joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003b70
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov eax, dword [0x100551b8]
xor eax, esp
mov dword [esp + 0x14], eax
cmp dword [0x10055b54], 0xffffffff
push esi
mov esi, dword [ebp + 8]
push edi
jne 0x10003bc1
mov ecx, 1
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov edi, 2
mov word [esp + 0x10], di
call dword [sym.imp.WS2_32.dll_htons]
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x10003c0b
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10003c0b
movsx ecx, word [eax + 0xa]
mov eax, dword [eax + 0xc]
push ecx
push dword [eax]
lea eax, [esp + 0x18]
push eax
call fcn.10027f00
add esp, 0xc
push 0x10
lea eax, [esp + 0x10]
push eax
push dword [0x10055b54]
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0xffffffff
jne 0x10003c6b
call esi
cmp eax, 0x2733
je 0x10003c6b
call esi
push eax
mov ecx, edi
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0x10
mov ecx, 0x10055b50
call fcn.10003d60
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
push 0x23
push dword [0x10055b58]
push dword [0x10055b54]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
jne 0x10003cf2
call esi
push eax
mov ecx, 3
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
mov eax, dword [0x10055b54]
add esp, 0x10
cmp eax, 0xffffffff
je 0x10003cbc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x10055b54], 0xffffffff
mov eax, dword [0x10055b58]
test eax, eax
je 0x10003cd6
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [0x10055b58], 0
mov byte [0x10155b88], 0
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
push 0x80000
push 0
push 0x10055b5c
call fcn.10028480
add esp, 0xc
mov dword [0x100d5b5c], 0
push 0x80000
push 0
push 0x100d5b60
call fcn.10028480
add esp, 0xc
mov dword [0x10155b60], 0
push 0
push ecx
push 0x10055b50
push 0x100042e0
call fcn.1001f1b0
mov ecx, dword [esp + 0x1c]
mov al, 1
pop edi
pop esi
xor ecx, esp
mov byte [0x10155b88], 1
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
Function at 0x10003da0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], 0
push 0
mov eax, 0x80000
mov edx, dword [edi + 0x8000c]
sub eax, edx
push eax
lea eax, [edi + 0xc]
add eax, edx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x10003e8d
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x2733
je 0x10003f8b
call esi
push eax
mov ecx, 4
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
mov eax, dword [edi + 4]
add esp, 0x10
cmp eax, 0xffffffff
je 0x10003e20
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 4], 0xffffffff
mov eax, dword [edi + 8]
test eax, eax
je 0x10003e35
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [edi + 8], 0
mov byte [edi + 0x100038], 0
cmp dword [0x10055b54], 0xffffffff
je 0x10003e52
cmp byte [0x10155b88], 0
jne 0x10003fee
push ecx
call fcn.10003ae0
test al, al
je 0x10003fee
movzx eax, word [0x1015ad6c]
mov ecx, 0x10055b50
push eax
push 0x1015ad4c
call fcn.10003b70
test al, al
je 0x10003fee
call fcn.10004e80
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [edi + 0x8000c], eax
cmp dword [edi + 0x8000c], 4
jl 0x10003f8b
xor ecx, ecx
lea esi, [edi + 0xc]
lea eax, [esi + ecx]
mov dword [ebp - 0xc], eax
mov al, byte [eax]
cmp al, 0xc1
jne 0x10003ebe
movzx ebx, byte [ecx + edi + 0xd]
mov dl, al
mov al, byte [ecx + edi + 0xf]
jmp 0x10003edf
cmp al, 0xc2
jne 0x10003fc7
mov dl, al
movzx eax, byte [ecx + edi + 0xd]
shl ax, 8
movzx ebx, ax
movzx eax, byte [ecx + edi + 0xe]
or ebx, eax
mov al, byte [ecx + edi + 0x10]
cmp ebx, 4
jl 0x10003f94
cmp ebx, 0x80000
jg 0x10003f94
cmp ebx, dword [edi + 0x8000c]
jg 0x10003f62
lea esi, [ecx + edi]
cmp dl, 0xc1
jne 0x10003f1a
movzx eax, byte [ecx + edi + 0xe]
lea edx, [ebx - 3]
push eax
lea ecx, [esi + 0xf]
call fcn.1001d340
mov al, byte [esi + 0xf]
jmp 0x10003f2e
movzx eax, byte [ecx + edi + 0xf]
lea edx, [ebx - 4]
push eax
lea ecx, [esi + 0x10]
call fcn.1001d340
mov al, byte [esi + 0x10]
add esp, 4
mov byte [ebp - 4], al
mov eax, dword [edi + 0x100014]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call eax
mov ecx, dword [ebp - 8]
add esp, 0xc
sub dword [edi + 0x8000c], ebx
add ecx, ebx
cmp dword [edi + 0x8000c], 0
mov dword [ebp - 8], ecx
jle 0x10003f8b
jmp 0x10003ea2
test ecx, ecx
jle 0x10003f8b
mov eax, dword [edi + 0x8000c]
test eax, eax
jle 0x10003f8b
mov edx, 0x80000
sub edx, ecx
cmp eax, edx
jg 0x10003f8b
push eax
lea eax, [edi + 0xc]
add eax, ecx
push eax
push esi
call fcn.10026e50
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, al
mov ecx, 6
push eax
movzx eax, dl
push ebx
push eax
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0x18
mov ecx, edi
call fcn.10003d60
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [ecx + edi + 0xc]
mov ecx, 5
push eax
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0x10
mov ecx, edi
call fcn.10003d60
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004000
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x8000c
call fcn.100260a0
mov eax, dword [0x100551b8]
xor eax, esp
mov dword [esp + 0x80008], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x10155b6c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x10055b54]
cmp ebx, 0xffffffff
je 0x100040d5
cmp byte [0x10155b88], 0
je 0x100040d5
push 0x80000
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10028480
mov esi, dword [ebp + 0xc]
lea eax, [esp + 0x1c]
add esp, 0xc
push esi
push edi
push eax
call fcn.10027f00
add esp, 0xc
cmp byte [esp + 0x10], 0xc1
jne 0x10004085
push dword [esp + 0x12]
lea edx, [esi - 3]
lea ecx, [esp + 0x17]
jmp 0x10004090
push dword [esp + 0x13]
lea edx, [esi - 4]
lea ecx, [esp + 0x18]
call fcn.1001d3e0
mov eax, dword [0x10155b60]
add esp, 4
test eax, eax
jle 0x10004138
lea ecx, [eax + esi]
cmp ecx, 0x80000
jle 0x100040f9
push ecx
mov ecx, 7
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0x10
mov ecx, 0x10055b50
call fcn.10003d60
push 0x10155b6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
push esi
lea ecx, [esp + 0x14]
push ecx
lea eax, [eax + 0x100d5b60]
push eax
call fcn.10027f00
add esp, 0xc
add dword [0x10155b60], esi
push 0x10155b6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80008]
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
xor edi, edi
test esi, esi
jle 0x10004114
nop
push 0
push esi
lea eax, [esp + 0x18]
add eax, edi
push eax
push ebx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x10004166
sub esi, eax
add edi, eax
test esi, esi
jle 0x10004114
mov ebx, dword [0x10055b54]
jmp 0x10004140
mov ebx, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call ebx
cmp eax, 0x2733
jne 0x100041d1
mov ecx, dword [0x10155b60]
lea eax, [ecx + esi]
cmp eax, 0x80000
jle 0x10004190
push eax
mov ecx, 8
jmp 0x100040b6
lea eax, [esp + 0x10]
add eax, edi
push esi
push eax
lea eax, [ecx + 0x100d5b60]
push eax
call fcn.10027f00
add dword [0x10155b60], esi
add esp, 0xc
push 0x10155b6c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x80014]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10024f58
mov esp, ebp
pop ebp
ret 8
call ebx
push eax
mov ecx, 9
jmp 0x100040b6
Function at 0x100041e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x10001c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
cmp dword [esi + 0x100010], edi
jle 0x10004232
lea eax, [esi + 0x80010]
push 0
push dword [esi + 0x100010]
add eax, edi
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1000423f
sub dword [esi + 0x100010], eax
add edi, eax
cmp dword [esi + 0x100010], 0
lea eax, [esi + 0x80010]
jg 0x10004202
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x10004277
push dword [esi + 0x100010]
lea eax, [esi + 0x80010]
add eax, edi
push eax
lea eax, [esi + 0x80010]
push eax
call fcn.10026e50
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
pop edi
pop esi
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov ecx, 0xa
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
mov eax, dword [esi + 4]
add esp, 0x10
cmp eax, 0xffffffff
je 0x100042ae
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 4], 0xffffffff
mov eax, dword [esi + 8]
test eax, eax
je 0x100042c3
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
mov dword [esi + 8], 0
push ebx
mov byte [esi + 0x100038], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x10004ff0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x100551b8]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x10161638], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
mov ebx, ecx
jne 0x10005249
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10161638], eax
mov word [ebp - 0x33c], 0x85c1
call fcn.1002b135
and eax, 0x800000ff
jns 0x10005041
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x10055b54], 0xffffffff
mov byte [ebp - 0x33a], al
mov byte [ebp - 0x339], 3
mov byte [ebp - 0x338], bl
je 0x1000523e
cmp byte [0x10155b88], 0
je 0x1000523e
mov word [ebp - 0x2b4], 0x9bc1
call fcn.1002b135
and eax, 0x800000ff
jns 0x1000508a
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [0x10161634]
mov byte [ebp - 0x2b2], al
mov byte [ebp - 0x2b1], 3
mov byte [ebp - 0x2b0], bl
test ecx, ecx
jne 0x100050c1
xorps xmm0, xmm0
mov word [ebp - 0x2a7], cx
movq qword [ebp - 0x2af], xmm0
mov byte [ebp - 0x2a5], cl
jmp 0x100050e1
movq xmm0, qword [ecx]
movq qword [ebp - 0x2af], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x2a7], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x2a5], al
mov ecx, dword [0x10161630]
test ecx, ecx
je 0x10005113
mov ecx, dword [ecx]
test ecx, ecx
je 0x10005113
movq xmm0, qword [ecx]
movq qword [ebp - 0x2a4], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x29c], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x29a], al
jmp 0x1000512e
xorps xmm0, xmm0
mov word [ebp - 0x29c], 0
movq qword [ebp - 0x2a4], xmm0
mov byte [ebp - 0x29a], 0
test esi, esi
jne 0x10005146
push 0x40
lea eax, [ebp - 0x299]
push esi
push eax
call fcn.10028480
add esp, 0xc
jmp 0x10005171
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x299], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x289], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x279], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ebp - 0x269], xmm0
push 0x40
lea eax, [ebp - 0x259]
push 0
push eax
call fcn.10028480
add esp, 0xc
test edi, edi
je 0x100051db
push edi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x100051db
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x100051d4
lea ecx, [ebp - 0x214]
call fcn.1001d2e0
push eax
lea eax, [ebp - 0x259]
push 0x1004dee4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x259]
mov ecx, 0x20
push eax
lea eax, [ebp - 0x299]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2af]
push eax
movzx eax, byte [ebp - 0x2b0]
push eax
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
movzx eax, byte [ebp - 0x2b3]
add esp, 0x20
push eax
lea eax, [ebp - 0x2b4]
push eax
call fcn.10004000
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10024f58
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x33c]
call fcn.10004d90
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10024f58
mov esp, ebp
pop ebp
ret
Function at 0x10005f20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10005fe3
push ebx
mov bl, byte [0x101615e2]
mov bh, byte [0x101615e1]
cmp edx, 0x20
jb 0x10005fc3
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005f53
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm3, xmmword [0x10050230]
mov edi, edx
sub edi, ecx
movaps xmm2, xmm3
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
paddb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm4, xmm0, 0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm2
psubb xmm0, xmm4
paddb xmm0, xmm3
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10005f90
pop edi
cmp eax, edx
jge 0x10005fe2
add bl, 0xf
nop word [eax + eax]
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
add cl, 0xf
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10005fd0
pop ebx
pop esi
ret

Function at 0x10005ff0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x100060a6
push ebx
mov bh, byte [0x101615e1]
mov bl, byte [0x101615e2]
cmp edx, 0x20
jb 0x1000608c
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10006023
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x10050230]
mov edi, edx
sub edi, ecx
movsx ecx, bh
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bl
pshufd xmm2, xmm0, 0
psubb xmm2, xmm1
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
paddb xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm2
pxor xmm0, xmm1
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10006061
pop edi
cmp eax, edx
jge 0x100060a5
add bl, 0xf
mov cl, byte [eax + esi]
sub cl, 0xf
add cl, bh
xor cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10006093
pop ebx
pop esi
ret
Function at 0x10006130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x1016168c]
test ecx, ecx
je 0x10006198
mov eax, dword [ecx]
mov edx, 0x101616a0
cmp eax, dword [edx]
jne 0x10006154
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x10006198
mov ecx, 0xf
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov ecx, dword [0x10161688]
test ecx, ecx
je 0x100061fa
mov eax, dword [ecx]
mov edx, 0x10161698
cmp eax, dword [edx]
jne 0x100061b6
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x100061fa
mov ecx, 0x10
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov ecx, dword [0x10161684]
test ecx, ecx
je 0x10006258
mov eax, dword [ecx]
mov edx, 0x10161690
cmp eax, dword [edx]
jne 0x10006218
movzx eax, byte [ecx + 4]
cmp al, byte [edx + 4]
je 0x10006258
mov ecx, 0x11
call fcn.1001efe0
push eax
push 0
push 0x10155d18
call fcn.10014380
add esp, 0xc
xorps xmm0, xmm0
movups xmmword [0x10161ac0], xmm0
movups xmmword [0x10161ad0], xmm0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp dword [pe_dos_header]
mov esp, ebp
pop ebp
ret
Function at 0x100066e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5b55ea
call esi
mov eax, 0x10006680
mov byte [0x5b55ea], 0xe9
sub eax, 0x5b55ef
mov dword [0x5b55eb], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x5b55ea
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5a3c70
call esi
mov eax, 0x100066c0
mov byte [0x5a3c70], 0xe9
sub eax, 0x5a3c75
mov dword [0x5a3c71], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push 0x5a3c70
call esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100070f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push dword [0x10161780]
mov esi, 0x41fe10
movss dword [ebp - 4], xmm1
mov ebx, edx
movss dword [ebp - 8], xmm0
mov edi, ecx
call esi
mov edx, 0x420120
mov ecx, eax
call edx
push 0xff
push 0xff
push 0xff
push 0xff
call esi
mov edx, 0x420040
mov ecx, eax
call edx
push 0
push 0
push 0
push 0
call esi
mov edx, 0x4200b0
mov ecx, eax
call edx
cmp byte [edi], 0
je 0x10007159
xorps xmm0, xmm0
jmp 0x10007161
movsd xmm0, qword [0x100501f8]
cvtpd2ps xmm0, xmm0
sub esp, 0x18
mov eax, 0x790e40
movss dword [esp + 0x14], xmm0
movss xmm0, dword [ebp - 4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x41700000
mov dword [esp + 8], 0x41700000
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push 0x7b69
call eax
add esp, 0x1c
push 0xff
push 0
push 0
push 0
call esi
mov ecx, eax
mov eax, 0x420040
call eax
movss xmm0, dword [ebp - 4]
addss xmm0, dword [0x10050200]
push 0
push 1
push 0
push 0xe6
movss dword [ebp - 0x10], xmm0
addss xmm0, dword [0x100501e0]
push ebx
cvttss2si esi, xmm0
movss xmm0, dword [ebp - 8]
addss xmm0, dword [0x10050204]
push esi
movss dword [ebp - 0xc], xmm0
addss xmm0, dword [0x100501e0]
cvttss2si eax, xmm0
push eax
mov eax, 0x41fe10
call eax
mov edx, 0x420150
mov ecx, eax
call edx
push 0xff
push 0
push 0
push 0
mov eax, 0x41fe10
call eax
mov ecx, eax
mov eax, 0x420040
call eax
movss xmm0, dword [ebp - 0xc]
addss xmm0, dword [0x100501f0]
push 0
push 1
push 0
push 0xe6
cvttss2si eax, xmm0
push ebx
push esi
push eax
mov eax, 0x41fe10
call eax
mov ecx, eax
mov esi, 0x420150
call esi
push 0xff
push 0xff
push 0xff
push 0xff
mov eax, 0x41fe10
call eax
mov ecx, eax
mov eax, 0x420040
call eax
push 0
push 1
push 0
push 0xe6
movss xmm0, dword [ebp - 0x10]
xorps xmm1, xmm1
addss xmm0, xmm1
push ebx
mov ebx, 0x41fe10
cvttss2si eax, xmm0
movss xmm0, dword [ebp - 0xc]
addss xmm0, xmm1
push eax
cvttss2si eax, xmm0
push eax
call ebx
mov ecx, eax
call esi
cvttss2si eax, dword [ebp - 4]
push 0xf
push 0xf
push eax
cvttss2si eax, dword [ebp - 8]
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
cmp al, 1
jne 0x10007323
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x10007323
push dword [0x10155cb8]
mov byte [0x10161758], 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000731c
cmp byte [0x10155cbc], 0
jne 0x10007323
mov byte [0x10155cbc], 1
cmp byte [edi], 0
sete al
mov byte [edi], al
jmp 0x10007323
mov byte [0x10155cbc], 0
push dword [0xe8c58c]
call ebx
mov ecx, eax
mov eax, 0x420120
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100551b8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1f27624b
lea ecx, [ebp - 0x18]
call fcn.10010570
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0xc]
mov word [ebp - 0x10], 0
push ecx
xorps xmm0, xmm0
mov byte [ebp - 0xe], 0
push eax
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0xc], 0x74696e49
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
call eax
push 0
push ecx
push 0
push 0x1000ad20
call fcn.1001f1b0
push 0x400000
push 0
push 0x10161b00
call fcn.10028480
add esp, 0xc
push 0
push 0x400000
push 0x10161b00
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movaps xmm1, xmmword [0x10050240]
xor eax, eax
movaps xmm2, xmmword [0x10050260]
nop word [eax + eax]
movups xmm0, xmmword [eax + 0x10161b00]
psubb xmm0, xmm1
movups xmmword [eax + 0x10161b00], xmm0
movups xmm0, xmmword [eax + 0x10161b00]
pxor xmm0, xmm2
movups xmmword [eax + 0x10161b00], xmm0
movups xmm0, xmmword [eax + 0x10161b10]
psubb xmm0, xmm1
movups xmmword [eax + 0x10161b10], xmm0
movups xmm0, xmmword [eax + 0x10161b10]
pxor xmm0, xmm2
movups xmmword [eax + 0x10161b10], xmm0
add eax, 0x20
cmp eax, 0x400000
jb 0x1000c1f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10024f58
mov esp, ebp
pop ebp
ret
Function at 0x10010690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xf0
xor eax, eax
mov dl, byte [edi + eax + 0x79ddc0fb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1e
jb 0x100106a1
pop edi
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100106d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x100106e1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10012010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10040356
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100551b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.100252c8
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10021467
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret