joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100fcbb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x268], 0
push esi
push edi
je 0x100fccc3
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x174]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fcc30
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x268]
cmp eax, dword [esp + 0x10]
je 0x100fcc71
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fccb1
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin3
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fccc3
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fcce0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x26c], 0
push esi
push edi
je 0x100fcdf3
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x194]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fcd60
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x26c]
cmp eax, dword [esp + 0x10]
je 0x100fcda1
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fcde1
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin4
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fcdf3
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100fce10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x440
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x43c], eax
cmp dword [ebx + 0x25c], 0
push esi
push edi
je 0x100fcf23
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea edi, [ebx + 0x114]
push eax
lea esi, [esp + 0x10]
mov eax, edi
call fcn.10001140
push edi
test al, al
jne 0x100fce90
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebx + 0x25c]
cmp eax, dword [esp + 0x10]
je 0x100fced1
lea ecx, [esp + 0x414]
push str._s_CRC_error_
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea edx, [esp + 0x418]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fcf11
push edi
lea eax, [esp + 0x414]
push str._s_CRC_error_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
push 0x10
push str.Error_Plugin5
lea ecx, [esp + 0x418]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fcf23
call eax
mov ecx, dword [esp + 0x444]
pop edi
pop esi
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret

Function at 0x100fcf40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
mov eax, dword [0x1014a018]
xor eax, esp
mov dword [esp + 0x40c], eax
cmp dword [edi + 0x270], 0
push ebx
push esi
je 0x100fcff2
lea esi, [esp + 0x10]
call section..text
mov eax, esi
lea ebx, [edi + 0x1b4]
push eax
lea esi, [esp + 0x10]
mov eax, ebx
call fcn.10001140
test al, al
jne 0x100fcfa6
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [edi + 0x270]
cmp ecx, dword [esp + 0xc]
je 0x100fcfce
push 0x10
push str.Error
push str.Camera_CRC_error_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x100fcfe0
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x1013e934
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100fcff2
call eax
mov ecx, dword [esp + 0x414]
pop esi
pop ebx
xor ecx, esp
call fcn.1012db16
mov esp, ebp
pop ebp
ret
Function at 0x100ffe70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, 0x10a72150
call fcn.1010ff10
movzx edi, byte [ebx + 3]
movzx edx, byte [ebx + 4]
mov eax, dword [ebx + 0xc]
xor ecx, ecx
cmp dword [0x10a770b0], ecx
mov dword [0x10a76fb8], eax
sete cl
shl di, 8
mov dword [0x10a770b0], ecx
or edi, edx
and edi, 0x7fff
xor esi, esi
nop
push esi
mov eax, 0x402bc0
call eax
mov edx, 0x96a4c0
mov ecx, eax
call edx
test eax, eax
je 0x100ffef6
movzx ecx, word [eax + 0x7e]
cmp ecx, edi
jne 0x100ffedb
mov edx, 0x2a3
cmp word [eax + 0x84], dx
je 0x100fff01
movzx eax, word [eax + 0x84]
mov ecx, 0x2a4
cmp ax, cx
je 0x100fff01
mov edx, 0x2a5
cmp ax, dx
je 0x100fff01
inc esi
cmp esi, 0x190
jl 0x100ffeb0
jmp 0x100fff27
mov eax, dword [0x7bc4f04]
mov dword [eax + 0x31a], 1
push 0
add eax, 0x308
push 0x12b
push eax
mov eax, 0x542310
call eax
add esp, 0xc
mov esi, dword [ebx + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, dword [0x87935e0]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x87935e0
call edi
lea edx, [ebp - 4]
push edx
mov dword [0x87935e0], esi
mov eax, dword [ebp - 4]
push eax
push 4
push 0x87935e0
call edi
movzx ecx, word [ebx + 6]
mov eax, dword [0x8128ac8]
movzx edx, word [ebx + 8]
shl ecx, 0x10
add ecx, dword [eax + 0x10]
pop edi
or ecx, edx
mov dword [eax + 0x10], ecx
movzx ecx, word [ebx + 8]
movzx eax, word [ebx + 6]
add ecx, dword [0x10a76fd8]
shl eax, 0x10
add ecx, eax
mov dword [0x10a76fd8], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10100a30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x118c8a50]
cmp eax, 0x12c
jbe 0x10100a5e
call esi
xor byte [0x118c8a55], 1
mov dword [0x118c8a50], eax
mov al, byte [edi + 5]
mov byte [0x10a76dc5], al
pop esi
ret
mov cl, byte [edi + 5]
mov byte [0x10a76dc5], cl
pop esi
ret

Function at 0x10100ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x118c8ba0]
cmp eax, 0x3e8
jbe 0x10100b2f
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp dword [esi + 0x18], 0
mov dword [0x10a77114], eax
mov eax, dword [esi + 0x10]
mov dword [0x10a77118], ecx
mov ecx, dword [esi + 0x14]
mov dword [0x10a7711c], edx
setne dl
mov byte [0x118c8bf9], dl
mov edx, dword [esi + 0x24]
mov dword [0x10a77120], eax
mov eax, dword [esi + 0x1c]
mov dword [0x10a77124], ecx
mov ecx, dword [esi + 0x20]
mov dword [0x10a7712c], eax
mov dword [0x10a77130], ecx
mov dword [0x10a77134], edx
call edi
mov dword [0x118c8bf4], eax
pop edi
ret

Function at 0x10102190
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp dword [0xe609e8], 5
jne 0x1010224a
cmp dword [0x10a771b4], 1
jne 0x1010224a
push esi
call fcn.10102250
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x10a771c0]
cmp eax, dword [0x10a771c8]
jbe 0x10102212
cmp byte [0x108c8373], 0
jne 0x10102205
mov dword [0x10a771b4], 2
mov dword [0x10a771b8], 0
call esi
mov dword [0x10a771bc], eax
call esi
mov dword [0x10a771c0], eax
mov dword [0x10a771c4], 0
mov dword [0x10a771c8], 0
mov eax, 0x63a180
mov ecx, 0x8793750
pop esi
jmp eax
call esi
sub eax, dword [0x10a771bc]
cmp eax, dword [0x10a771c4]
jb 0x10102249
mov eax, dword [0x10a771b8]
sub eax, 0
je 0x1010223d
dec eax
jne 0x10102242
call fcn.101024e0
call esi
mov dword [0x10a771bc], eax
pop esi
ret
call fcn.10102470
call esi
mov dword [0x10a771bc], eax
pop esi
ret

Function at 0x101029f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10a771b8], 2
jne 0x10102a74
mov edx, dword [0x10a71fa8]
mov eax, dword [0x10a71fa4]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x10a71fac]
lea edx, [ebp - 0x10]
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.10100800
add esp, 4
cmp byte [0x108c8373], 0
jne 0x10102a74
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10a771b4], 1
mov dword [0x10a771b8], 3
call esi
mov dword [0x10a771bc], eax
call esi
mov dword [0x10a771c0], eax
mov eax, 0x7530
mov dword [0x10a771c4], eax
mov dword [0x10a771c8], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10102a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
xor ebx, ebx
cmp dword [0x10a771b8], 3
jne 0x10102ab3
cmp dword [0x10a771d0], ebx
je 0x10102ab3
lea eax, [ebp - 8]
lea ecx, [ebx + 5]
push eax
mov dword [ebp - 8], 0x51bf05c1
mov byte [ebp - 4], bl
call fcn.10100800
add esp, 4
cmp byte [0x108c8373], bl
jne 0x10102af5
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10a771b4], ebx
mov dword [0x10a771b8], ebx
call esi
mov dword [0x10a771bc], eax
call esi
mov dword [0x10a771c0], eax
mov dword [0x10a771c4], ebx
mov dword [0x10a771c8], ebx
mov dword [0x10a771cc], ebx
mov dword [0x10a771d0], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10102db0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor ebx, ebx
mov edx, eax
cmp byte [0x118cb359], bl
je 0x10102e1f
mov eax, 0x137
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10102e1f
cmp dword [ebp + 8], 0x201
jne 0x10102df2
mov al, 1
pop esi
mov byte [0x118cb5a4], al
pop ebx
pop ebp
ret 4
sub edx, dword [0x118cb5a0]
mov byte [0x118cb5a4], bl
cmp edx, 0x1f4
jb 0x10102e1f
call esi
mov dword [0x118cb5a0], eax
mov byte [0x118cb359], bl
mov dword [0xe8cb3c], ebx
mov byte [0x118cb389], bl
pop esi
xor al, al
pop ebx
pop ebp
ret 4

Function at 0x10102e30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp byte [0x118cb359], 0
mov edx, eax
je 0x10102eac
mov eax, 0x138
mov ecx, 0x118c4e50
call fcn.100bb9d0
test al, al
je 0x10102eac
cmp byte [0x118cb5fa], 0
je 0x10102eac
cmp dword [ebp + 8], 0x201
jne 0x10102e78
mov al, 1
mov byte [0x118cb5f8], al
pop esi
pop ebp
ret 4
sub edx, dword [0x118cb5f4]
mov byte [0x118cb5f8], 0
cmp edx, 0x1f4
jb 0x10102eac
call esi
mov dword [0x118cb5f4], eax
lea eax, [ebp + 8]
mov ecx, 4
push eax
mov dword [ebp + 8], 0x1ff04c1
call fcn.10100800
add esp, 4
xor al, al
pop esi
pop ebp
ret 4

Function at 0x101034f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebx
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x34]
mov edi, eax
mov eax, dword [esi + 0x3c]
push eax
mov eax, dword [esi + 0x30]
push ecx
push edx
push eax
mov ecx, 0x790b10
call ecx
add esp, 0x10
cmp al, 1
jne 0x10103543
cmp dword [ebp + 8], 0x201
jne 0x1010352f
pop edi
mov byte [esi + 0x40], al
pop ebx
pop ebp
ret 4
sub edi, dword [esi + 0x44]
mov byte [esi + 0x40], 0
cmp edi, 0x1f4
jb 0x10103543
call ebx
mov dword [esi + 0x44], eax
pop edi
pop ebx
pop ebp
ret 4
Function at 0x10103d10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x119209ac]
mov edx, dword [0x119209a8]
sub esp, 0x10
push ebx
push esi
push edi
cmp edx, eax
je 0x10103d50
mov ebx, eax
cmp eax, eax
je 0x10103d4a
mov edi, edi
mov esi, eax
mov edi, edx
add eax, 0x118
mov ecx, 0x46
add edx, 0x118
rep movsd dword es:[edi], dword [esi]
cmp eax, ebx
jne 0x10103d30
mov dword [0x119209ac], edx
call fcn.10103ec0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10104070
push 5
sub eax, 0x9540bd
mov bl, 0xe8
xor edi, edi
push 0x9540b8
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10103dad
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x9540b8
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x9540b8
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10103db3
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10104070
push 5
sub ecx, 0x9540f3
push 0x9540ee
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10103e02
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x9540ee
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x9540ee
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10103e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10104070
push 5
sub edx, 0x954126
push 0x954121
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10103e57
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x954121
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x954121
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10103e5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10104070
push 5
sub edx, 0x954159
push 0x954154
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10103eac
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x954154
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x954154
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10103eb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10108240
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x410268
call esi
mov eax, 0x90909090
mov ecx, 0x410268
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 5
push 0x410268
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x14c
push 0x40f120
call esi
push 0x14c
push 0x90
push 0x40f120
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 0x14c
push 0x40f120
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x41001d
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x41001d], 0x450
mov edx, dword [ebp - 4]
push edx
push 4
push 0x41001d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x410154
call esi
mov eax, 0x90909090
mov ecx, 0x410154
mov dword [ecx], eax
mov byte [ecx + 4], al
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 5
push 0x410154
call esi
lea ecx, [ebp - 4]
mov eax, 0x10108210
push ecx
sub eax, 0x410124
mov bl, 0xe8
xor edi, edi
push 0x40
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
push 5
push 0x41011f
call esi
test eax, eax
je 0x10108366
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x41011f
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x41011f
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x1010836c
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10108210
push 5
sub ecx, 0x410159
push 0x410154
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x101083bb
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x410154
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x410154
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x101083c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10108210
push 0x410154
call fcn.10110d60
push 0x10108000
push 0x40fca0
mov bl, 0xe9
call fcn.10110d60
add esp, 0x10
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x41011f
call esi
mov eax, 0x90909090
mov ecx, 0x41011f
mov dword [ecx], eax
mov byte [ecx + 4], al
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 5
push 0x41011f
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010c9b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
fld dword [ebp + 0x14]
sub esp, 0x10
fstp dword [esp + 0xc]
fld dword [ebp + 0x10]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
call fcn.100bb960
test al, al
je 0x1010cabf
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
fld dword [ebp + 0x14]
mov ecx, 0x8000
fld st(0)
fdiv dword [ebp + 0x1c]
push ecx
test cx, ax
je 0x1010ca61
fldz
mov edx, 0x637c60
fst dword [esp]
push 1
fxch st(1)
fst dword [ebp + 0x14]
push 1
fld dword [ebp + 0x14]
sub esp, 0x20
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fadd st(0), st(0)
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call edx
add esp, 0x30
pop ebp
ret 0x18
fstp dword [ebp + 0x14]
mov eax, 0x637c60
fldz
fst dword [esp]
fld dword [ebp + 0x14]
push 1
push 1
sub esp, 0x20
fst dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(1)
fstp dword [esp + 0x14]
fxch st(1)
fstp dword [esp + 0x10]
fxch st(1)
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call eax
add esp, 0x30
pop ebp
ret 0x18
fldz
push ecx
fst dword [esp]
mov ecx, 0x637c60
fld dword [ebp + 0x14]
push 1
fld st(0)
push 1
fdiv dword [ebp + 0x1c]
sub esp, 0x20
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x1c]
fld dword [ebp + 0x10]
fld st(0)
fdiv dword [ebp + 0x18]
fstp dword [ebp + 0x14]
fld dword [ebp + 0x14]
fstp dword [esp + 0x18]
fxch st(2)
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fstp dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp + 0xc]
fstp dword [esp + 4]
fld dword [ebp + 8]
fstp dword [esp]
push 0x7e4b
call ecx
add esp, 0x30
pop ebp
ret 0x18

Function at 0x1010ce60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
mov dword [ebp - 4], 0
call ebx
test eax, eax
jne 0x1010ce8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push esi
push edi
mov dword [ebp - 8], 0
call ebx
test eax, eax
je 0x1010ce82
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010cec0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1010ceee
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov cl, byte [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 1
push esi
mov byte [esi], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1010cee3
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1010cf20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1010cf4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
push eax
push 4
push esi
mov dword [esi], ecx
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1010cf43
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1010cf80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], 0
call edi
test eax, eax
jne 0x1010cfb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov dword [esi], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
mov dword [ebp - 8], 0
call edi
test eax, eax
je 0x1010cfae
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1010cff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
movzx esi, si
push edi
push esi
call fcn.1012baac
push esi
mov edi, eax
push 0x90
push edi
call sub.MSVCR100.dll_memset
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1010d035
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov esp, ebp
pop ebp
ret
push esi
push edi
push ebx
call sub.MSVCR100.dll_memcpy
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push esi
push ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1010d02a
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret