [ebp - 8], ebx
jne 0xf03a823
cmp dword [0xf09b0d8], esi
je 0xf03a815
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
add dword [ebp + 0x14], ebx
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03a818
add dword [ebp + 0xc], ebx
sub dword [ebp + 0x10], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03a7cd
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03a7b8

Function at 0xf03a82e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
je 0xf03a8e8
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
lea ecx, [eax + 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0xf03a8e8
mov ebx, 0x9000
cmp dword [ebp + 0x10], ebx
ja 0xf03a86c
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b0d8], esi
je 0xf03a880
call fcn.0f03a69a
cmp eax, esi
mov dword [ebp + 0xc], eax
je 0xf03a8e8
cmp dword [ebp + 0x10], esi
mov dword [ebp - 4], esi
je 0xf03a8e3
push edi
cmp dword [ebp + 0x10], ebx
jae 0xf03a891
mov ebx, dword [ebp + 0x10]
cmp dword [0xf09b0d8], esi
je 0xf03a8b3
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
jmp 0xf03a8b9
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
push esi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0xf03a8e2
cmp dword [ebp - 8], ebx
jne 0xf03a8e2
sub dword [ebp + 0x10], ebx
add dword [ebp + 0x14], ebx
add dword [ebp - 4], ebx
cmp dword [ebp + 0x10], esi
jne 0xf03a889
pop edi
mov eax, dword [ebp - 4]
jmp 0xf03a8ea
xor eax, eax
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03b58f
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0097cf
test eax, eax
jne 0xf03b6be
push edi
push 0x3c
call fcn.0f0311a7
test eax, eax
jne 0xf03b5ca
push 0x3e
call fcn.0f0311a7
test eax, eax
je 0xf03b625
mov edi, 0xf0641e8
push edi
call fcn.0f03ab72
call fcn.0f0097bd
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0097cf
test eax, eax
jne 0xf03b61d
push edi
call fcn.0f03ab4e
call fcn.0f0097bd
push 0x64
call esi
push 0xffffffffffffffff
call fcn.0f0097cf
test eax, eax
jne 0xf03b61d
push edi
call fcn.0f03ab72
call fcn.0f0097bd
push 0x14
call esi
push 0xffffffffffffffff
call fcn.0f0097cf
test eax, eax
je 0xf03b625
push 1
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.0f032378
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
je 0xf03b63f
mov dword [ebp - 4], 0x80
push pe_nt_image_headers32
call esi
test al, 1
mov edi, dword [ebp - 4]
je 0xf03b650
or edi, 0x20
push 0x91
call esi
test al, 1
je 0xf03b65e
or edi, 0x40
mov eax, dword [0xf064218]
xor eax, edi
test al, al
jns 0xf03b67a
mov esi, 0xf0641c8
push esi
call fcn.0f03ab4e
push esi
call fcn.0f03ab72
mov eax, dword [0xf064218]
xor eax, edi
test al, 0x20
je 0xf03b696
mov esi, 0xf0641f8
push esi
call fcn.0f03ab4e
push esi
call fcn.0f03ab72
mov eax, dword [0xf064218]
xor eax, edi
test al, 0x40
je 0xf03b6b2
mov esi, 0xf064208
push esi
call fcn.0f03ab4e
push esi
call fcn.0f03ab72
mov dword [0xf064218], edi
call fcn.0f0097bd
pop edi
pop esi
leave
ret

Function at 0xf03b93c
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
xor esi, esi
cmp dword [0xf06bb24], esi
je 0xf03b94f
pop esi
jmp fcn.0f034c11
cmp dword [0xf06421c], 1
jne 0xf03b9b8
cmp dword [0xf063a68], esi
je 0xf03b9b8
cmp dword [0xf070748], esi
jne 0xf03b9b8
push 0xf09b5cc
push dword [0xf09b520]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0xf03b998
push 0x7b4
push 0xf00251c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f034820
call fcn.0f01fa33
movzx eax, word [0xf06a9c4]
movzx ecx, word [0xf06a9d0]
shl eax, 4
push 2
add eax, ecx
push eax
call fcn.0f00f660
call fcn.0f0098f4
and byte [0xf070972], 0xfd
call fcn.0f014faa
call fcn.0f035af4
push esi
push dword [0xf09b6a4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call fcn.0f032515
call fcn.0f032fe1
cmp dword [0xf09b550], 2
je 0xf03b9fe
call fcn.0f036519
push dword [0xf09b5bc]
call fcn.0f009851
call sym.ntvdm.exe_ResumeTimerThread
cmp dword [0xf06bb24], esi
jne 0xf03ba10
call fcn.0f03aef3
call fcn.0f0163fa
push dword [0xf09b0c4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
Function at 0xf03bd25
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, 0xf070990
jne 0xf03bd3d
mov edi, 0xf070994
mov eax, dword [edi]
test eax, eax
mov ebx, dword [ebp + 0xc]
jne 0xf03bdc5
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0xf03bd62
mov al, byte [eax + ebx - 1]
cmp al, byte [0xf064224]
je 0xf03bd8d
mov eax, 0xf064224
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03bd69
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03bd75
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 8], 0
mov eax, str.config.nt
jne 0xf03bd9d
mov eax, str.autoexec.nt
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03bd9f
sub eax, edx
dec ebx
mov edi, ebx
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03bdab
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0xf03bde8
mov esi, 0x110
push esi
push ebx
push eax
call fcn.0f00e297
test eax, eax
je 0xf03bdda
cmp eax, esi
jbe 0xf03bddd
mov byte [ebx], 0
push dword [edi]
call fcn.0f0058a2
and dword [edi], 0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0xf03cb9b
Capabilities:
Resume thread
Suspend thread

Disassembly:
push 0xc
push 0xf002628
call fcn.0f01b8c8
and dword [ebp - 0x1c], 0
xor edi, edi
inc edi
mov dword [0xf0709a4], edi
and dword [ebp - 4], 0
call fcn.0f004176
push dword [0xf09b6a0]
mov esi, dword [sym.imp.KERNEL32.dll_SuspendThread]
call esi
or ebx, 0xffffffff
cmp eax, ebx
je 0xf03cc41
cmp dword [0xf06bb24], 0
jne 0xf03cbe7
push dword [0xf09b870]
call esi
cmp eax, ebx
je 0xf03cc41
mov dword [0xf09af08], edi
cmp dword [0xf09b550], edi
jne 0xf03cbfc
call fcn.0f03cb28
jmp 0xf03cc09
push dword [0xf0706c8]
push 0
call fcn.0f03c513
and dword [0xf09af08], 0
cmp dword [0xf06bb24], 0
jne 0xf03cc29
push dword [0xf09b870]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03cc41
push dword [0xf09b6a0]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, ebx
je 0xf03cc41
call fcn.0f004165
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], ebx
jmp 0xf03cc51
xor esi, esi
cmp dword [ebp - 0x1c], esi
jne 0xf03cc8d
cmp dword [0xf0709a4], esi
je 0xf03cc72
push dword [0xf09af00]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [0xf0709a4], esi
push 0x215
push 0xf0025e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x3e9
call fcn.0f034820
mov dword [0xf0709a4], esi
call fcn.0f01b903
ret
Function at 0xf03cc9e
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [0xf09aef8]
test esi, esi
mov dword [ebp + 0xc], ecx
je 0xf03ccd7
mov dx, word [ebp + 8]
cmp word [esi + 8], dx
jne 0xf03cccc
cmp ecx, dword [esi]
jne 0xf03cccc
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 4]
je 0xf03ccd3
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03ccba
test esi, esi
jne 0xf03cce9
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cdc8
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
add ecx, 0xfff40000
mov dword [ebp - 8], ecx
movzx ecx, dx
sub ecx, 0xfffa
push ebx
mov dword [ebp + 8], eax
je 0xf03cd3f
dec ecx
dec ecx
je 0xf03cd1e
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cdc7
push 0x40
push 0x1000
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03cdb4
push 0xe
jmp 0xf03cd11
shr eax, 0xc
mov ebx, eax
mov dword [ebp + 8], 0x1000
jmp 0xf03cd69
push dword [ebp + 0xc]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cdad
add ebx, 0xffff
add dword [ebp + 0xc], 0x1000
test bx, bx
ja 0xf03cd4d
mov eax, dword [esi]
push 0x40
push 0x40000000
push 2
sub eax, 0xc0000
mov dword [ebp - 8], eax
mov eax, dword [esi]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
lea ecx, [ebp - 8]
push ecx
push eax
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jge 0xf03cdb4
push 5
jmp 0xf03cd11
push dword [esi + 4]
mov word [esi + 8], 0xfffd
push dword [esi]
call fcn.0f04fd2e
xor eax, eax
inc eax
pop ebx
pop esi
leave
ret 0xc
Function at 0xf03cdd2
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [0xf09aef8]
test edi, edi
mov dword [ebp + 8], edx
je 0xf03ce15
mov eax, dword [ebp + 0xc]
cmp word [edi + 8], 0xfffa
jne 0xf03ce0a
mov ecx, dword [edi]
mov ebx, dword [edi + 4]
lea esi, [edx + eax]
add ebx, ecx
cmp ebx, esi
jb 0xf03ce0a
cmp ecx, esi
jbe 0xf03ce11
mov edi, dword [edi + 0x10]
test edi, edi
jne 0xf03cdf0
test edi, edi
jne 0xf03ce1f
push 0x1e7
jmp 0xf03cecd
mov ecx, edx
sub ecx, dword [edi]
and dword [ebp - 8], 0
xor ebx, ebx
shr ecx, 0xc
inc ebx
shr eax, 0xc
add edx, 0xfff40000
shl ebx, cl
test ax, ax
mov esi, 0x1000
mov dword [ebp - 4], esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], edx
jbe 0xf03cebd
test dword [edi + 0xc], ebx
jne 0xf03ce6e
push 0x40
push esi
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jl 0xf03cecb
or dword [edi + 0xc], ebx
jmp 0xf03cea7
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cec7
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03cecb
add dword [ebp + 0xc], 0xffff
add dword [ebp - 0xc], esi
add dword [ebp + 8], esi
shl ebx, 1
cmp word [ebp + 0xc], 0
ja 0xf03ce4b
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
jmp 0xf03cecd
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cec0
Function at 0xf03cedc
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0xf09aef8]
test esi, esi
push edi
mov dword [ebp + 8], eax
je 0xf03cf1f
mov ecx, dword [ebp + 0xc]
cmp word [esi + 8], 0xfffa
jne 0xf03cf14
mov edx, dword [esi]
mov ebx, dword [esi + 4]
lea edi, [eax + ecx]
add ebx, edx
cmp ebx, edi
jb 0xf03cf14
cmp edx, edi
jbe 0xf03cf1b
mov esi, dword [esi + 0x10]
test esi, esi
jne 0xf03cefa
test esi, esi
jne 0xf03cf29
push 0x1e7
jmp 0xf03cfaf
shr ecx, 0xc
mov dword [ebp + 0xc], ecx
mov ebx, 0x1000
mov ecx, eax
mov dword [ebp - 4], ebx
sub ecx, dword [esi]
and dword [ebp - 8], 0
xor edi, edi
shr ecx, 0xc
inc edi
shl edi, cl
sub eax, dword [esi]
mov dword [ebp - 0xc], eax
jmp 0xf03cf9c
test dword [esi + 0xc], edi
je 0xf03cf8d
push dword [ebp + 8]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03cfad
push 0x40
push 0x40000000
push 2
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03cfad
add dword [ebp - 0xc], ebx
add dword [ebp + 8], ebx
add dword [ebp + 0xc], 0xffff
shl edi, 1
cmp word [ebp + 0xc], 0
ja 0xf03cf4e
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03cfa6
Function at 0xf03cffc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
sub ebx, dword [esi]
mov eax, dword [esi + 4]
sub eax, ebx
sub eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
je 0xf03d058
push 0x14
call fcn.0f007089
mov edi, eax
test edi, edi
pop ecx
jne 0xf03d034
push 0xe
jmp 0xf03d138
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [edi + 4], eax
mov ecx, dword [ebp + 0xc]
or word [edi + 8], 0xffff
add ecx, edx
mov dword [edi], ecx
mov ecx, dword [esi + 0x10]
mov dword [edi + 0x10], ecx
sub dword [esi + 4], eax
mov dword [esi + 0x10], edi
jmp 0xf03d05b
mov edi, dword [ebp + 0x14]
test ebx, ebx
jbe 0xf03d095
push 0x14
call fcn.0f007089
test eax, eax
pop ecx
mov dword [ebp - 8], eax
je 0xf03d02d
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov cx, word [ebp + 0x14]
mov word [eax + 8], cx
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x10], ecx
or word [esi + 8], 0xffff
mov dword [esi + 0x10], eax
mov dword [esi + 4], ebx
jmp 0xf03d09d
mov ax, word [ebp + 0x14]
mov word [esi + 8], ax
push dword [esi]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
test eax, eax
jl 0xf03d136
xor ecx, ecx
cmp ebx, ecx
mov ebx, dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov dword [ebp - 0xc], ecx
jbe 0xf03d0f9
mov eax, dword [esi + 4]
mov esi, dword [esi]
push 0x40
push 0x40000000
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
mov dword [ebp + 0xc], esi
add esi, 0xfff40000
mov dword [ebp - 0x10], esi
call ebx
test eax, eax
jl 0xf03d136
xor ecx, ecx
cmp dword [ebp - 4], ecx
jbe 0xf03d142
mov eax, dword [edi]
push 0x40
mov dword [ebp + 0xc], eax
add eax, 0xfff40000
push 0x40000000
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
push 2
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ecx
push ecx
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
call ebx
test eax, eax
jge 0xf03d142
push 5
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03d145
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0xf03d151
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
test eax, eax
push esi
push edi
je 0xf03d18c
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
cmp word [eax + 8], 0xffff
jne 0xf03d181
mov ecx, dword [eax]
cmp ecx, edx
ja 0xf03d181
mov edi, dword [eax + 4]
add edi, ecx
lea ecx, [edx + esi]
cmp edi, ecx
jae 0xf03d188
mov eax, dword [eax + 0x10]
test eax, eax
jne 0xf03d167
test eax, eax
jne 0xf03d19b
push 0x1e7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0xf03d209
push 0xfffa
push esi
push edx
push eax
call fcn.0f03cffc
test eax, eax
je 0xf03d197
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
shr esi, 0xc
mov edi, esi
mov esi, 0x1000
add eax, 0xfff40000
mov dword [ebp + 0x10], esi
mov dword [ebp - 8], eax
jmp 0xf03d201
push 0x40
push 0x40000000
push 2
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
push dword [0xf09aef4]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
test eax, eax
jl 0xf03d197
add dword [ebp + 8], esi
add edi, 0xffff
add dword [ebp - 8], esi
test di, di
ja 0xf03d1ca
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc

Function at 0xf03ddf9
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0xf061038]
push esi
push edi
mov esi, 0xf0029dc
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
push 0x49
pop ecx
xor eax, eax
lea edi, [ebp - 0x12a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0xf03dea5
inc dword [0xf0709d8]
js 0xf03dea5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_wvsprintfA]
lea eax, [ebp - 0x230]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xf03de59
lea edi, [ebp - 0x130]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xf03de69
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x130]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xf03de88
mov esi, 0xf001680
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x130]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0f01b780
leave
ret

Function at 0xf03e84b
Capabilities:
Allocate or change rwx memory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push 0x40
push 0x3000
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0xffffffffffffffff
mov dword [ebp - 8], 0xa0000
mov dword [ebp - 4], 0x20000
call dword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
jge 0xf03e892
push 0xd9
push 0xf002a50
push eax
push 0x3e9
call fcn.0f034820
leave
ret
Function at 0xf0411ab
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0xa]
xor ebx, ebx
cmp al, 0xf0
mov byte [ebp + 0xb], al
mov word [esi + 4], 1
mov word [esi + 6], bx
mov dword [esi + 0xc], ebx
jne 0xf0411d8
cmp word [esi + 8], bx
je 0xf0411d8
mov byte [ebp + 0xb], bl
push 1
lea eax, [ebp + 0xb]
push eax
push ebx
push 2
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_RtlOemToUnicodeN]
test eax, eax
jge 0xf0411f6
xor eax, eax
jmp 0xf0413bc
mov cl, byte [ebp + 0xb]
cmp cl, bl
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
jne 0xf041240
xor eax, eax
mov ax, word [esi + 8]
cmp ax, 0x54
jb 0xf0412f1
cmp ax, 0xa6
ja 0xf0412f1
add eax, 0xffffffac
mov word [esi + 8], ax
movzx eax, ax
shl eax, 3
mov ecx, dword [eax + 0xf06477c]
mov dword [esi + 0xc], ecx
mov ax, word [eax + 0xf064778]
jmp 0xf041390
cmp cl, 0xe0
jne 0xf0412f1
mov ax, word [esi + 8]
cmp ax, bx
je 0xf0412f1
movzx ecx, ax
mov eax, 0x84
cmp ecx, eax
mov dword [esi + 0xc], 0x108
jg 0xf0412ac
je 0xf0412a4
sub ecx, 0x73
je 0xf04129c
dec ecx
je 0xf041294
dec ecx
je 0xf04128c
dec ecx
je 0xf041284
dec ecx
jne 0xf0412bf
mov word [esi + 8], 0x47
jmp 0xf0412e6
mov word [esi + 8], 0x51
jmp 0xf0412e6
mov word [esi + 8], 0x4f
jmp 0xf0412e6
mov word [esi + 8], 0x4d
jmp 0xf0412e6
mov word [esi + 8], 0x4b
jmp 0xf0412e6
mov word [esi + 8], 0x49
jmp 0xf0412e6
sub ecx, 0x8d
je 0xf0412e0
sub ecx, 4
je 0xf0412d8
dec ecx
je 0xf0412d0
dec ecx
je 0xf0412c8
mov dword [esi + 0xc], 0x100
jmp 0xf0412e6
mov word [esi + 8], 0x53
jmp 0xf0412e6
mov word [esi + 8], 0x52
jmp 0xf0412e6
mov word [esi + 8], 0x50
jmp 0xf0412e6
mov word [esi + 8], 0x48
mov byte [ebp + 0xb], bl
mov dword [ebp - 4], ebx
jmp 0xf041394
mov ax, word [esi + 8]
cmp ax, 0xe0
jne 0xf04132f
cmp cl, 0x2f
mov dword [esi + 0xc], 0x100
jne 0xf041315
mov word [esi + 8], 0x35
mov word [esi + 6], 0x6f
jmp 0xf041394
cmp cl, 0xa
mov word [esi + 8], 0x1c
mov word [esi + 6], 0xd
jne 0xf041394
mov dword [esi + 0xc], 0x108
jmp 0xf041394
cmp cl, bl
je 0xf041394
cmp ax, 1
je 0xf041394
cmp ax, 0xe
je 0xf041394
cmp ax, 0xf
je 0xf041394
cmp ax, 0x1c
je 0xf041394
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
jne 0xf041366
mov word [esi + 8], bx
mov word [esi + 6], 0x12
jmp 0xf041394
test ah, 1
movzx cx, al
mov word [esi + 6], cx
je 0xf041377
or dword [esi + 0xc], 0x10
test ah, 2
je 0xf041380
or dword [esi + 0xc], 8
test ah, 4
je 0xf041389
or dword [esi + 0xc], 2
movzx eax, cx
push ebx
push eax
call edi
mov word [esi + 8], ax
cmp word [esi + 6], bx
jne 0xf0413b0
movzx eax, word [esi + 8]
push 3
push eax
call edi
cmp ax, bx
mov word [esi + 6], ax
jne 0xf0413b0
xor eax, eax
jmp 0xf0413bb
mov ax, word [ebp - 4]
mov word [esi + 0xa], ax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0xf041419
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [0xf077210], 0
je 0xf041452
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [0xf077218]
shl eax, 2
push eax
push 0xf09ad00
push dword [0xf07720c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0xf041452
leave
ret
and dword [0xf077218], 0
xor eax, eax
inc eax
leave
ret

Function at 0xf041f36
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push esi
xor esi, esi
cmp dword [0xf077234], esi
jne 0xf041f96
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push 0xf09aca0
mov dword [0xf077234], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0f0592ee
movzx ecx, word [0xf09ae04]
mov edx, ecx
shr edx, 2
shl edx, 6
add edx, eax
mov dword [0xf09ac70], eax
mov eax, ecx
mov dword [0xf09ac04], edx
push 4
cdq
pop ecx
idiv ecx
mov word [0xf09ac80], dx
push 0x3000
mov dword [0xf09ac24], 0x200
call fcn.0f041dbc
test eax, eax
je 0xf042002
push edi
push esi
push 0x64
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push esi
push esi
mov dword [0xf09ac18], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ac0c], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ac60], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ac54], eax
call edi
push esi
push esi
push esi
push esi
mov dword [0xf09ac78], eax
call edi
mov dword [0xf09acb8], eax
xor eax, eax
inc eax
pop edi
jmp 0xf042004
xor eax, eax
pop esi
leave
ret