joyce8/EMBER2024-capa huggingface dataset:
Function at 0xadc470
Capabilities:
Encode data using base64

Disassembly:
push ebp
xor ecx, ecx
push edi
push esi
push ebx
sub esp, 8
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
cmp esi, 0x3ffffffe
ja 0xadc539
lea edi, [esi + 2]
mov edx, 0x55555556
mov eax, edi
imul edx
sar edi, 0x1f
sub edx, edi
shl edx, 2
cmp edx, dword [esp + 0x20]
jge 0xadc539
test esi, esi
mov eax, dword [esp + 0x1c]
je 0xadc532
mov edx, esi
xor edi, edi
jmp 0xadc4c7
mov edx, dword [esp]
test edx, edx
je 0xadc514
movzx esi, byte [ebx]
shl edi, 8
add ebx, 1
add ecx, 8
add edi, esi
mov esi, edi
shl esi, 6
sub edx, 1
sete byte [esp + 7]
mov dword [esp], edx
mov ebp, esi
shr ebp, cl
sub ecx, 6
and ebp, 0x3f
movzx ebp, byte [ebp + 0x1258140]
mov edx, ebp
mov byte [eax], dl
add eax, 1
cmp ecx, 6
jg 0xadc4e5
test ecx, ecx
jle 0xadc4c0
cmp byte [esp + 7], 0
jne 0xadc4e5
mov edx, dword [esp]
test edx, edx
jne 0xadc4c7
mov edx, eax
sub edx, dword [esp + 0x1c]
and edx, 3
je 0xadc532
mov ecx, dword [esp + 0x1c]
mov byte [eax], 0x3d
add eax, 1
mov edx, eax
sub edx, ecx
and edx, 3
jne 0xadc523
mov ecx, dword [esp + 0x1c]
mov byte [eax], 0
add esp, 8
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0xadd660
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
push ebx
sub esp, 0x68
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x58], 0x10325476
mov dword [esp + 0x5c], 0x98badcfe
mov eax, esi
sar eax, 0x1f
test esi, esi
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x67452301
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jle 0xadd6e0
movzx eax, byte [edi]
xor ebx, ebx
mov byte [esp + 0x18], al
mov eax, 1
add ebx, 1
cmp ebx, esi
je 0xadd6e0
movzx edx, byte [edi + ebx]
mov byte [esp + eax + 0x18], dl
add eax, 1
cmp eax, 0x40
jne 0xadd6b0
lea eax, [esp + 0x58]
add ebx, 1
lea edx, [esp + 0x18]
call fcn.00adcb60
xor eax, eax
cmp ebx, esi
jne 0xadd6b7
lea esi, [esi]
mov eax, dword [esp + 0x78]
mov dword [esp + 4], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
call fcn.00add3d0
add esp, 0x68
pop ebx
pop esi
pop edi
ret

Function at 0xadfe30
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00adfe90
Function at 0xadfe90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov ecx, dword [0x1a4da18]
mov dword [esp + 0x1c], edx
test ecx, ecx
jle 0xadff99
mov eax, dword [0x1a4da14]
xor esi, esi
mov edx, dword [eax + 4]
cmp ebx, edx
jb 0xadfec9
mov edi, dword [eax + 8]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0xadff4c
add esi, 1
add eax, 0xc
cmp esi, ecx
jne 0xadfeb4
mov dword [esp], ebx
call fcn.00ae0390
test eax, eax
mov edi, eax
je 0xadffc0
lea edx, [esi + esi*2]
mov esi, dword [0x1a4da14]
shl edx, 2
add esi, edx
mov dword [esi + 8], eax
mov dword [esi], 0
mov dword [esp + 0x18], edx
call fcn.00ae0470
mov edx, dword [esp + 0x18]
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [0x1a4da14]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + edx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
mov edx, dword [esp + 0x18]
je 0xadffa0
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0xadff68
add dword [0x1a4da18], 1
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0xadff45
mov eax, dword [esp + 0x30]
add edx, dword [0x1a4da14]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
jmp 0xadff45
xor esi, esi
jmp 0xadfed3
mov eax, dword [0x1a4da14]
mov eax, dword [eax + edx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00adfe30
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00adfe30

Function at 0xae0280
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
cmp word [edx], 0x5a4d
je 0xae0290
repz ret
add edx, dword [edx + 0x3c]
cmp dword [edx], 0x4550
jne 0xae028d
xor eax, eax
cmp word [edx + 0x18], 0x10b
sete al
ret

Function at 0xae0850
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x1a4dd84
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x1a4dd9c]
sub esp, 4
test ebx, ebx
je 0xae08a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0xae089e
test esi, esi
je 0xae089e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0xae0880
mov dword [esp], 0x1a4dd84
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xae1b30
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], edi
mov esi, dword [ebp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0xae1b90
mov ecx, dword [ecx + 4]
lea edi, [edx*4]
movzx edx, byte [ecx + edx*4]
mov byte [esi], dl
mov edx, dword [eax]
mov edx, dword [edx + 4]
movzx edx, byte [edx + edi + 1]
mov byte [ebx], dl
mov eax, dword [eax]
mov edx, dword [ebp + 0x18]
mov eax, dword [eax + 4]
movzx eax, byte [eax + edi + 2]
mov byte [edx], al
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x10]
movzx edi, byte [eax + 6]
and ecx, edx
mov dword [ebp - 0x18], ecx
movzx ecx, byte [eax + 0xa]
mov dword [ebp - 0x10], edi
add edi, edi
shr dword [ebp - 0x18], cl
mov ecx, 8
sub ecx, edi
mov edi, dword [ebp - 0x18]
shr edi, cl
movzx ecx, byte [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shl edi, cl
movzx ecx, byte [ebp - 0x14]
add ecx, edi
mov byte [esi], cl
mov esi, dword [eax + 0x14]
movzx ecx, byte [eax + 0xb]
movzx edi, byte [eax + 7]
and esi, edx
shr esi, cl
mov ecx, 8
mov dword [ebp - 0x14], edi
add edi, edi
sub ecx, edi
mov edi, esi
shr edi, cl
movzx ecx, byte [ebp - 0x14]
mov dword [ebp - 0x10], edi
shl esi, cl
movzx ecx, byte [ebp - 0x10]
add ecx, esi
mov byte [ebx], cl
movzx ecx, byte [eax + 0xc]
mov ebx, 8
and edx, dword [eax + 0x18]
movzx eax, byte [eax + 8]
mov edi, dword [ebp + 0x18]
shr edx, cl
lea ecx, [eax + eax]
sub ebx, ecx
mov ecx, ebx
mov ebx, edx
shr ebx, cl
mov ecx, eax
shl edx, cl
add ebx, edx
mov byte [edi], bl
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0xae29a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x2c]
test edx, edx
je 0xae29cc
sub edx, 1
test edx, edx
mov dword [eax + 0x2c], edx
jne 0xae29cc
mov edx, dword [eax + 0x18]
sub dword [eax + 0x14], edx
mov edx, dword [eax]
test dl, 5
jne 0xae29e0
test dh, 0x40
jne 0xae29d0
leave
ret
and dh, 0xbf
mov dword [eax], edx
mov dword [ebp + 8], eax
leave
jmp fcn.00af0130
mov edx, dword [0x1a4ddb0]
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [edx + 0x58]
leave
ret
Function at 0xafc6d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 8
call sub.msvcrt.dll_malloc
test eax, eax
je 0xafc732
mov edx, dword [sym.imp.msvcrt.dll__endthreadex]
mov dword [eax + 4], edx
mov edx, dword [ebp + 0xc]
mov dword [eax], edx
lea edx, [ebp - 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xafc690
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov edx, dword [ebp + 8]
test eax, eax
mov dword [edx + 4], eax
je 0xafc745
xor eax, eax
leave
ret
mov dword [esp], 0
call fcn.00ae69b0
mov eax, 0xffffffff
leave
ret
mov dword [esp], 0x125af68
call fcn.00ae6670
mov eax, 0xffffffff
leave
ret

Function at 0xafc7c0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
sub esp, 8
leave
ret
Function at 0xaffcb0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x41
sub esp, 0x3c
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [0x1a4e220], 0xaff6a0
lea esi, [ebp - 0x1c]
mov dword [0x1a4e224], 0xaffc00
mov dword [0x1a4e228], 0xaffa60
mov dword [0x1a4e22c], 0xaff960
mov dword [0x1a4e230], 0xaff880
mov dword [0x1a4e234], 0xaff850
mov dword [0x1a4e238], 0xaff7c0
mov dword [0x1a4e23c], 0xaff790
mov dword [0x1a4e240], 0xaff760
mov dword [0x1a4e244], 0xaff730
jmp 0xaffd38
add ebx, 1
cmp ebx, 0x5b
je 0xaffd94
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._c:_
mov dword [esp + 4], 4
mov dword [esp], esi
call fcn.01088520
mov dword [esp], esi
call edi
sub esp, 4
cmp eax, 5
jne 0xaffd30
mov edx, dword [0x1abab4c]
cmp edx, 0x19
jg 0xaffd30
mov dword [ebp - 0x2c], edx
mov dword [esp], esi
call sub.msvcrt.dll__strdup
mov edx, dword [ebp - 0x2c]
test eax, eax
mov dword [edx*4 + 0x1a52720], eax
je 0xaffdac
add ebx, 1
add dword [0x1abab4c], 1
cmp ebx, 0x5b
jne 0xaffd38
mov edx, 0x1a527a0
xor eax, eax
mov ecx, 0x1a
mov edi, edx
rep stosd dword es:[edi], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
call fcn.00ae69b0
jmp 0xaffd30

Function at 0xb09930
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0
mov dword [ebp - 0xc], ebx
lea ebx, [ebp - 0x20]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
sub esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetACP]
movzx esi, si
mov dword [esp + 0xc], 8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1004
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
sub esp, 0x10
test eax, eax
jne 0xb09992
mov eax, edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_atoi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xb0c540
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 4], edi
cmp ebx, 0xd
mov edi, ecx
mov dword [ebp - 8], esi
mov esi, edx
mov byte [edi], dl
mov dword [ecx + 8], 0
mov word [ecx + 0xc], 0
je 0xb0c612
mov eax, dword [0x1a52904]
mov dword [esp + 4], 1
mov dword [ebp - 0x12c], ebx
mov dword [esp + 8], eax
mov eax, esi
and eax, 0xff
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov edx, dword [ebp - 0x12c]
sub esp, 0xc
cmp ebx, 0x6b
jle 0xb0c5f1
cmp ebx, 0x6f
je 0xb0c5c8
jg 0xb0c6a3
cmp ebx, 0x6d
je 0xb0c5c8
lea edx, [eax - 0xc]
cmp edx, 0x22
jbe switch.0x00b0c6b7
test eax, eax
mov edx, eax
cmove edx, ebx
mov eax, dword [edx*4 + 0x1a52920]
mov dword [edi + 4], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0xb0c5e2
mov eax, dword [0x1a4fb00]
test eax, eax
jne 0xb0c624
mov eax, edi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
cmp ebx, 0x6a
jge 0xb0c5c8
cmp ebx, 0x2c
je 0xb0c5c8
nop
lea esi, [esi]
jg 0xb0c6c0
cmp ebx, 0x13
jne 0xb0c5b5
nop
lea esi, [esi]
jmp 0xb0c5c8
test dh, 1
je 0xb0c570
mov dword [ecx + 4], 0x10f
jmp 0xb0c5d2
lea edx, [ebp - 0x11c]
mov dword [esp], edx
mov dword [ebp - 0x12c], edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edx, dword [ebp - 0x12c]
sub esp, 4
cmp ebx, 0x5f
jbe 0xb0c659
test byte [ebp - 0x8c], 1
je 0xb0c659
cmp ebx, 0x69
jbe 0xb0c6d5
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [0x10efd24]
sub esp, 0x18
test eax, eax
jle 0xb0c5e2
movzx eax, word [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov word [edi + 0xc], ax
mov eax, edi
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea ecx, [ebx - 0xa0]
cmp ecx, 5
jbe 0xb0c5c8
jmp 0xb0c5b5
jmp dword [edx*4 + 0x125ddb0]
lea ecx, [ebx - 0x5b]
cmp ecx, 2
ja 0xb0c5b5
lea esi, [esi]
jmp 0xb0c5c8
sub ebx, 0x30
mov word [edi + 0xc], bx
jmp 0xb0c5e2
mov edx, 0x6e
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x60
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x62
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x66
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x68
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x64
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x67
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x61
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x63
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x69
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
mov edx, 0x65
test esi, 0x100
cmovne edx, eax
jmp 0xb0c5c8
Function at 0xb0d280
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00b0a710
mov dword [esp], 0x125de91
call fcn.00ae6ae0
xor edx, edx
test eax, eax
setne dl
test edx, edx
mov dword [0x1a528dc], edx
je 0xb0d327
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.01089f70
test eax, eax
mov dword [0x1a528ac], eax
je 0xb0d3c7
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [0x1a52900], eax
mov eax, dword [0x1a528ac]
sub esp, 8
mov dword [esp + 8], 0xb09ad0
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
sub esp, 0xc
call fcn.00b0a660
xor eax, eax
leave
ret
mov eax, dword [0x1a528a0]
mov edx, dword [0x1a528a8]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xca0000
mov dword [esp + 8], eax
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
sub esp, 0x30
test eax, eax
mov dword [0x1a528ac], eax
je 0xb0d3b4
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
sub esp, 8
call fcn.00b0a660
xor eax, eax
leave
ret
mov dword [esp], 0x125dec3
call fcn.00ae6670
mov eax, 0xffffffff
leave
ret
mov dword [esp], 0x125dea0
call fcn.00ae6670
mov eax, 0xffffffff
leave
ret

Function at 0xb0e250
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 8], esi
mov esi, edx
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov byte [esi], al
mov eax, dword [eax*4 + 0x1a532a0]
mov dword [ebp - 4], edi
mov dword [edx + 8], 0
mov word [edx + 0xc], 0
mov dword [edx + 4], eax
je 0xb0e28d
mov edi, dword [0x1a4fb00]
test edi, edi
jne 0xb0e2a0
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
lea edx, [ebp - 0x11c]
mov dword [ebp - 0x12c], edx
sub esp, 8
mov edi, eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov edx, dword [ebp - 0x12c]
sub esp, 4
cmp edi, 0x5f
jbe 0xb0e2e7
test byte [ebp - 0x8c], 1
je 0xb0e2e7
cmp edi, 0x69
jbe 0xb0e331
lea eax, [ebp - 0x1c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [0x10efd24]
sub esp, 0x18
test eax, eax
jle 0xb0e28d
movzx eax, word [ebp - 0x1c]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov word [esi + 0xc], ax
mov eax, esi
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
sub edi, 0x30
mov word [esi + 0xc], di
jmp 0xb0e28d
Function at 0xbb63d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov edx, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x4c]
mov eax, edx
neg eax
add ecx, 0x10
lea eax, [eax*8 - 8]
add eax, dword [ebx + 0x78]
mov dword [esp], 0x18
call fcn.00bb4400
mov edx, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x4c]
mov eax, edx
neg eax
add ecx, 0x10
lea eax, [eax*8 - 8]
add eax, dword [ebx + 0x7c]
mov dword [esp], 0x18
call fcn.00bb4400
mov edx, dword [ebx + 0x3c]
mov ecx, dword [ebx + 0x4c]
mov eax, edx
neg eax
add ecx, 0x10
lea eax, [eax*8 - 8]
add eax, dword [ebx + 0x80]
mov dword [esp + 0x20], 0x18
add esp, 0x18
pop ebx
jmp fcn.00bb4400
Function at 0xcd7e30
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x60]
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], ebp
mov eax, dword [ebx + 0x3268]
test eax, eax
je 0xcd7eb8
mov ecx, dword [esi + 0x2c3c0]
mov dword [ebx + 0x3fc0], 0
test ecx, ecx
jne 0xcd7f4e
mov eax, dword [ebx + 0x3fc0]
test eax, eax
jle 0xcd7e95
mov dword [esp], esi
add esi, 0x114a0
mov dword [esp + 4], eax
call fcn.00cff100
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00cf84a0
mov eax, dword [ebx + 0x30b8]
mov dword [esp], eax
call dword [0x1a8d4f0]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
call fcn.00cff550
lea eax, [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [esp], eax
call edi
mov ebp, dword [esi + 0x2b2f0]
sub esp, 4
test ebp, ebp
mov dword [esp + 4], esi
mov eax, dword [esi + 0x1f684]
mov dword [esp], eax
je 0xcd7f75
call fcn.00cff140
lea eax, [esp + 0x30]
mov dword [esp], eax
call edi
mov eax, dword [esi + 0x2c4f8]
sub esp, 4
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x14], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov edx, 0xf4240
sub esp, 4
test eax, eax
jne 0xcd7f80
mov ecx, dword [esi + 0x2c3c0]
add edx, dword [esp + 0x18]
test ecx, ecx
mov dword [esi + 0x2c4f8], edx
je 0xcd7e6d
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [esi + 0x2c3ec]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
sub esp, 0xc
jmp 0xcd7e6d
call fcn.00cfed90
jmp 0xcd7eef
mov ecx, dword [esp + 0x3c]
sub edi, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
sbb ebp, dword [esp + 0x14]
cmp ebp, ecx
mov dword [esp + 0x10], edx
jg 0xcd7fd8
jl 0xcd7f9e
cmp edi, edx
jae 0xcd7fd8
imul eax, ebp, 0xf4240
mov ebp, 0xf4240
mov dword [esp + 0xc], ecx
mov dword [esp + 0x1c], eax
mov eax, edi
mul ebp
mov ebp, dword [esp + 0x1c]
add ebp, edx
mov edx, dword [esp + 0x10]
mov edi, eax
mov dword [esp], edi
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
call fcn.01087f40
mov edx, eax
jmp 0xcd7f36
mov edx, 0xf4240
jmp 0xcd7f36
Function at 0xd06550
Capabilities:
Create thread

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test eax, eax
mov dword [ebx + 4], 0
mov dword [ebx], edx
je 0xd06598
mov dword [ebx + 4], 1
lea edx, [esp + 0x2c]
mov dword [esp + 8], eax
lea eax, [ebx + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x4f
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov byte [ebx + 0x57], 0
mov eax, dword [ebx + 0x58]
test eax, eax
jne 0xd065a4
add esp, 0x18
pop ebx
ret
mov eax, dword [ebx]
add ebx, 0x5c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_longjmp
lea esi, [esi]
lea edi, [edi]

Function at 0xd0fb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, eax
mov eax, edx
push edi
mov edi, edx
sar eax, 0x1f
push esi
xor edi, eax
push ebx
sub edi, eax
sub esp, 8
cmp edi, 7
mov esi, ecx
movzx ecx, byte [ecx]
mov dword [esp], edx
jg 0xd0fc30
xor edx, edx
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 2]
mov ebx, edi
sar ebx, 2
mov eax, ebp
mov edx, ebx
call fcn.00d0fa60
movsx ebx, byte [ebx + 0x12815a0]
mov dword [esp + 4], ebx
movzx eax, byte [esp + 4]
mov ebx, edi
sar ebx, 1
and ebx, 1
mov edx, ebx
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00d0fa60
mov eax, dword [esp + 4]
mov edx, edi
and edx, 1
movzx eax, byte [ebx + eax + 0x12815a0]
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00d0fa60
test edi, edi
je 0xd0fd07
mov edx, dword [esp]
mov eax, ebp
movzx ecx, byte [esi + 1]
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
shr edx, 0x1f
jmp fcn.00d0fa60
mov edx, 1
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 9]
mov edx, edi
and edx, 1
mov eax, ebp
call fcn.00d0fa60
movzx ecx, byte [esi + 0xa]
mov edx, edi
sar edx, 1
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xb]
mov edx, edi
sar edx, 2
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x12]
mov edx, edi
sar edx, 9
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x11]
mov edx, edi
sar edx, 8
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0x10]
mov edx, edi
sar edx, 7
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xf]
mov edx, edi
sar edx, 6
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xe]
mov edx, edi
sar edx, 5
mov eax, ebp
and edx, 1
call fcn.00d0fa60
movzx ecx, byte [esi + 0xd]
mov edx, edi
sar edx, 4
mov eax, ebp
and edx, 1
call fcn.00d0fa60
test edi, 0xfff0
je 0xd0fc14
movzx ecx, byte [esi + 0xc]
mov edx, edi
mov eax, ebp
sar edx, 3
and edx, 1
call fcn.00d0fa60
jmp 0xd0fc14
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x10]
movzx edx, word [ebx]
mov ecx, esi
mov eax, edi
sar dx, 1
movsx edx, dx
call 0xd0fb80
movzx edx, word [ebx + 2]
lea ecx, [esi + 0x13]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
sar dx, 1
movsx edx, dx
jmp 0xd0fb80