joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4074f6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor eax, eax
cmp word [ecx], 0x5a4d
jne 0x407576
dec esp
arpl word [ecx + 0x3c], ax
dec ecx
add eax, ecx
inc ecx
cmp dword [eax], 0x4550
jne 0x407576
inc ebp
mov eax, dword [eax + 0x88]
inc ebp
test eax, eax
je 0x407576
dec edx
lea edi, [ecx + eax]
inc esp
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x14]
test esi, esi
dec esi
lea edx, [ecx + eax]
je 0x407576
movzx ebx, byte [edx]
inc ebp
xor ebx, ebx
inc ebp
mov ecx, dword [edx]
dec ecx
add ecx, ecx
inc ecx
cmp byte [ecx], bl
jne 0x407567
test bl, bl
je 0x40757a
dec eax
mov eax, edx
jmp 0x407553
inc ebp
test al, al
je 0x40757a
dec eax
add eax, 1
dec ecx
mov eax, eax
dec ecx
sub eax, edx
inc edi
movzx eax, byte [eax + ecx]
inc esp
cmp al, byte [eax]
je 0x40754e
inc ecx
add ebx, 1
dec ecx
add edx, 4
inc ecx
cmp ebx, esi
jne 0x40753a
xor eax, eax
pop ebx
pop esi
pop edi
ret
inc esp
cmp esi, ebx
je 0x407574
mov edx, dword [edi + 0x24]
dec esi
lea eax, [ecx + ebx*2]
mov eax, dword [edi + 0x1c]
inc ecx
movzx edx, word [eax + edx]
dec eax
lea edx, [ecx + edx*4]
mov eax, dword [edx + eax]
dec eax
add eax, ecx
pop ebx
pop esi
pop edi
ret

Function at 0x4075c7
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x4075d1
add dword [esp], 5
retf

Function at 0x40775e
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
push 0x33
call 0x407768
add dword [esp], 5
retf
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x29053e10
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x1d56766c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jl 0x401765
enter 0x40c0, 0
push eax
sub edx, 0x7e
push 0x40d274
ljmp 0x40:0xd274687e
push ecx
call dword [0x40e09b]
mov eax, dword [0x410287]
add esp, 0xc
test eax, eax
je 0x401787
push eax
push 0x2540d254
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push 0x23
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
fdiv qword [edx]
mov eax, 0xa1000000
js 0x40179e
mov eax, dword [0x410278]
inc ecx
add byte [ebp + 0x404c19c0], al
inc ecx
test eax, eax
sbb dword [eax + eax*2 + 0x41], ecx
add byte [esp + edx + 0x68], dh
inc eax
cmp al, 0x41
out 0x50, al
call fcn.00407d50
mov cx, word [0xd0274]
jmp 0x4017cf
mov cl, 8
sbb byte [ecx], al
loop 0x40175e
add al, byte [ecx]
push ebx
push esi
mov byte [0x40c133d5], al
add byte [esi - 0x77], ah
jle 0x401799
or esi, dword [edx - 0x483f7a15]
jne 0x40184a
mov eax, dword [esi + 0x381800]
push edx
push str.Benchmarking__s
jmp [0x410278a1]
mov edx, dword [0x3440e618]
mov esi, dword [0x88c158]
push 0x860
outsb dx, byte [esi]
call [esi + 0x4a]
mov al, 0xb
inc ecx
add byte [ecx + 0x40d010], ah
les esp, [eax]
push eax
call esi
mov ecx, dword [0x41404c]
mov edx, dword [0xaed0c3]
add esp, 0x10
mov dword [0x2d417ec8], eax
aas
add byte [ecx + 0x52], dl
inc ecx
sub eax, 0x5251003f
jbe 0x40187f
pop ss
mov al, 0
call fcn.00406010
mov al, byte [0x500e74c0]
push str.apr_pollset_create_failed
inc esp
mov byte [0x8300d005], al
les ecx, [eax]
mov eax, dword [0x41027c]
test eax, eax
jne 0x4018df
mov eax, dword [0x410bac]
mov ebx, dword [edi + 0x41de9c]
mov edi, dword [eax + ecx*2 + 0x6a004140]
add byte [eax - 0x64], ch
rol dword [eax], 1
push eax
ja 0x401911
inc eax
inc ecx
retf
mov eax, dword [0x414048]
mov ebx, edx
add byte [edx], 0x3c
add byte [ebp - 0x74d98a37], al
or eax, 0x415a4c
push 0
push 0x7840349c
push 0x93d444
cmp dword [ebp - 0x2c], edx
inc eax
sbb eax, 0x84b25150
aas
add byte [eax], al
add esp, 0x18
mov dword [0x414048], eax
loope 0x401923
inc eax
inc ecx
add cl, ah
or eax, 0x41d584
test ecx, ecx
jne 0x401913
test ch, dl
inc ecx
add byte [ebp - 0x740a8a37], al
adc eax, 0x241404c
mov edx, dword [0x241404c]
add ch, byte [edx]
push 0
push 0x28d418
push eax
push edx
call fcn.00405890
sbb edi, 0x10
mov dword [0x414048], eax
mov ecx, dword [0x890260]
aam 0xc9
mul dword [ebx + 0x37]
xchg edi, eax
push 0xbe324102
cld
rol dword [esi + 0x10], cl
test dword [eax], eax
jne 0x401958
mov esi, 0x4e02d4
mov edx, dword [0x41021e]
test edx, edx
mov byte [0x5f414040], dl
xor al, 6
mov edx, dword [0x41a0e4]
test ecx, ecx
mov ecx, 0x40d3f8
je 0x40197c
mov ecx, str.HEAD
mov eax, dword [0xbf376704]
lahf
mov eax, dword [0xb14044]
push eax
push esi
scasd eax, dword es:[edi]
push ecx
xchg byte [0x360c30], cl
adc ah, 0xd3
inc eax
add byte [eax], ch
or byte [eax], al
add byte [ecx - 0x18], dl
ficomp word [eax - 0x3b7c0100]
jmp 0x401a24
cmp eax, 0x6d540800
inc esp
mov ebx, 0x40216448
add ch, al
sbb edi, ebp
invalid
Function at 0x10003af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
add eax, 5
mov esi, esp
push eax
call dword [sym.imp.MSVCR100D.dll_malloc]
add esp, 4
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.MSVCR100D.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
sub eax, dword [ebp - 8]
sub eax, 5
mov ecx, dword [ebp - 8]
mov dword [ecx + 1], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov ecx, dword [ebp + 8]
mov dword [ecx + 1], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 0x10]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003bdc]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret

Function at 0x10003c00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10003c68
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x10003c7b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x10003c5f
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp + 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x10003cc4]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x10003db0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
add ecx, 0x14
cmp dword [ebp - 0x20], ecx
je 0x10003e30
cmp dword [ebp - 0x20], 0
je 0x10003e30
mov eax, dword [ebp - 0x20]
sub eax, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x28]
push edx
call fcn.10003e50
add esp, 8
test eax, eax
je 0x10003e26
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x18]
jmp 0x10003e32
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
jmp 0x10003dea
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x10004130
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
push ebx
push esi
push edi
lea edi, [ebp - 0x2fc]
mov ecx, 0xbf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x48], 0
push 0x31
push 0
lea eax, [ebp - 0x47]
push eax
call sub.MSVCR100D.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10004179
xor eax, eax
jmp 0x100042a6
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100041a3
xor eax, eax
jmp 0x100042a6
mov esi, esp
push 0x10028a90
mov edi, esp
push 0x10028a80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp edi, esp
call fcn.100226a0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0x60], eax
mov esi, esp
push 4
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100D.dll_strlen
add esp, 4
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0x54], eax
mov esi, esp
push 0
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR100D.dll_strlen
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.100226a0
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp esi, esp
call fcn.100226a0
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
push str._s_tried_to_be_loaded__n
lea ecx, [ebp - 0x168]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.100226a0
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100226a0
mov esi, esp
push 0xc000
push 0
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp esi, esp
call fcn.100226a0
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100042d8]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100228c0
add esp, 0x2fc
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x10004470
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 8], eax
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.100226a0
mov byte [ebp - 0x1d], 0x90
mov dword [ebp - 0x2c], 0
jmp 0x100044d7
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0xc]
jae 0x10004503
mov esi, esp
push 0
push 1
lea eax, [ebp - 0x1d]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp esi, esp
call fcn.100226a0
jmp 0x100044ce
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp esi, esp
call fcn.100226a0
push edx
mov ecx, ebp
push eax
lea edx, [0x1000454c]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x10005d00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push str.._config1.txt
push 0
push str.Talisman
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne al
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret

Function at 0x100072c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf0
push ebx
push esi
push edi
lea edi, [ebp - 0xf0]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 1], ecx
mov dword [ebp - 0x2c], 5
jmp 0x10007328
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp + 0x10]
jae 0x1000733b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x2c]
mov byte [eax], 0x90
jmp 0x1000731f
mov esi, esp
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100226a0
push edx
mov ecx, ebp
push eax
lea edx, [0x10007380]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xf0
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret

Function at 0x10007480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0x40
push 0x3000
mov eax, dword [ebp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 8], eax
mov esi, esp
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR100D.dll_memcpy_s]
add esp, 0x10
cmp esi, esp
call fcn.100226a0
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 8]
sub eax, 5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov byte [eax], 0xe9
mov eax, dword [ebp - 8]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 1], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100072c0
add esp, 0xc
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x10008fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x1000906c
mov esi, esp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100226a0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push str.closed_TITLE_:__s__n
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.100226a0
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x100], esp
lea eax, [ebp - 0x34]
push eax
call fcn.10002270
mov dword [ebp - 0x108], eax
call fcn.1001d360
add esp, 0x20
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x1000909c]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100228c0
add esp, 0x108
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret

Function at 0x100090c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10032420]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExA]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jbe 0x10009170
mov esi, esp
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.100226a0
mov esi, esp
mov eax, dword [ebp + 8]
push eax
push str.closed_CLASSEWINDOW_:__s__n
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.MSVCR100D.dll_sprintf]
add esp, 0xc
cmp esi, esp
call fcn.100226a0
sub esp, 0x20
mov ecx, esp
mov dword [ebp - 0x100], esp
lea eax, [ebp - 0x34]
push eax
call fcn.10002270
mov dword [ebp - 0x108], eax
call fcn.1001d360
add esp, 0x20
mov esi, esp
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x100091a0]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100228c0
add esp, 0x108
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret
Function at 0x1000a540
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], 0x811c9dc5
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp + 8]
call fcn.10002450
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, 0xa
div ecx
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x1000a599
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x2c]
jae 0x1000a5c0
mov esi, dword [ebp - 0x14]
imul esi, esi, 0x1000193
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
call fcn.1000f2f0
movsx ecx, byte [eax]
xor esi, ecx
mov dword [ebp - 0x14], esi
jmp 0x1000a590
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a960
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
lea edi, [ebp - 0xc0]
mov ecx, 0x30
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
cmp dword [0x10032600], 0
je 0x1000a9ab
mov esi, esp
push 0x10
push str.Error
push str.Keyboard_hook_is_already_set_up
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.100226a0
mov eax, 1
jmp 0x1000aa09
mov esi, esp
push 0
mov edi, esp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp edi, esp
call fcn.100226a0
push eax
push 0x1000a050
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
cmp esi, esp
call fcn.100226a0
mov dword [0x10032600], eax
cmp dword [0x10032600], 0
jne 0x1000aa07
mov esi, esp
push 0x10
push str.Error
push str.Failed_to_set_up_keyboard_hook
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, esp
call fcn.100226a0
mov eax, 2
jmp 0x1000aa09
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret

Function at 0x1000b180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
lea eax, [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.100226a0
mov dword [ebp - 0x14], eax
mov esi, esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, esp
call fcn.100226a0
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100226a0
push edx
mov ecx, ebp
push eax
lea edx, [0x1000b210]
call fcn.100226d0
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.100226a0
mov esp, ebp
pop ebp
ret