joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f1190
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, ecx
lea eax, [edi + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x100f11d8
mov eax, dword [eax + 0x28]
test eax, eax
je 0x100f11d8
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
setne al
test al, al
je 0x100f11d8
mov al, 1
jmp 0x100f11da
xor al, al
test al, al
je 0x100f1365
mov esi, edi
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x38]
call eax
test al, al
je 0x100f125f
mov esi, dword [esi + 0x88]
test esi, esi
jne 0x100f11e4
mov eax, edi
nop dword [eax]
cmp byte [eax + 0x81], 0
jne 0x100f1251
mov eax, dword [eax + 0x88]
test eax, eax
jne 0x100f1200
xor ecx, ecx
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov esi, dword [esp + 0xc]
push eax
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x3c]
mov dword [ecx + 0x24], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100f128c
mov eax, dword [esi]
push 5
mov esi, dword [eax + 0x3c]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100f128c
push dword [esi + 0x24]
push 1
jmp 0x100f127e
test eax, eax
je 0x100f1213
mov eax, dword [eax + 0xb8]
mov ecx, dword [eax]
jmp 0x100f1215
mov eax, dword [esp + 0xc]
push 0
mov eax, dword [eax]
mov esi, dword [eax + 0x3c]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x28]
test eax, eax
je 0x100f128c
push 0
push 0
push 0xc9c
push dword [eax + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 0x98]
sub eax, dword [edi + 0x90]
mov ecx, dword [edi + 0x9c]
sub ecx, dword [edi + 0x94]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], ecx
movaps xmm0, xmmword [esp + 0x14]
push eax
movaps xmmword [esp + 0x18], xmm0
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
xor ecx, ecx
nop word [eax + eax]
add eax, dword [edi + 0x90]
add ecx, dword [edi + 0x94]
mov edi, dword [edi + 0x88]
test edi, edi
jne 0x100f12e0
mov esi, dword [esp + 0x30]
lea edi, [ecx + esi]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x30], edi
lea edx, [eax + ecx]
mov eax, edx
mov dword [esp + 0x2c], edx
sub eax, ecx
add dword [esp + 0x34], eax
mov eax, edi
sub eax, esi
add dword [esp + 0x38], eax
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
mov edi, dword [eax + 0x3c]
mov eax, dword [edi + 0x28]
test eax, eax
je 0x100f1365
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100f1365
mov edi, dword [edi + 0x28]
push 0x10
call fcn.102af954
add esp, 4
mov esi, eax
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_CopyRect]
push esi
push 0
push 0xc9b
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.102af935
mov esp, ebp
pop ebp
ret
Function at 0x100f1e00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d285b
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1036a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push 0x78
mov dword [esi], vtable.RC::RCMiniUIBounceWndHandler.0
mov dword [esi + 0xc], eax
call fcn.102af954
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
movaps xmm0, xmmword [0x10300910]
movsd xmm1, qword [0x10300140]
mov byte [eax], 0
movups xmmword [eax + 8], xmm0
movaps xmm0, xmmword [0x103008d0]
movsd qword [eax + 0x18], xmm1
movups xmmword [eax + 0x20], xmm0
movsd qword [eax + 0x30], xmm1
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 1
mov dword [eax + 0x48], 0
mov byte [ebp - 4], 1
mov dword [eax + 0x4c], 0
mov byte [ebp - 4], 2
mov dword [eax + 0x50], 0
mov byte [ebp - 4], 3
mov dword [eax + 0x54], 0
mov byte [ebp - 4], 4
xorps xmm0, xmm0
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x64], 0
movsd qword [eax + 0x68], xmm0
mov dword [eax + 0x70], 1
mov dword [eax + 0x38], SysReAllocString
mov dword [eax + 0x3c], SysReAllocString
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100f3480
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x100f34e5
cmp dword [edi], 0
mov esi, dword [esi]
je 0x100f34c5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100f34db
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100f34db
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x100f34db
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x10372b11], 0
jne 0x100f3525
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100f3517
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10372b14], eax
mov byte [0x10372b11], 1
jmp 0x100f352a
mov eax, dword [0x10372b14]
mov byte [0x10372b11], 1
jmp 0x100f352a
mov eax, dword [0x10372b14]
test eax, eax
je 0x100f3540
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
Function at 0x100f4150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xffffffffffffffff
push 0x102d2c13
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x41c]
mov eax, dword [ebp + 0x420]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x424]
mov dword [ebp - 0x14], eax
mov dword [ebp + 0x40c], 0
mov dword [ebp + 0x40c], 0
mov dword [ebp - 4], 0
mov dword [ebp + 0x408], ecx
mov dword [ebp + 0x404], 0
push 0x404
push 0
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
jne 0x100f421e
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x1c], eax
test esi, esi
jne 0x100f421e
call fcn.1001d720
mov edi, eax
jmp 0x100f4329
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x100f423b
call fcn.1001d720
jmp 0x100f431c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x100f4256
call fcn.1001d720
jmp 0x100f431c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x14], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x100f4274
mov edi, 0x8007000e
jmp 0x100f431e
mov byte [ebp - 4], 2
mov ecx, 2
mul ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
test edx, edx
ja 0x100f436b
jb 0x100f4298
cmp eax, 0xffffffff
ja 0x100f436b
cmp eax, 0x400
jbe 0x100f42b1
push eax
lea ecx, [ebp]
call fcn.100f9f30
mov dword [ebp - 4], 1
jmp 0x100f42d6
lea eax, [ebp + 4]
mov dword [ebp], eax
mov dword [ebp - 4], 1
jmp 0x100f42d6
mov eax, dword [ebp]
test eax, eax
jne 0x100f42e4
mov edi, 0x8007000e
jmp 0x100f431e
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x100f42ff
call fcn.1001d720
jmp 0x100f431c
xor edx, edx
mov eax, dword [ebp]
mov word [eax + ecx*2], dx
push dword [ebp + 0x428]
push dword [ebp]
lea ecx, [ebp + 0x404]
call fcn.100f5590
mov edi, eax
test esi, esi
je 0x100f4329
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x100f433d
lea ecx, [ebp]
call fcn.100f9a90
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.102af935
lea esp, [ebp + 0x414]
pop ebp
ret 0x10
push 0x80070216
call fcn.1000cb10
int3
Function at 0x100fc790
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x12c]
sub esp, 0x12c
push 0xffffffffffffffff
push 0x102d4053
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp + 0x128], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
movzx eax, word [ebp + 0x134]
mov edi, 1
mov esi, dword [0x1036e6a4]
push 0xf0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100fc929
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100fc929
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100fc929
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 0x1234
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x100fc929
mov ecx, dword [esi + 4]
mov dword [ebp - 0x10], eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x18], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x100fc8ab
push 0x104
lea eax, [ebp + 0x24]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp + 0x24]
push esi
call fcn.100fcc70
mov dword [ebp - 4], 0
push dword [ebp + 0x24]
mov eax, dword [ebp - 0x10]
push 0
push 0x143
movzx eax, ax
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x24]
lea ecx, [ebp + 0x28]
cmp eax, ecx
je 0x100fc919
push eax
call ebx
add esp, 4
jmp 0x100fc919
cmp dx, ax
jne 0x100fc91e
push esi
lea ecx, [ebp - 0x11c]
mov dword [ebp], 1
mov dword [ebp + 4], 0xffffffff
call fcn.100fcc70
mov dword [ebp - 4], 1
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
mov eax, dword [ebp - 0x11c]
cmp eax, ecx
je 0x100fc8f3
push eax
call ebx
add esp, 4
lea eax, [ebp]
push eax
mov eax, dword [ebp - 0x10]
push 0
push 0x40b
movzx eax, ax
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
mov edx, 0x1234
add esi, dword [ebp - 0x18]
test edi, edi
jne 0x100fc822
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x128]
xor ecx, ebp
call fcn.102af935
lea esp, [ebp + 0x12c]
pop ebp
ret 4
Function at 0x100fd440
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x1036a00c]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov edi, dword [esp + 0x128]
mov esi, ecx
push 0x30
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 0x110
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x114
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100fd4a0
cmp dword [esp + 0xc], 6
mov eax, 0x30
jae 0x100fd4a5
mov eax, 0x2c
push edi
mov dword [esi], eax
mov dword [esi + 4], 0
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], edi
mov ecx, dword [0x1036e6a4]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x134]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x11c]
pop edi
mov dword [esi + 0x28], 0
pop esi
xor ecx, esp
call fcn.102af935
add esp, 0x118
ret 0x18
Function at 0x100fdb00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d4342
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1036a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call sym.2345MiniUI.dll_public:_void___thiscall_RC::RCMiniUIWindow::constructor_void_
mov dword [ebp - 4], 0
lea esi, [edi + 0x4c]
mov dword [edi], vtable.RC::RCMiniUIDialogView.0
lea ecx, [edi + 0x3c]
mov dword [edi + 0x10], 0xae
mov dword [edi + 0x14], 0xaf
mov dword [edi + 0x1c], edi
push edi
mov dword [edi + 0x24], edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
call sym.2345MiniUI.dll_public:_void___thiscall_RC::RCMiniUIBounceWndHandler::constructor_class_RC::RCMiniUIDialogView__
mov byte [ebp - 4], 1
push 0x60
mov byte [esi], 0
mov byte [edi + 0x4d], 0xff
call fcn.102af954
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.100fd790
mov byte [ebp - 4], 1
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101007c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d47f8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1036a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10100941
mov eax, dword [ecx + 0xb8]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x10100941
cmp dword [eax + 4], 0
je 0x10100941
call sym.2345MiniUI.dll_public:_class_RC::RCMiniUIInputMethod____thiscall_RC::RCMiniUIRootView::GetInputMethod_void_
mov edi, eax
test edi, edi
je 0x10100941
mov eax, dword [ebp + 8]
sub eax, 0x10d
je 0x10100932
sub eax, 1
je 0x1010091a
sub eax, 1
jne 0x10100941
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp dword [edi + 4], 0
mov ebx, eax
mov dword [ebp - 0x30], ebx
je 0x10100941
mov ecx, edi
call fcn.100566d0
push ebx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov ebx, eax
test ebx, ebx
je 0x10100941
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
test dword [ebp + 0x10], 0x800
je 0x101008f3
push eax
push eax
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x101008f3
mov esi, eax
shr esi, 1
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x28]
call fcn.100567e0
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.100568a0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x2c]
cmovae eax, dword [ebp - 0x28]
push eax
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10018a30
jmp 0x10100941
mov byte [edi + 8], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
jmp 0x10100941
mov ecx, edi
mov byte [edi + 8], 0
call fcn.100566d0
mov byte [edi + 0x10], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102af935
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101059c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
push 0x12
mov ebp, ecx
mov dword [eax], 0
call ebx
movzx esi, ax
shr esi, 5
push 0x10
and esi, 4
call ebx
mov edi, esi
or edi, 1
and al, 0x80
push 0x11
cmove edi, esi
call ebx
mov ecx, dword [ebp + 4]
mov esi, edi
or esi, 2
and al, 0x80
cmove esi, edi
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
test ecx, ecx
je 0x10105a2e
mov eax, dword [ecx]
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
mov eax, dword [eax + 0x88]
call eax
test al, al
je 0x10105a2e
mov eax, dword [esp + 0x20]
mov dword [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10

Function at 0x10105a40
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x12
mov dword [esp + 0x14], ecx
mov dword [ebp], 0
call ebx
movzx esi, ax
shr esi, 5
push 0x10
and esi, 4
call ebx
mov edi, esi
or edi, 1
and al, 0x80
push 0x11
cmove edi, esi
call ebx
mov ecx, dword [esp + 0x10]
mov esi, edi
or esi, 2
and al, 0x80
cmove esi, edi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [esp + 0x20]
mov ecx, eax
mov ebx, dword [esp + 0x1c]
test ecx, ecx
je 0x10105aae
mov eax, dword [ecx]
push esi
push edi
push ebx
mov eax, dword [eax + 0x84]
call eax
test al, al
jne 0x10105ac9
cmp dword [ebp], 0
jne 0x10105ad0
mov eax, dword [esp + 0x10]
push esi
push edi
push ebx
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
test al, al
je 0x10105ad0
mov dword [ebp], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10

Function at 0x10106900
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d4f89
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1036a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 4
lea ecx, [edi + 0x24]
call sym.2345MiniUI.dll_public:_void___thiscall_RC::RCMiniUIDialogView::constructor_void_
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0x30]
mov eax, dword [ebp + 8]
mov dword [edi], vtable.RC::RCMiniUISimpleWindow.0
mov dword [edi + 0x24], vtable.RC::RCMiniUISimpleWindow.1.0
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x101069b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102d4fe9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1036a00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 4
lea ecx, [edi + 0x24]
call sym.2345MiniUI.dll_public:_void___thiscall_RC::RCMiniUIDialogView::constructor_void_
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0x30]
mov eax, dword [ebp + 8]
add ecx, 0x18
mov dword [edi], vtable.RC::RCMiniUISimpleWindow.0
mov dword [edi + 0x24], vtable.RC::RCMiniUISimpleWindow.1.0
cmp ecx, eax
je 0x10106a54
cmp dword [eax + 0x14], 0x10
mov edx, eax
jb 0x10106a4b
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.10017030
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1010cf90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1010cfbc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x1010cfde
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x1010cfe0
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x1010d065
jg 0x1010cff5
test esi, esi
je 0x1010d065
test ecx, ecx
jl 0x1010d03e
jg 0x1010cfff
test eax, eax
je 0x1010d03e
cmp edi, ecx
jg 0x1010d013
jl 0x1010d009
cmp esi, eax
jae 0x1010d013
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x1010d041
mov edx, dword [ebp + 8]
test edi, edi
jl 0x1010d065
jg 0x1010d04b
test esi, esi
je 0x1010d065
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1010d065
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc