joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015dc7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x10015df1
jl 0x10015de8
test ebx, ebx
jne 0x10015df1
xor eax, eax
xor edx, edx
jmp 0x10015ea9
cmp dword [ecx + 0x38], 0
je 0x10015e04
push esi
push ebx
push edx
call fcn.10017526
jmp 0x10015ea9
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x10015e44
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x10015e44
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.1006d5f0
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x10015e9f
call fcn.10018ee8
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x10015e87
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.1007e62a
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10015e9f
jmp 0x10015e54
test edx, edx
je 0x10015e9f
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.1007e62a
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10035768
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0xc]
mov esi, edx
mov dword [ebp - 0xc], ecx
lea ecx, [eax - 1]
mov ebx, ecx
mov dword [ebp - 0x10], eax
sar ebx, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
cmp edx, ebx
jge 0x100357ca
lea edx, [esi + esi]
lea ecx, [edi + 0x10]
lea ecx, [ecx + edx*8]
lea eax, [ecx - 8]
push eax
push ecx
call fcn.10035746
movzx esi, al
xor esi, 1
inc esi
add esi, edx
lea eax, [edi + esi*8]
push eax
mov eax, dword [ebp - 4]
lea ecx, [edi + eax*8]
call fcn.10015264
mov dword [ebp - 4], esi
cmp esi, ebx
jl 0x10035795
mov eax, dword [ebp - 0x10]
mov edx, esi
cmp esi, ebx
jne 0x100357e4
test al, 1
jne 0x100357e4
dec eax
lea ecx, [edi + esi*8]
lea eax, [edi + eax*8]
push eax
call fcn.10015264
mov edx, dword [ebp - 0x14]
cmp dword [ebp - 8], edx
jge 0x1003580e
push dword [ebp - 0xc]
lea esi, [edx - 1]
sar esi, 1
lea ebx, [edi + esi*8]
push ebx
call fcn.10035746
test al, al
je 0x1003580e
push ebx
lea ecx, [edi + edx*8]
call fcn.10015264
mov edx, esi
cmp dword [ebp - 8], esi
jl 0x100357e9
push dword [ebp - 0xc]
lea ecx, [edi + edx*8]
call fcn.10015264
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003c7cb
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10042100
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1003c82a
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3
Function at 0x1003fc27
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x18], eax
push edi
mov edi, edx
test ebx, ebx
je 0x1003fc65
mov ecx, dword [ebp + 0xc]
mov edx, ebx
add ecx, 0xfffffffe
test ecx, ecx
je 0x1003fc4f
add esi, ecx
mov eax, esi
sub edx, 1
jne 0x1003fc49
test esi, esi
je 0x1003fc65
cmp eax, 0x2aaaaaaa
jg 0x1003fd53
mov eax, dword [edi + 8]
imul eax, dword [edi + 4]
imul ecx, esi, 3
mov dword [ebp - 8], ecx
cmp ecx, eax
je 0x1003fc98
mov eax, dword [edi]
test eax, eax
je 0x1003fc88
push dword [eax - 4]
call fcn.1007dbbc
pop ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jle 0x1003fc95
call fcn.10021319
mov dword [edi], eax
jmp 0x1003fc98
and dword [edi], 0
and dword [ebp - 4], 0
mov dword [edi + 4], esi
mov dword [edi + 8], 3
test ebx, ebx
je 0x1003fd4c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0xc]
add edx, 0xfffffffe
xor eax, eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
xor esi, esi
and dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
test edx, edx
je 0x1003fd3b
add eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
movzx eax, byte [eax]
mov ecx, dword [edi]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
mov eax, dword [edi + 4]
add eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [edi]
movzx ecx, byte [ecx + esi + 1]
mov dword [edx + eax*4], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor ecx, 1
mov edx, dword [edi + 4]
add eax, ebx
mov esi, dword [edi]
add eax, ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [eax + ecx + 1]
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
lea eax, [eax + edx*2]
mov edx, dword [ebp - 0x1c]
mov dword [esi + eax*4], ecx
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
inc eax
inc dword [ebp - 0xc]
cmp eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
jb 0x1003fcd4
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
add eax, ecx
sub ebx, 1
mov dword [ebp - 8], eax
mov dword [ebp + 8], ebx
jne 0x1003fcbf
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
call fcn.10002288
int3
Function at 0x1003ff09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
push edi
mov edi, edx
test ebx, ebx
je 0x1003ff47
mov ecx, dword [ebp + 0xc]
mov edx, ebx
add ecx, 0xfffffffe
test ecx, ecx
je 0x1003ff31
add esi, ecx
mov eax, esi
sub edx, 1
jne 0x1003ff2b
test esi, esi
je 0x1003ff47
cmp eax, 0x2aaaaaaa
jg 0x1004004d
mov eax, dword [edi + 4]
imul eax, dword [edi + 8]
imul ecx, esi, 3
mov dword [ebp - 8], ecx
cmp ecx, eax
je 0x1003ff7a
mov eax, dword [edi]
test eax, eax
je 0x1003ff6a
push dword [eax - 4]
call fcn.1007dbbc
pop ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jle 0x1003ff77
call fcn.10021319
mov dword [edi], eax
jmp 0x1003ff7a
and dword [edi], 0
and dword [ebp - 4], 0
mov dword [edi + 4], esi
mov dword [edi + 8], 3
test ebx, ebx
je 0x10040046
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
lea edx, [eax + eax]
lea esi, [eax - 2]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], edx
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
test esi, esi
je 0x1004002f
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], edx
movzx eax, word [edx]
mov ecx, dword [edi]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov esi, dword [edi]
movzx ecx, word [ecx + eax*2 + 2]
mov eax, edx
add eax, dword [edi + 4]
mov dword [esi + eax*4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor eax, 1
mov edx, dword [edi + 4]
mov esi, dword [edi]
mov dword [ebp - 0xc], eax
add eax, ebx
add eax, dword [ebp - 0x14]
movzx ecx, word [ecx + eax*2 + 2]
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
lea eax, [eax + edx*2]
mov edx, dword [ebp - 0x20]
mov dword [esi + eax*4], ecx
add edx, 2
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
inc eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x1003ffbf
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x28]
add ecx, eax
sub ebx, 1
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp + 8], ebx
jne 0x1003ffaa
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
call fcn.10002288
int3
Function at 0x100401e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
push edi
mov edi, edx
test ebx, ebx
je 0x10040223
mov ecx, dword [ebp + 0xc]
mov edx, ebx
add ecx, 0xfffffffe
test ecx, ecx
je 0x1004020d
add esi, ecx
mov eax, esi
sub edx, 1
jne 0x10040207
test esi, esi
je 0x10040223
cmp eax, 0x2aaaaaaa
jg 0x10040329
mov eax, dword [edi + 8]
imul eax, dword [edi + 4]
imul ecx, esi, 3
mov dword [ebp - 8], ecx
cmp ecx, eax
je 0x10040256
mov eax, dword [edi]
test eax, eax
je 0x10040246
push dword [eax - 4]
call fcn.1007dbbc
pop ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jle 0x10040253
call fcn.10021319
mov dword [edi], eax
jmp 0x10040256
and dword [edi], 0
mov dword [edi + 4], esi
xor esi, esi
mov dword [edi + 8], 3
mov dword [ebp - 4], esi
test ebx, ebx
je 0x10040322
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, eax
mov dword [ebp - 0x20], ecx
shl edx, 2
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x10]
lea esi, [eax - 2]
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], edx
and dword [ebp - 0xc], 0
and dword [ebp - 0x14], 0
test esi, esi
je 0x1004030b
mov eax, edx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax]
mov ecx, dword [edi]
add dword [ebp - 0x1c], 4
mov dword [ecx + edx*4], eax
add edx, dword [edi + 4]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x18]
mov esi, dword [edi]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4 + 4]
mov dword [esi + edx*4], eax
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
xor eax, 1
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov dword [ebp - 0xc], eax
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x14]
lea ecx, [esi + ecx*2]
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + eax*4 + 4]
mov esi, dword [ebp - 0x24]
mov dword [edx + ecx*4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
inc edx
inc eax
mov dword [ebp - 4], edx
inc dword [ebp - 0x18]
cmp eax, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
jb 0x100402a0
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x28]
add ecx, eax
sub ebx, 1
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp + 8], ebx
jne 0x10040289
pop edi
pop esi
mov al, 1
pop ebx
leave
ret
call fcn.10002288
int3
Function at 0x10040dc1
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10044cc8
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x10040e20
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3

Function at 0x10041973
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x100455ed
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x100419d2
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3

Function at 0x100419dd
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10045659
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x10041a3c
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3
Function at 0x10041db7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100ef900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [eax - 1]
mov dword [ebp - 0xc], edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov ecx, dword [ebp + 0xc]
sar ebx, 1
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
jge 0x10041e1e
lea esi, [ecx + ecx]
lea ecx, [edi + 8]
lea ecx, [ecx + esi*4]
lea eax, [ecx - 4]
push eax
push ecx
lea ecx, [ebp + 0x10]
call fcn.100411b8
mov edx, dword [ebp - 0xc]
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + ecx*4]
mov dword [edi + edx*4], eax
cmp ecx, ebx
jl 0x10041dec
mov eax, dword [ebp - 0x18]
mov esi, ecx
cmp ecx, ebx
jne 0x10041e32
test al, 1
jne 0x10041e32
mov eax, dword [edi + eax*4 - 4]
mov esi, dword [ebp - 8]
mov dword [edi + ecx*4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], esi
jge 0x10041e62
push dword [ebp - 0x14]
lea ebx, [esi - 1]
sar ebx, 1
lea ecx, [ebp - 8]
lea eax, [edi + ebx*4]
push eax
call fcn.100411b8
test al, al
je 0x10041e62
mov eax, dword [edi + ebx*4]
mov dword [edi + esi*4], eax
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jl 0x10041e3d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
mov dword [edi + esi*4], eax
pop edi
pop esi
pop ebx
call fcn.1006bae9
leave
ret

Function at 0x1004216c
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x10046601
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x100421cb
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3

Function at 0x10043200
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1009ce03
call fcn.1006c7fa
mov edi, edx
push 0x10
call fcn.1006bbdc
mov ecx, dword [ebp + 0x14]
mov esi, eax
mov dword [ebp - 0x14], esi
mov ecx, dword [ecx]
mov dword [esi], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [esi + 0xc], eax
xor eax, eax
lea ebx, [edi + 4]
push ebx
push eax
push esi
push 0x1004665a
push eax
push eax
mov dword [ebp - 4], eax
call fcn.10075bca
add esp, 0x1c
mov dword [edi], eax
test eax, eax
je 0x1004325f
call fcn.1006c7a9
ret
and dword [ebx], 0
push 6
call fcn.1006a933
int3
Function at 0x10053ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x10053f21
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x10053f21
jne 0x10053f18
cmp eax, edx
jge 0x10053f18
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x10053f49
inc eax
cmp eax, edx
jl 0x10053f06
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x10053ee3
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x10053f5f
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x10053f51
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x10053f53
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x10053f5f
inc eax
xor bl, 1
cmp eax, edi
jb 0x10053f31
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x1005b190
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x10106580], 0
jne 0x1005b1a9
push 0
push 0x10001
call fcn.1005b590
add esp, 8
ret
jmp fcn.1005c010

Function at 0x1005b210
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x10106580], 0
jne 0x1005b229
push 0
push 0x10001
call fcn.1005b590
add esp, 8
ret
jmp 0x1005c730
call dword [sym.imp.USER32.dll_WaitMessage]
jmp fcn.1005c010

Function at 0x1005b890
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x10106580], 0
jne 0x1005b93d
push 0x2220
push 0
push 0x10106580
call fcn.1006db70
movq xmm0, qword [0x100ef5bc]
add esp, 0xc
mov eax, dword [0x100ef5c4]
movq qword [0x10106584], xmm0
mov dword [0x1010658c], eax
call fcn.100602e0
test eax, eax
je 0x1005b943
push 0x1010782c
call fcn.1005bab0
add esp, 4
test eax, eax
je 0x1005b943
push 0x1010781c
call fcn.1005bad0
add esp, 4
test eax, eax
je 0x1005b943
push 0x10107824
call fcn.1005bad0
add esp, 4
test eax, eax
je 0x1005b943
push 0x101087a0
push 0x1010781c
call fcn.1005bb80
add esp, 8
call fcn.100599c0
mov dword [0x10106580], 1
call fcn.1005f320
mov dword [0x10107848], eax
mov dword [0x1010784c], edx
call fcn.1005aff0
mov eax, 1
ret
call fcn.1005b970
xor eax, eax
ret

Function at 0x1005bad0
Capabilities:
Allocate thread local storage

Disassembly:
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [esp + 4]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x1005baf7
push str.Win32:_Failed_to_allocate_TLS_index
push 0x10008
call fcn.10060090
add esp, 8
xor eax, eax
ret
mov dword [ecx], 1
mov eax, 1
ret
Function at 0x1005bbb0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push ebp
push esi
call fcn.1005ca70
add esp, 0xc
test eax, eax
je 0x1005bce1
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x1005bc54
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x1005bbfd
call fcn.10061230
test eax, eax
je 0x1005bce1
push ebx
push edi
push esi
call fcn.10060e30
jmp 0x1005bc37
cmp eax, 0x36002
jne 0x1005bc1b
call fcn.10062460
test eax, eax
je 0x1005bce1
push ebx
push edi
push esi
call fcn.10061fd0
jmp 0x1005bc37
cmp eax, 0x36003
jne 0x1005bc42
call fcn.10062fc0
test eax, eax
je 0x1005bce1
push ebx
push edi
push esi
call fcn.10062da0
add esp, 0xc
test eax, eax
je 0x1005bce1
push edi
push esi
call fcn.10058f20
add esp, 8
test eax, eax
je 0x1005bce1
cmp dword [esi + 0x3c], 0
je 0x1005bcb4
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.1005c830
push esi
call fcn.1005d1e0
add esp, 8
cmp dword [ebp + 0x28], 0
je 0x1005bcd7
push esi
call fcn.10059930
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0x10], 0
je 0x1005bcd7
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0x18], 0
je 0x1005bcd7
push esi
call fcn.1005bda0
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x1005cf20
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0x14
mov eax, dword [0x100ef900]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x1c]
lea eax, [esp + 4]
push edi
push eax
mov dword [0x10108638], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1005cf7e
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [esp + 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x10108628], xmm0
movd xmm0, dword [esp + 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x10108630], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x1005cfa3
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1005cf93
push dword [eax + 4]
jmp 0x1005cfa5
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x1005cfa5
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.10059930
add esp, 4
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 8]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 0x10]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x1005d03a
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 1
push eax
mov dword [esp + 0x14], 0x20001
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1005d03a
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.10060090
add esp, 8
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
xor ecx, esp
call fcn.1006bae9
add esp, 0x14
ret

Function at 0x1005d050
Capabilities:
Register raw input devices

Disassembly:
sub esp, 0xc
push 0xc
push 1
lea eax, [esp + 8]
mov dword [esp + 8], 0x20001
push eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x1005d090
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.10060090
add esp, 8
add esp, 0xc
ret