joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411500
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
movzx ecx, al
shr eax, 8
movzx eax, al
push esi
mov dword [ebp - 0x8c], ecx
mov esi, edx
xor ecx, ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x88], eax
mov word [ebx], cx
push edi
test al, 2
je 0x411584
cmp esi, 0x7ffffffe
ja 0x411584
lea ecx, [esi + 1]
mov eax, ebx
mov edi, ecx
test ecx, ecx
je 0x411565
cmp word [eax], 0
je 0x411565
add eax, 2
sub ecx, 1
jne 0x411557
mov eax, edi
sub eax, ecx
neg edi
push 0x42ec50
sbb edi, edi
and edi, eax
sub edx, edi
lea ecx, [ebx + edi*2]
call fcn.004097e0
mov eax, dword [ebp - 0x88]
test al, 4
je 0x4115cf
cmp esi, 0x7ffffffe
ja 0x4115cf
lea ecx, [esi + 1]
mov eax, ebx
mov edi, ecx
test ecx, ecx
je 0x4115ae
jmp 0x4115a0
cmp word [eax], 0
je 0x4115ae
add eax, 2
sub ecx, 1
jne 0x4115a0
mov eax, edi
mov edx, esi
sub eax, ecx
neg edi
push str.Alt
sbb edi, edi
and edi, eax
sub edx, edi
lea ecx, [ebx + edi*2]
call fcn.004097e0
mov eax, dword [ebp - 0x88]
test al, 1
je 0x41160f
cmp esi, 0x7ffffffe
ja 0x41160f
lea ecx, [esi + 1]
mov eax, ebx
mov edi, ecx
test ecx, ecx
je 0x4115f4
cmp word [eax], 0
je 0x4115f4
add eax, 2
sub ecx, 1
jne 0x4115e6
mov eax, edi
mov edx, esi
sub eax, ecx
neg edi
push 0x42ec68
sbb edi, edi
and edi, eax
sub edx, edi
lea ecx, [ebx + edi*2]
call fcn.004097e0
mov eax, dword [ebp - 0x8c]
cmp eax, 0x2c
jne 0x411655
lea edx, [eax + 0x14]
mov edi, str.Prnt_scrn
lea eax, [ebp - 0x84]
mov ecx, eax
sub edi, ecx
lea esp, [esp]
movzx ecx, word [edi + eax]
mov ebx, eax
test cx, cx
je 0x411648
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x411630
mov eax, ebx
mov ebx, dword [ebp - 0x90]
xor ecx, ecx
mov word [eax], cx
jmp 0x411671
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 0x40
lea ecx, [ebp - 0x84]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp esi, 0x7ffffffe
ja 0x4116af
lea ecx, [esi + 1]
mov eax, ebx
mov edx, ecx
test ecx, ecx
je 0x411692
cmp word [eax], 0
je 0x411692
add eax, 2
sub ecx, 1
jne 0x411684
mov eax, edx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
lea eax, [ebp - 0x84]
sub esi, edx
push eax
lea ecx, [ebx + edx*2]
mov edx, esi
call fcn.004097e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414c55
mov esp, ebp
pop ebp
ret 4

Function at 0x4154b9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4154f8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4154f8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4154f8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4154f8
cmp dword [ecx + 0x74], 0xe
jbe 0x4154f8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x41d1b4
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x41d1ff
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0041d3d1
test al, al
jne 0x41d1f9
sub edx, 2
cmp edx, edi
jne 0x41d1df
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x41d221
lea eax, [edi + 2]
cmp edx, eax
je 0x41d221
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0041d100
add esp, 0x10
jmp 0x41d31b
push esi
lea ecx, [ebp - 0x255]
call fcn.0041d3d1
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41d264
push dword [ebp - 0x25c]
jmp 0x41d211
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x41d2a1
cmp word [ebp - 0x226], 0
je 0x41d2c2
cmp word [ebp - 0x226], ax
jne 0x41d2a1
cmp word [ebp - 0x224], 0
je 0x41d2c2
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0041d100
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x41d30e
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x41d27b
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x41d2f6
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x41d31b
push 0x41cf30
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00421a30
add esp, 0x10
jmp 0x41d2eb
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414c55
leave
ret

Function at 0x41ec43
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42971c
push 0x429714
push str.FlsAlloc
push 0x1f
call fcn.0041eb7e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ec77
push dword [ebp + 8]
mov ecx, esi
call dword [0x427534]
call esi
jmp 0x41ec7d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41ecc1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42972c
push 0x429724
push str.FlsGetValue
push 0x21
call fcn.0041eb7e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ecf8
push dword [ebp + 8]
mov ecx, esi
call dword [0x427534]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x41ed00
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429734
push 0x42972c
push str.FlsSetValue
push 0x22
call fcn.0041eb7e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ed3a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x427534]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4258d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4258fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4258fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4013f5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x404590], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
call fcn.004013ed
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401306
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Jungo
mov dword [ebp - 0x20], eax
call fcn.004013ea
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x4014d5
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.180000
push str.Jungo
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x404588], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x404588]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x4014d5
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x4014ba
mov esp, ebp
pop ebp
ret

Function at 0x401f98
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401fc1
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401fb9
cmp al, 0x22
jne 0x401fad
cmp byte [esi], 0x22
jne 0x401fcb
inc esi
jmp 0x401fcb
cmp al, 0x20
jle 0x401fcb
inc esi
cmp byte [esi], 0x20
jg 0x401fc5
mov al, byte [esi]
test al, al
je 0x401fd5
cmp al, 0x20
jle 0x401fbe
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00402045
push 0x404004
push section..data
call fcn.0040202b
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x402005
movzx eax, word [ebp - 0x14]
jmp 0x402008
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.0040205d
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..3ean
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x787871e9
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..7LWLf
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x672e1d36
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1dc83b0a
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xe292a01
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x43e8a4
Capabilities:
Encode data using xor

Disassembly:
mov cl, 5
mov dl, 0xfd
sub al, 0xd8
enter 0xffffffffffffe518, 0x64
inc edx
dec dword [eax]
pop eax
in eax, dx
jae 0x43e8cf
cmp ah, byte [esi - 0xa]
and dl, dh
sbb dword [0x27163cfe], 0xea909b22
mov eax, 0x8268aa7
jmp 0x43e8db
jecxz 0x43e90f
dec esp
adc bl, cl
push ebp
insb byte es:[edi], dx
mov dh, 0x6f
imul edx, ebp, 0x956715b5
rol byte [esi], cl
adc eax, 0x6d29567
mov ah, 0xd2
sal byte [eax - 0x73496218], 1
idiv byte [ebp + 0x261598f3]
add eax, 0x6122e9ad
in eax, 0x7d
invalid
in al, 0x34
retf 0x5895

Function at 0x4e73b3
Capabilities:
Encode data using xor

Disassembly:
pop esi
add dword [edi], eax
test byte [ebx - 0x34], dl
inc ebx
aad 0x1c
and dword [ebx], eax
mov ebx, 0x9408a969
rcl dword [eax - 0x20]
adc dh, byte [esi + 0x39c896c3]
rol byte [ecx + 0x1c], 0x9c
sbb ch, byte [edi]
arpl word [edx], dx
add eax, dword [edx + 0x5e58f7e]
cwde
daa
jbe 0x4e73f9
stosd dword es:[edi], eax
test eax, 0x161a1ac
dec edx
movsb byte es:[edi], byte [esi]
fsub st(7), st(0)
adc cl, cl
jmp 0x754ec610
cmp ch, ah
popal
imul ebp, dword [esi + ebx*2 + 0x30014cfa], 0x12
dec esp
add dword [eax], esi
adc cl, byte [eax]
dec esp
add dword [eax], esi
adc cl, byte [eax]
ja 0x4e73ac
out dx, eax
leave
or byte [esi - 0x64], 0x1e
jl 0x4e7356
pushfd
cdq
sbb cl, byte [edi + 0x7351e1ce]
hlt
adc dh, al
ljmp 0x8fab
mov byte [0x54964e7c], al
in eax, 0x7e
xor dword [edx + 0x6cc5daca], ebp
clc
scasd eax, dword es:[edi]
in eax, 0xf7
xchg ebp, eax
inc ebp
sar byte [edx - 0x68], 0xce
or eax, 0xffffffa1
div byte [ecx + 0x11]
jno 0x4e7427
jge 0x4e73eb
mov esi, dword cs:[eax + 0x6f]
dec edi
das
popal
cmp edx, dword [eax]
mov esi, 0x1800bd81
sal dword [ecx + ebp + 0x90de20c], cl
wait
sahf
mov eax, dword [0x21213e16]
mov ah, 0x29
or al, 0xe2
or eax, 0xa19e9b09
push ss
and dword ds:[ecx], esp
or dword [eax - 0x5a511dcc], 0x52aa5058
xor dword [esi - 0xa], ebx
lds ebp, [ebx - 0x69ec9ff6]
stc
push eax
inc esi
and al, 0xba
inc esp
les edi, [esi - 0x65]
lahf
and ah, dl
dec esi
add dword [esi - 0x1b], eax
or al, 0x6f
xchg esi, eax
lcall 0xc10e, 0xf5886c42
jne 0x4e7414
inc eax
test eax, 0x1ef81990
mov edx, 0xcec9a8d1
cmp dh, al
and eax, 0xb7fef63e
pop edx
pop edi
std
out dx, al
cmp eax, 0xa2f0beb1
insb byte es:[edi], dx
lodsd eax, dword [esi]
add eax, 0x961888bf
invalid
Function at 0x6500ee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6572c0
cmp edx, dword [eax]
je 0x650110
add eax, 8
inc ecx
cmp eax, 0x657350
jl 0x650101
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6572c0]
jne 0x65023e
mov eax, dword [0xa5a93c]
cmp eax, 1
je 0x650218
test eax, eax
jne 0x650141
cmp dword [0x657204], 1
je 0x650218
cmp edx, 0xfc
je 0x65023e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x650178
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650800
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650a30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6501bb
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650a30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6549c0
push edi
call fcn.00652200
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650800
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650810
lea eax, [ebp - 0xa0]
push 0x6549a0
push eax
call fcn.00650810
push dword [esi + 0x6572c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650810
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00652174
add esp, 0x2c
pop edi
jmp 0x65023e
lea eax, [ebp + 8]
lea esi, [esi + 0x6572c4]
push 0
push eax
push dword [esi]
call fcn.00650a30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100012f1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x220
mov eax, 0x1000efb8
call fcn.1000eecd
mov edi, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], esi
mov dword [edi], ebx
cmp dword [ebp + 0xc], ebx
je 0x1000131f
mov eax, 0x80040110
jmp 0x100014e8
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x218]
call fcn.100064f0
test eax, eax
je 0x1000134d
mov eax, 0x80040112
jmp 0x100014e8
mov edx, dword [ebp + 8]
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010874
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x10001499
inc ecx
cmp ecx, 4
jne 0x10001352
call fcn.100064f0
test eax, eax
je 0x100014e3
push 4
mov ecx, ebx
pop edx
mov eax, dword [esi + ecx*4]
mov esi, 0x10010884
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100013f1
inc ecx
cmp ecx, edx
jne 0x10001382
mov ecx, dword [0x1001640c]
test ecx, ecx
jne 0x100013e5
push 0x10
pop ecx
call fcn.10001222
mov ecx, eax
mov dword [ebp - 0x220], ecx
test ecx, ecx
je 0x100013cf
inc dword [0x10016410]
mov dword [ecx], vtable.CShellExtension.0
mov byte [ecx + 4], bl
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
jmp 0x100013d1
mov ecx, ebx
mov dword [0x1001640c], ecx
test ecx, ecx
jne 0x100013e5
mov eax, 0x8007000e
jmp 0x100014e8
mov eax, dword [ecx]
push edi
push esi
push ecx
call dword [eax]
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [esi + ecx*4]
mov esi, 0x1001034c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, edx
jne 0x100013f3
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
mov dword [ebp - 0x228], ebx
push eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], edx
push eax
lea eax, [ebp - 0x228]
mov esi, ebx
push eax
push str.ShowCacheFolder
push str.SoftwareMicrosoftOffice16.0MS_Project
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x1000145a
cmp dword [ebp - 0x22c], eax
sete al
mov dword [ebp - 0x220], eax
mov esi, eax
push 0x58
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
test eax, eax
je 0x10001479
lea ecx, [esi + 1]
push ecx
mov ecx, eax
call fcn.100064f0
mov ebx, eax
test ebx, ebx
je 0x100013db
push edi
push dword [ebp - 0x21c]
mov eax, dword [ebx]
push ebx
call dword [eax]
mov ecx, dword [ebx]
mov esi, eax
push ebx
call dword [ecx + 8]
mov eax, esi
jmp 0x100014e8
mov ecx, ebx
mov eax, dword [edx + ecx*4 + 8]
mov esi, 0x10010b2c
cmp eax, dword [esi + ecx*4]
mov esi, dword [ebp - 0x21c]
jne 0x100014e3
inc ecx
cmp ecx, 4
jne 0x1000149b
push 0x4c
pop ecx
call fcn.10001222
mov dword [ebp - 0x220], eax
mov dword [ebp - 4], ebx
test eax, eax
je 0x100014d3
mov ecx, eax
call fcn.10007cce
mov ebx, eax
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x100013db
push edi
push esi
jmp 0x10001488
mov eax, 0x80004002
call fcn.1000ee8c
ret 0x10
Function at 0x10004d5d
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x10
mov esi, ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
mov eax, dword [esi + 0x68]
je 0x10004e1b
test eax, eax
je 0x10004e0f
cmp eax, 1
je 0x10004e0f
cmp eax, 2
je 0x10004df1
cmp eax, 3
je 0x10004df1
push 4
pop ecx
cmp eax, ecx
je 0x10004e63
cmp dword [esi + 0x6c], 0
je 0x10004de8
cmp dword [esi + 0x6c], 1
je 0x10004de8
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x98]
test eax, eax
jne 0x10004de2
push eax
push eax
push 0xf0
push dword [esi + 0x90]
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, 2
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov eax, dword [esi + eax*4 + 0x88]
push eax
jmp 0x10004e8f
or dword [esi + 0x6c], 0xffffffff
xor eax, eax
inc eax
pop esi
ret
push 0
push 0
push 0xf0
push dword [esi + 0x88]
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
sbb eax, eax
neg eax
jmp 0x10004e82
or dword [esi + 0x68], 0xffffffff
push dword [esi + 0x28]
mov dword [esi + 0x6c], eax
jmp 0x10004e8f
test eax, eax
je 0x10004e63
cmp eax, 1
je 0x10004e63
cmp eax, 2
je 0x10004e3a
cmp eax, 3
je 0x10004e3a
push 4
pop ecx
cmp eax, ecx
jne 0x10004df1
mov dword [esi + 0x6c], ecx
jmp 0x10004e4e
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], 4
mov eax, dword [esi + 0x98]
test eax, eax
jne 0x10004e54
or dword [esi + 0x68], 0xffffffff
jmp 0x10004dec
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x68]
mov dword [esi + 0x6c], eax
jmp 0x10004e95
push 0
push 0
push 0xf0
push dword [esi + 0x90]
call dword [sym.imp.USER32.dll_SendMessageW]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, 2
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
push dword [esi + eax*4 + 0x88]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
pop esi
ret
Function at 0x10009a7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x100150e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0xdc], eax
or edi, 0xffffffff
mov eax, dword [ecx + 0x20]
xor ebx, ebx
mov dword [ebp - 0xd4], 0x64
test eax, eax
je 0x10009ab8
mov edx, dword [eax]
jmp 0x10009aba
mov edx, ebx
lea eax, [ecx + 4]
neg ecx
sbb ecx, ecx
and ecx, eax
call fcn.100064f0
mov esi, eax
test esi, esi
js 0x10009b9a
lea eax, [ebp - 0xd8]
push eax
push 0x20019
push ebx
push str.MSProject.ApplicationCurVer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10009b93
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd0]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10009b93
push 0x16
lea eax, [ebp - 0xd0]
push str.MSProject.Application.
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10009b93
mov eax, dword [ebp - 0xa4]
push 0x30
pop ecx
cmp ax, cx
jbe 0x10009b93
cmp ax, 0x39
ja 0x10009b93
movzx edi, ax
mov eax, dword [ebp - 0xa2]
sub edi, ecx
push 0x17
pop ebx
test ax, ax
je 0x10009b7f
movzx edx, ax
lea eax, [edx - 0x30]
cmp ax, 9
ja 0x10009b7f
imul ecx, edi, 0xa
movzx edi, dx
movzx edx, word [ebp + ebx*2 - 0xce]
add edi, 0xffffffd0
add edi, ecx
inc ebx
test dx, dx
jne 0x10009b5d
xor ecx, ecx
mov eax, 0x80004005
cmp word [ebp + ebx*2 - 0xd0], cx
cmovne esi, eax
jmp 0x10009b98
mov esi, 0x80004005
test esi, esi
mov eax, dword [ebp - 0xdc]
cmovns esi, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
call fcn.10001171
leave
ret 8

Function at 0x1000bc9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.1000ee3e
mov eax, dword [0x100150e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, 0x1048
mov esi, dword [eax]
lea eax, [ebp - 0x104c]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x1050], edi
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1054]
push eax
push 0
push str.Path
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
pop edi
pop esi
test ecx, ecx
jne 0x1000bd10
lea eax, [ebp - 0x104c]
push eax
call fcn.10007b7d
jmp 0x1000bd1d
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001171
leave
ret 4