joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001440
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0x200030
push dword [0x100260c0]
push str.Error_201__Contate_um_administrador_e_avise_da_falha___
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100014b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, 0x10015028
lea ecx, [ecx]
mov eax, dword [esi - 8]
test eax, eax
je 0x10001520
lea ecx, [ebp - 8]
push ecx
push 4
push dword [esi]
push eax
call edi
mov ecx, dword [esi]
cmp ecx, 1
jne 0x100014f3
mov eax, dword [esi - 8]
mov al, byte [eax]
cmp al, byte [esi - 4]
jmp 0x10001511
cmp ecx, 2
jne 0x10001504
mov eax, dword [esi - 8]
mov ax, word [eax]
cmp ax, word [esi - 4]
jmp 0x10001511
cmp ecx, 4
jne 0x10001513
mov eax, dword [esi - 8]
mov eax, dword [eax]
cmp eax, dword [esi - 4]
jne 0x1000153b
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ecx
push dword [esi - 8]
call edi
add esi, 0x10
cmp esi, 0x10015358
jl 0x100014d0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
push 1
call dword [sym.imp.MSVCR120.dll_exit]
int3
Function at 0x10003110
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1000e8d8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x10003297
cmp byte [edi + 0x45], 0
je 0x10003297
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x10003170
xor al, al
jmp 0x10003299
sub esp, 8
lea ecx, [esp + 0x20]
call fcn.10002e20
mov dword [esp + 0x40], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp ebx, 0x10
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi + 0x40]
lea eax, [edi + 0x48]
push eax
call dword [sym.imp.MSVCP120.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100031cf
dec eax
je 0x100031d3
sub eax, 2
je 0x1000327d
xor bl, bl
jmp 0x1000327f
mov byte [edi + 0x45], 0
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ebx, 0x10
mov esi, dword [esp + 0x14]
cmovae eax, ecx
sub esi, eax
je 0x1000320b
push dword [edi + 0x50]
cmp ebx, 0x10
lea eax, [esp + 0x1c]
push esi
cmovae eax, ecx
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x100031c8
cmp byte [edi + 0x45], 0
je 0x1000327d
test esi, esi
jne 0x10003184
mov ecx, dword [esp + 0x28]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x10003272
lea esi, [ecx + 8]
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.10003460
test al, al
je 0x10003184
cmp dword [esp + 0x2c], 0x10
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
cmovae ecx, dword [esp + 0x18]
movq qword [ecx + eax], xmm0
lea eax, [esp + 0x18]
cmp dword [esp + 0x2c], 0x10
mov dword [esp + 0x28], esi
cmovae eax, dword [esp + 0x18]
mov byte [eax + esi], 0
jmp 0x10003184
push str.string_too_long
call dword [sym.imp.MSVCP120.dll_void___cdecl_std::_Xlength_error_char_const__]
mov bl, 1
cmp dword [esp + 0x2c], 0x10
jb 0x10003293
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
jmp 0x10003299
mov al, 1
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x100039e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
push esi
mov esi, ecx
test al, 1
jne 0x10003a1b
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000ed50
mov dword [0x100248e4], eax
call fcn.1000dea4
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003a51
lea eax, [ebp - 8]
mov dword [esi], 5
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret 4

Function at 0x10003a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
push esi
mov esi, ecx
test al, 1
jne 0x10003aab
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000ed50
mov dword [0x100248e4], eax
call fcn.1000dea4
add esp, 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10003ae1
lea eax, [ebp - 8]
mov dword [esi], 0
push eax
push dword [ebp - 8]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x10005260
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
jmp 0x10005282
lea eax, [ebp - 8]
push eax
push 4
push 0x1cc000
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 4
push 0x18000
push 0x5cd000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1002757c]
test al, 1
jne 0x100052d6
or eax, 1
mov dword [0x10027580], 0x1000fdcc
push 0x1000ed70
mov dword [0x1002757c], eax
call fcn.1000dea4
add esp, 4
call fcn.100053f0
test al, al
jne 0x100052ef
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10027574]
test al, 1
jne 0x10005317
or eax, 1
mov dword [0x10027578], 0x1000fdb4
push 0x1000ed60
mov dword [0x10027574], eax
call fcn.1000dea4
add esp, 4
call fcn.10009ca0
test al, al
je 0x100052df
mov byte [0x100248fa], 1
call fcn.100072d0
test al, al
je 0x10005338
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.100073b0
test al, al
je 0x10005349
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret

Function at 0x10005360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1d
push 0x44b828
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100053db
mov eax, 0x44b828
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
mov dword [eax + 0x18], 0x90909090
mov byte [eax + 0x1c], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x1d
push 0x44b828
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret 8
Function at 0x10005e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100248e4]
test al, 1
jne 0x10005e48
or eax, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000ed50
mov dword [0x100248e4], eax
call fcn.1000dea4
add esp, 4
push ebx
push esi
push edi
push 0x100245a5
push 5
mov dword [ebp - 8], 0
call fcn.1000df1c
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x10005ed0
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006020
push 5
sub ecx, 0x4e0546
push 0x4e0541
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x10005ed0
mov eax, dword [esi]
mov ecx, 0x4e0541
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x10005ed0
push 5
push 0x4e0541
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push 0x100245a5
push 6
mov dword [ebp - 8], 0
call fcn.1000df1c
mov esi, eax
add esp, 8
test esi, esi
je 0x10005f4f
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006050
sub ecx, 0x50d979
push 6
mov dword [esi + 1], ecx
push 0x50d974
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10005f4f
mov eax, dword [esi]
mov ecx, 0x50d974
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10005f4f
push 6
push 0x50d974
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
push 0x100245a5
push 6
mov dword [ebp - 8], 0
call fcn.1000df1c
mov esi, eax
add esp, 8
test esi, esi
je 0x10005fce
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x10006080
sub ecx, 0x4df308
push 6
mov dword [esi + 1], ecx
push 0x4df303
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x10005fce
mov eax, dword [esi]
mov ecx, 0x4df303
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x10005fce
push 6
push 0x4df303
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete___void__]
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x100061b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000eaab
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x12c
lea eax, [ebp - 0x140]
push 0
push eax
call sub.MSVCR120.dll_memset
sub esp, 0xc
lea ecx, [ebp - 0x140]
call fcn.1000d200
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x13c]
test eax, eax
je 0x10006233
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebp - 0x13c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.USER32.dll_UnregisterClassA]
lea ecx, [ebp - 0x140]
call fcn.1000d300
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10006652
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001490
push 0
push 0
mov dword [0x100248f0], esi
call edi
push 0
push 0
push 0
push 0x10006110
push 0
push 0
call edi
push 0
push 0
push 0
push 0x100063c0
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10006150
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10006260
push 0
push 0
mov dword [0x100248f4], eax
call edi
call fcn.100013c0
push 0
push 0
push 0
push 0x10001a10
push 0
push 0
call edi
push 0
push 0
push 0
push 0x10001c10
push 0
push 0
call edi
call fcn.10001e90
push 0
push 0
push 0
push 0x100021a0
push 0
push 0
call edi
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.shell32.dll
call esi
push str.xProtect.dll
call esi
push str.music.dll
call esi
push 0
push 0
push 0
push 0x10006ab0
push 0
push 0
call edi
pop edi
cmp dword [ebp + 0x10], 0
pop esi
jne 0x1000664c
mov eax, dword [0x10027584]
test al, 1
jne 0x1000662a
or eax, 1
mov dword [0x10027588], 0x1000fde0
push 0x1000ed80
mov dword [0x10027584], eax
call fcn.1000dea4
add esp, 4
mov ecx, 0x10027588
call fcn.10005260
test al, al
jne 0x10006669
push 0
push str.Erro:_ClientPatch.dll
push 0x1000fe50
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
ret 0xc
test eax, eax
jne 0x1000664c
cmp dword [ebp + 0x10], eax
je 0x1000664c
call fcn.10006680
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100066b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x6bdaf0]
push esi
mov esi, ecx
push 0x44d
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x48]
cmp esi, 1
jne 0x100066ee
push 0x3e8
push 0x3e8
push str.UIList1.txt
jmp 0x1000681f
cmp esi, 2
jne 0x10006707
push 0x3e8
push 0x3e8
push str.UIList2.txt
jmp 0x1000681f
cmp esi, 3
jne 0x10006720
push 0x3e8
push 0x3e8
push str.UIList3.txt
jmp 0x1000681f
cmp esi, 4
jne 0x10006739
push 0x3e8
push 0x3e8
push str.UIList4.txt
jmp 0x1000681f
cmp esi, 5
jne 0x10006752
push 0x3e8
push 0x3e8
push str.UIList5.txt
jmp 0x1000681f
cmp esi, 6
jne 0x1000676b
push 0x3e8
push 0x3e8
push str.UIList6.txt
jmp 0x1000681f
cmp esi, 7
jne 0x10006784
push 0x3e8
push 0x3e8
push str.UIList7.txt
jmp 0x1000681f
cmp esi, 8
jne 0x1000679d
push 0x3e8
push 0x3e8
push str.UIList8.txt
jmp 0x1000681f
cmp esi, 9
jne 0x100067b3
push 0x3e8
push 0x3e8
push str.UIList9.txt
jmp 0x1000681f
cmp esi, 0xa
jne 0x100067c9
push 0x3e8
push 0x3e8
push str.UIList10.txt
jmp 0x1000681f
cmp esi, 0xb
jne 0x100067df
push 0x3e8
push 0x3e8
push str.UIList11.txt
jmp 0x1000681f
cmp esi, 0xc
jne 0x100067f5
push 0x3e8
push 0x3e8
push str.UIList12.txt
jmp 0x1000681f
cmp esi, 0xd
jne 0x1000680b
push 0x3e8
push 0x3e8
push str.UIList13.txt
jmp 0x1000681f
cmp esi, 0xe
jne 0x10006829
push 0x3e8
push 0x3e8
push str.UIList14.txt
push eax
mov ecx, eax
mov edx, 0x4aa153
call edx
mov eax, dword [0x6bdaf0]
push 0x2711
mov ecx, dword [eax + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x48]
mov ecx, dword [0x100248e4]
mov esi, eax
test cl, 1
jne 0x10006868
or ecx, 1
mov dword [0x100248e0], 0x1000fd38
push 0x1000ed50
mov dword [0x100248e4], ecx
call fcn.1000dea4
add esp, 4
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push eax
push 0x40
push 4
add esi, 0x1fc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000689e
lea eax, [ebp - 0x58]
mov dword [esi], 0
push eax
push dword [ebp - 0x58]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
lea eax, [ebp - 0x54]
push 0x1000fda0
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
mov eax, dword [0x6bdaf0]
add esp, 0xc
mov ecx, dword [eax + 0x28]
push 0x578
mov eax, dword [ecx]
call dword [eax + 0x48]
pop esi
test eax, eax
je 0x100068d9
mov edx, dword [eax]
lea ecx, [ebp - 0x54]
push 0
push ecx
mov ecx, eax
call dword [edx + 0x80]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x10007150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edx
push eax
push 0x40
push 4
push 0x49b50a
mov esi, ecx
mov dword [ebp - 8], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10023f70]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x1000c910
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x130]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1000c9ca
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
mov eax, dword [ebp - 0x134]
lea ecx, [ebp - 0x10c]
lea esp, [esp]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000c990
test dl, dl
je 0x1000c98c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000c990
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000c970
xor eax, eax
jmp 0x1000c995
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000c9b0
push dword [ebp - 0x128]
push eax
push 0x1f0fff
call ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x1000c960
cmp esi, 0xffffffff
je 0x1000c9ca
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret

Function at 0x1000c9e0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp dword [ebp + 0x1c], 0x10
jb 0x1000ca07
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
pop ebp
ret
Function at 0x1000cf10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
mov esi, dword [ebp + 8]
jmp 0x1000cf3a
cmp dword [ebp + 0x10], 0
jne 0x1000cfff
movsx eax, word [esi + 4]
add eax, 0x1f4
cmp eax, 0x401
jne 0x1000cfff
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [esp + 0x1f]
xorps xmm0, xmm0
push eax
movzx eax, byte [esp + 0x22]
push eax
movzx eax, byte [esp + 0x25]
push eax
movzx eax, byte [esp + 0x28]
push eax
movzx eax, byte [esp + 0x2b]
push eax
movzx eax, byte [esp + 0x2e]
push eax
lea eax, [esp + 0x38]
movdqa xmmword [esp + 0x38], xmm0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
mov word [esp + 0x50], 0
call dword [sym.imp.MSVCR120.dll_sprintf]
lea ecx, [esp + 0x40]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000cfb1
sub ecx, edx
cmp ecx, 0xc
jge 0x1000cfc7
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esi + 0x42]
xorps xmm0, xmm0
lea eax, [esp + 0x20]
movdqu xmmword [edx], xmm0
mov ecx, eax
mov word [edx + 0x10], 0
sub edx, ecx
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1000cfe0
mov eax, 0x9c4
mov word [esi + 0x54], ax
mov eax, 0x1d4c
mov word [esi + 0x5c], ax
jmp 0x1000d011
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.1000dcd0
mov esp, ebp
pop ebp
ret
Function at 0x4013b0
Capabilities:
Log keystrokes via polling

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x24
call sym.___main
jmp 0x4013c9
nop
mov dword [esp], 0x20
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
setne al
test al, al
je 0x40143d
jmp 0x4013e5
nop
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 6
call sym._mouse_event_20
sub esp, 0x14
mov dword [esp], 0xa
call sym._Sleep_4
sub esp, 4
mov dword [esp], 0x10
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
setne al
test al, al
je 0x4013e4
nop
mov dword [esp], 0x1b
call sym._GetAsyncKeyState_4
sub esp, 4
test ax, ax
setne al
test al, al
je 0x4013c8
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret

Function at 0x401650
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sym._fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]
lea edi, [edi]

Function at 0x4016b0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4017a6
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x401720
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x4016f5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sym._memcpy
cmp byte [esp + 0x1f], 0
je 0x401705
cmp byte [esp + 0x1e], 0
je 0x401705
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
jmp 0x401705
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call sym.___report_error
nop
Function at 0x401a40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x405048
call sym._EnterCriticalSection_4
mov ebx, dword [0x405060]
sub esp, 4
test ebx, ebx
je 0x401a8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401a84
test esi, esi
je 0x401a84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401a60
mov dword [esp], 0x405048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret