joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45bfd0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45bfe7
add esp, 0xfffffff0
call fcn.00403d44
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419f04
mov eax, dword [0x469258]
cmp word [eax + 2], 0
jne 0x45c00f
mov eax, dword [0x469258]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d738
mov eax, dword [0x469304]
cmp word [eax + 2], 0
jne 0x45c029
mov eax, dword [0x469304]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045d930
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4121e4]
call fcn.004039f0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4121e4]
call fcn.004039f0
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c458]
call fcn.00423a90
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x45c1b0
mov eax, dword [0x46917c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00423e60
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45dee0
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46917c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cc2c
test eax, eax
je 0x45c11e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408ef4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cc54
test eax, eax
je 0x45c132
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404a00
mov eax, dword [0x469064]
cmp byte [eax], 0
jne 0x45c166
mov eax, ebx
call fcn.0045c2d8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045e0bc
mov eax, ebx
call fcn.0045ea80
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45c1a6
call fcn.00403d9c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c558
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46abdc]
cmp dword [eax + 0x30], 0
je 0x45c602
cmp dword [ebx + 0x94], 0
jne 0x45c5fc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45c4e8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45c5fc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45c5c2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45c5fc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041454c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45c5d1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45d164
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45d199
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404880
jmp 0x45d1a6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004047e4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45e298
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45e2d9
mov eax, esi
call fcn.004444a0
test al, al
je 0x45e2d9
mov eax, dword [ebx + 0x84]
call fcn.0044419c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45e2d9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044419c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x45f68c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.004047e4
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404a50
test ax, ax
jbe 0x45f6f7
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404ca8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x45f6bc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45fa40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.004047e4
mov eax, dword [esi]
call fcn.00404a50
test ax, ax
jbe 0x45faa0
mov word [esp], ax
mov bx, 1
mov eax, esi
call fcn.00404ca8
movzx ebp, bx
mov edx, dword [esi]
mov dl, byte [edx + ebp - 1]
movzx ecx, di
shr ecx, 8
xor dl, cl
mov byte [eax + ebp - 1], dl
mov eax, dword [esi]
movzx eax, byte [eax + ebp - 1]
add di, ax
imul ax, di, 0xce6d
add ax, 0x58bf
mov edi, eax
inc ebx
dec word [esp]
jne 0x45fa68
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45fe28
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
xor edx, edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c40
xor eax, eax
push ebp
push 0x45ff7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x45ff90
lea eax, [ebp - 0x1d0]
call fcn.00402db0
lea eax, [ebp - 0x1d0]
call fcn.00402b4c
call fcn.00402864
mov edx, 0x45ffa4
lea eax, [ebp - 0x1d0]
call fcn.00404e6c
call fcn.004034e8
call fcn.00402864
push 0x45ffb4
push dword [ebp - 4]
push 0x45ffc4
lea eax, [ebp - 0x1d4]
mov edx, 3
call fcn.00404b10
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00404e6c
call fcn.004034e8
call fcn.00402864
push 0x45ffd0
push dword [ebp - 4]
push 0x45ffe4
lea eax, [ebp - 0x1d8]
mov edx, 3
call fcn.00404b10
mov edx, dword [ebp - 0x1d8]
lea eax, [ebp - 0x1d0]
call fcn.00404e6c
call fcn.004034e8
call fcn.00402864
mov edx, 0x45fffc
lea eax, [ebp - 0x1d0]
call fcn.00404e6c
call fcn.004034e8
call fcn.00402864
lea eax, [ebp - 0x1d0]
call fcn.00402f2c
call fcn.00402864
mov edx, 0x460018
mov eax, 0x45ff90
call fcn.00408ce4
push 0
push 0
push 0
push 0x460024
push 0x460030
push 0
call sub.shell32.dll_ShellExecuteA
call fcn.00404680
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ff84
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.004047b4
lea eax, [ebp - 4]
call fcn.00404790
ret

Function at 0x4609a4
Capabilities:
Get disk information

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
push 0
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x4609f8
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x4609e5
mov eax, dword [esp + 8]
xor edx, edx
push edx
push eax
mov edx, ebx
mov eax, 8
call fcn.00408970
jmp 0x4609f1
mov eax, ebx
mov edx, 0x460a04
call fcn.004047e4
add esp, 0xc
pop ebx
ret
Function at 0x401790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb ecx, dword [eax]
or dword [edx], ecx
or ebx, dword [ebx]
or al, 0xd
invalid
ret 0x1835
lodsb al, byte [esi]
mov ebp, esp
mov eax, dword [ebp + 8]
jo 0x401728
enter 0x40c0, 0
push eax
sub dword [esi], 0x40
push 0xae40d274
push ecx
call dword [0xf540c180]
mov eax, dword [0x4102ac]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push 0x40d24b
jmp ebp
push 1
push eax
cmpsd dword [esi], dword es:[edi]
jo 0x4017f3
inc eax
add byte [edi - 0x7e1374ab], bl
push ebp
mov ebp, esp
sub esp, 0xa900b8
invalid
js 0x4017d3
inc ecx
add byte [ebp + 0x404ca1c0], al
inc ecx
add byte [esi + 0x14], al
push 0x413c40
push eax
arpl word [esi + 0x66000040], bx
loopne 0x40173d
je 0x4017b9
inc ecx
add bl, ch
adc byte [ebx - 0x2de7ffeb], cl
add byte [edx + 0x50], dl
push edx
push eax
jmp 0x4017cb
add cl, byte [eax + 0x66004040]
mov ecx, dword [0x41177b]
mov dword [0x411808], eax
jnp 0x4017e4
inc ecx
add byte [ebx + 0x411808], ah
add byte [ecx + 0xa50251], ah
mov eax, dword [0xa50251]
push ebx
push esi
mov esi, dword [0x40c1fa]
mov word [0x410bb4], cx
test eax, eax
push edi
jne 0x40184a
mov ah, 0xb
inc ecx
add byte [ebp + 0x5d7557c0], al
js 0x401804
out dx, eax
mov ah, 0xcf
hlt
bound ebp, qword [eax - 0x3f]
aam 0x40
or edi, edi
salc
mov eax, dword [0x410206]
add esp, 8
test eax, eax
je 0x40181c
sal byte [ebp + edx - 0x5f], 0x74
add al, byte [ecx]
mov eax, dword [0x410274]
push eax
push 0xb53c40
push str._through__s:_d_
call esi
sub dword [esp + ecx + 0x40d014a1], 0
mov eax, dword [0x40d014]
test eax, eax
retf
inc ecx
adc eax, 0x4097cf
mov esi, dword [0x8cc134]
push 0xc760
push edx
or dh, dl
mov dword [0xe1410bb0], eax
mov eax, dword [0x5ad010]
push 0xfffffffffffffff6
push eax
call esi
mov ecx, dword [0x41404c]
invalid

Function at 0x40a5d0
Capabilities:
Encode data using xor

Disassembly:
sar dword [0x18ba833a], 0x53
mov ebx, dword [ebp - 0x42]
test ebx, ebx
push edi
mov dword [ebp - 4], 0x6f00
pop ebp
adc eax, dword [edi]
inc ebp
push 0x3883db33
cld
je 0x40a5f9
mov ecx, dword [eax + ebx*4 - 0x4d]
inc ebx
test dword [ebp + esi*2 - 0x62fbb63b], ecx
dec ecx
add al, 0x9d
add al, 0
add byte [eax + 0x56], ch
push eax
push esp
adc eax, sym.imp.MSVCRT.dll_malloc
adc dword [ecx], 4
mov edi, eax
test dword [ecx + 0x32f47d89], edi
mov esp, dword ss:[esi + 0xc]
mov esi, edi
sub eax, dword [edx]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x73], eax
jmp 0x40a626
mov dword [0xca61042], eax
xor byte [ecx - 1], dl
adc eax, sym.imp.MSVCRT.dll_wcslen
cmpsb byte [esi], byte es:[edi]
or al, 0x30
push ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
and dword [edx + 4], 0x40
mov dword [esi], eax
mov cl, 0x72
cld
add edx, eax
mov eax, dword [ebp - 8]
add esi, 4
dec eax
add byte [ebp - 4], dl
mov dword [ebp - 8], eax
jne 0x40a623
mov eax, dword [ebp - 4]
lea edi, [eax + eax*2]
add dword [eax - 0x69], edx
inc ebp
cld
call dword [0x6cc15c]
add esp, 4
xor ebx, dword [0x4589db85]
clc
mov esi, eax
cmp al, 0x54
mov eax, dword [ebp + 0xc]
aaa
dec ebp
hlt
Function at 0x4453cd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4453fb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x445419
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00445337
jmp 0x445419
mov eax, dword [esi + 0x14]
test eax, eax
je 0x445419
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00445337
test edi, edi
mov eax, edi
jne 0x445403
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56f64c]
test ecx, ecx
je 0x4454cc
jmp 0x4453cc
ret 8
Function at 0x407180
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4071be
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4071b6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4071c0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4071a6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4072a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4072b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4072d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3e0c080d
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x32fd0fda
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10008e60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10008ebd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10008e80
mov eax, dword [esi]
jmp 0x10008f9b
cmp eax, 0x4e0
jb 0x10008f9b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10008ed6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10008f21
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009980
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov dword [esp + 8], ecx
mov ecx, dword [0x101c84fc]
push ebx
push esi
push edi
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x101c8500]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov ebx, eax
test ebx, ebx
jne 0x100099ba
fldz
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [0x100d25f8]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
push dword [0x100d2604]
movsx edi, ax
shr edi, 0x10
call esi
push dword [0x100d2610]
cwde
shr eax, 0x10
mov dword [esp + 0x14], eax
call esi
cwde
shr eax, 0x10
test di, di
je 0x100099ff
mov byte [0x100d25f4], 1
mov byte [0x100d260c], 0
jmp 0x10009a31
cmp word [esp + 0x10], 0
je 0x10009a1e
mov byte [0x100d2600], 1
mov byte [0x100d25f4], 0
mov byte [0x100d260c], 0
jmp 0x10009a38
test ax, ax
je 0x10009a38
mov byte [0x100d260c], 1
mov byte [0x100d25f4], 0
mov byte [0x100d2600], 0
mov eax, dword [0x101c865c]
push dword [0x100d27c0]
push dword [0x100d27bc]
mov al, byte [eax + ebx]
not al
and al, 1
mov byte [esp + 0x17], al
call fcn.10008fe0
mov ecx, dword [0x101c8660]
add esp, 8
mov byte [esp + 0xe], al
movq xmm0, qword [ecx + ebx]
mov ecx, dword [ecx + ebx + 8]
movq qword [esp + 0x18], xmm0
movss xmm1, dword [esp + 0x18]
movss xmm0, dword [esp + 0x1c]
mulss xmm1, xmm1
mov dword [esp + 0x20], ecx
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x10009aa3
sqrtsd xmm0, xmm0
jmp 0x10009aa8
call fcn.10079330
mov cl, byte [esp + 0xf]
mov dl, byte [esp + 0xe]
cvtsd2ss xmm0, xmm0
comiss xmm0, dword [0x100a53f0]
jbe 0x10009ac9
test cl, cl
jne 0x10009ac9
test dl, dl
jne 0x10009ac9
mov al, 1
jmp 0x10009acb
xor al, al
cmp byte [0x101c874c], 0
mov esi, dword [esp + 0x14]
mov dword [esp + 0x30], esi
mov byte [esp + 0x34], cl
mov byte [esp + 0x35], dl
mov byte [esp + 0x36], al
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x18], esi
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], dl
mov byte [esp + 0x1e], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
je 0x10009b30
lea ecx, [esp + 0x18]
call fcn.10007b30
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x30]
call fcn.100084c0
pop edi
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009c90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1511
mov eax, dword fs:[0]
push eax
mov eax, dword [0x10104a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101c8ac4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101b54b0]
cmp eax, dword [ecx + 4]
jg 0x10009d2f
nop
mov ecx, 0x101b4128
call fcn.10008e60
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100a5470]
cvtpd2ps xmm2, xmm0
xorps xmm0, xmm0
subss xmm2, xmm0
addss xmm2, xmm0
movss xmm0, dword [ebp + 0xc]
subss xmm0, dword [ebp + 8]
mulss xmm2, dword [0x100a53ec]
mulss xmm2, xmm0
addss xmm2, dword [ebp + 8]
movss dword [ebp + 0xc], xmm2
fld dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x101b54b0
call fcn.1007345a
add esp, 4
cmp dword [0x101b54b0], 0xffffffff
jne 0x10009cd0
mov dword [ebp - 4], 0
call fcn.10072433
mov dword [0x101b54ac], 0xffffffff
mov edx, 1
mov dword [0x101b412c], eax
jmp 0x10009d67
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [edx*4 + 0x101b412c], eax
inc edx
cmp edx, 0x270
jb 0x10009d67
push 0x101b54b0
mov dword [0x101b4128], 0x270
call fcn.10073409
add esp, 4
jmp 0x10009cd0
Function at 0x10011a70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x100d26a8]
sub esp, 0x38
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x10011c66
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10011c66
mov ecx, dword [0x101c84fc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x101c8500]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov esi, eax
test esi, esi
je 0x10011c66
mov ecx, dword [0x101c8658]
cmp dword [ecx + esi], 0
jle 0x10011c66
mov ecx, dword [0x101c865c]
test byte [ecx + esi], 1
jne 0x10011c66
mov eax, dword [0x101c8660]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
movq xmm0, qword [eax + esi]
mov eax, dword [eax + esi + 8]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1c]
movq qword [esp + 0x2c], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.10002980
add esp, 0xc
cmp byte [0x101b58bd], 0
movss xmm0, dword [eax + 4]
movss dword [esp + 0x14], xmm0
je 0x10011b45
movss xmm0, dword [0x100a5460]
jmp 0x10011b4d
movss xmm0, dword [0x100a539c]
mov eax, dword [0x101c8660]
movss dword [esp + 8], xmm0
mov dword [esp + 0x10], 0x42340000
mov dword [esp + 0xc], 0
movq xmm0, qword [eax + esi]
movq qword [esp + 0x18], xmm0
movss xmm1, dword [esp + 0x18]
movss xmm0, dword [esp + 0x1c]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
cvtps2pd xmm0, xmm1
xorps xmm1, xmm1
ucomisd xmm1, xmm0
ja 0x10011b9d
sqrtsd xmm0, xmm0
jmp 0x10011ba2
call fcn.10079330
fld qword [0x100a54a0]
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
call fcn.100795a0
fstp qword [esp + 0x18]
movsd xmm0, qword [esp + 0x18]
xorps xmm1, xmm1
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x100a54b0]
comiss xmm0, xmm1
jb 0x10011bea
movss xmm2, dword [0x100a54ac]
comiss xmm2, xmm0
jae 0x10011bfc
comiss xmm1, xmm0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
cmovbe eax, ecx
movss xmm0, dword [eax]
mov eax, dword [0x101c8504]
movss xmm1, dword [esp + 8]
push ecx
mov ecx, edi
mulss xmm0, dword [eax + 0x20]
mulss xmm1, xmm0
movss dword [esp], xmm1
call fcn.10011c70
mov eax, dword [ebp + 8]
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
comiss xmm0, dword [0x100a53e8]
mov dword [eax + 0x24], 0
jbe 0x10011c44
movss xmm1, dword [0x100a54c4]
jmp 0x10011c4c
movss xmm1, dword [0x100a53c8]
addss xmm0, dword [esp + 0x14]
push ecx
movss dword [eax + 0x28], xmm1
movss dword [esp], xmm0
push eax
call fcn.10071070
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10014e20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1b5d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10104a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
js 0x10014f5a
cmp esi, dword [ebx + 0x10]
jge 0x10014f5a
cmp dword [ebp + 0xc], 0
je 0x10014f5a
mov eax, dword [ebx + 0xc]
lea ecx, [esi*4]
mov dword [ebp - 0x20], ecx
xor edi, edi
mov eax, dword [ecx + eax]
mov ecx, dword [ebx]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
cmp byte [eax + 0xd], 0
jne 0x10014eae
nop
mov dword [ebp - 0x10], eax
cmp dword [eax + 0x10], esi
jge 0x10014e9f
mov eax, dword [eax + 8]
xor edi, edi
jmp 0x10014ea8
mov ecx, eax
mov edi, 1
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x10014e90
cmp byte [ecx + 0xd], 0
jne 0x10014eb9
cmp esi, dword [ecx + 0x10]
jge 0x10014f0a
cmp dword [ebx + 4], 0xaaaaaaa
je 0x10014f70
mov dword [ebp - 0x2c], ebx
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], 0
call fcn.100733a0
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], 0
mov dword [eax], ecx
push eax
mov dword [eax + 4], ecx
push edi
push dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov ecx, ebx
mov word [eax + 0xc], 0
call fcn.10019ea0
mov ecx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx + 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebx + 0xc]
push 0x40
push 4
add eax, edi
push eax
call esi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [edi + eax], ecx
lea eax, [ebp - 0x24]
mov ecx, dword [ebx + 0xc]
push eax
push dword [ebp - 0x18]
add ecx, edi
push 4
push ecx
call esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.1001a400
int3