joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402740
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Mation.inf
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x404748
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4027cb
push esi
push str.___r_____
call dword [sym.imp.MSVCRT.dll_fputs]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x104
ret

Function at 0x4027e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x138
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.Mation.inf
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x40]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4046e8
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x44]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4028a3
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x10]
push 0x31
push ecx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_fgets]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
lea edx, [esp + 0x1c]
push str.___r_____
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x18
test eax, eax
jne 0x4028a3
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x138
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x138
ret
Function at 0x100031b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x10076020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x10003250
push 0x80000002
call sub.user32.dll_VkKeyScanA
test eax, eax
jne 0x10003230
xor eax, eax
push ebp
push 0x10003229
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1000326c
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_WaitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10003230
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_UpdateWindow
ret
mov ax, word [0x10076020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x10076020], ax
mov esp, ebp
pop ebp
ret
Function at 0x10005614
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call fcn.1000127c
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x10005844
push 0x80000001
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x10005697
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x10005844
push 0x80000002
call sub.user32.dll_VkKeyScanA
test eax, eax
je 0x10005697
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x10005860
push 0x80000001
call sub.user32.dll_VkKeyScanA
test eax, eax
jne 0x10005720
xor eax, eax
push ebp
push 0x10005719
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.1000545c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x100056fe
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x10005880
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x100056fe
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10005720
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UpdateWindow
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call fcn.100012b4
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call fcn.1000129c
push eax
call fcn.10001274
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x1000583a
cmp byte [ebp - 0xd], 0
jne 0x10005767
cmp byte [ebp - 0x12], 0
je 0x1000583a
lea eax, [ebp - 0x11d]
push eax
call fcn.100012bc
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x10005780
dec ebx
cmp byte [ebx], 0x2e
je 0x1000578f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x1000577f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x1000583a
inc ebx
cmp byte [ebp - 0x12], 0
je 0x100057cc
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call fcn.100012b4
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.100012a4
mov esi, eax
test esi, esi
jne 0x1000583a
cmp byte [ebp - 0xd], 0
je 0x1000583a
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.100012b4
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.100012a4
mov esi, eax
test esi, esi
jne 0x1000583a
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call fcn.100012b4
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call fcn.100012a4
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008b04
Capabilities:
Get keyboard layout

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x10008b24
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EndPaint
test eax, eax
jne 0x10008b24
call sub.user32.dll_GetKeyboardLayout
jmp 0x10008b63
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x10008b0c
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_EnableMenuItem
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.10004374
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x10008bb8
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EndPaint
test eax, eax
je 0x10008bd5
mov eax, ebx
call fcn.10008b04
pop ebx
ret
call sub.user32.dll_GetKeyboardLayout
pop ebx
ret

Function at 0x10008d44
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.100045c4
push eax
call sub.user32.dll_GetKeyState
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.100041f4
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x1000a120
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xffffffe0
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov cx, word [esp + 0xe]
mov dx, word [esp + 0xa]
mov ax, word [esp + 8]
call fcn.10009f5c
fstp qword [esp + 0x18]
wait
mov ax, word [esp + 0x16]
push eax
mov cx, word [esp + 0x18]
mov dx, word [esp + 0x16]
mov ax, word [esp + 0x14]
call fcn.10009dbc
fadd qword [esp + 0x18]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x20
ret

Function at 0x1000a170
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xfffffff0
push esp
call sub.user32.dll_GetKeyboardLayoutList
mov ax, word [esp]
add esp, 0x10
ret

Function at 0x1000b66c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_EnumWindows
jmp 0x1000b693
dec eax
test eax, eax
jle 0x1000b6a5
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x1000b692
sub dl, 0xd
je 0x1000b692
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.100041f4
add esp, 0x100
pop ebx
ret

Function at 0x1000b684
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_EnumWindows
jmp 0x1000b693
dec eax
test eax, eax
jle 0x1000b6a5
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x1000b692
sub dl, 0xd
je 0x1000b692
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.100041f4
add esp, 0x100
pop ebx
ret
Function at 0x1000b6b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
jle 0x1000b6f1
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.100041f4
jmp 0x1000b6fa
mov eax, ebx
mov edx, esi
call fcn.10004158
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b704
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.user32.dll_GetKeyboardState
test eax, eax
jle 0x1000b725
mov al, byte [esp]
jmp 0x1000b727
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x1000c730
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1000c806
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.1000419c
lea eax, [ebp - 8]
call fcn.10004614
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.100045c4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x1000c7f0
mov eax, ebx
call fcn.100026dc
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x1000c7e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.100045c4
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x1000c7d3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1000c818
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x1000c7d3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000c7f0
mov eax, dword [ebp - 0x10]
call fcn.100026fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000c80d
lea eax, [ebp - 8]
call fcn.10004104
ret

Function at 0x1000cc84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x1000cce8
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.10004374
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetActiveWindow
mov edx, eax
pop eax
call fcn.100087b8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000ccef
lea eax, [ebp - 0xc]
call fcn.10004104
ret
Function at 0x1000d264
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x1000d2f4
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayout
mov ebx, eax
test ebx, ebx
je 0x1000d2c0
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.1000b66c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x1007ac2c]
mov dl, 1
mov eax, dword [0x10007e88]
call fcn.1000bf90
mov edx, eax
jmp 0x1000d2d4
mov ecx, dword [0x1007ad2c]
mov dl, 1
mov eax, dword [0x10007e88]
call fcn.1000bf54
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.10003abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1000d2fb
lea eax, [ebp - 0x14]
call fcn.10004104
ret

Function at 0x1000f1f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce8
push ebx
push esi
push edi
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
test byte [eax + 1], 0x20
jne 0x1000f21c
mov eax, 0x80070057
call fcn.1000f03c
mov eax, dword [ebp - 0x304]
mov ax, word [eax]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x1000f358
mov edx, dword [ebp - 0x304]
test ah, 0x40
je 0x1000f254
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
jmp 0x1000f263
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + 8]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x1000f2e8
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.1000f03c
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
call fcn.1000f03c
mov eax, dword [ebp - 0x318]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x318]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x1000f286
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x1000f30d
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x1000f300
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.1000f168
pop ecx
test al, al
je 0x1000f34b
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x308]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
call fcn.1000f03c
mov eax, dword [ebp - 0x314]
call fcn.1000f3ec
push ebp
mov eax, ebx
call fcn.1000f198
pop ecx
test al, al
jne 0x1000f30d
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_VirtualQuery
call fcn.1000f03c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f494
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffce0
push ebx
push esi
push edi
mov dword [ebp - 0x308], ecx
mov ebx, edx
mov dword [ebp - 0x304], eax
test byte [ebx + 1], 0x20
jne 0x1000f4be
mov eax, 0x80070057
call fcn.1000f03c
mov ax, word [ebx]
mov edx, eax
and dx, 0xfff
cmp dx, 0xc
jne 0x1000f645
test ah, 0x40
je 0x1000f4e4
mov eax, dword [ebx + 8]
mov eax, dword [eax]
mov dword [ebp - 0x314], eax
jmp 0x1000f4ed
mov eax, dword [ebx + 8]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
movzx eax, word [eax]
mov dword [ebp - 0x310], eax
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x1000f572
inc ebx
xor edi, edi
lea esi, [ebp - 0x300]
mov eax, esi
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
add eax, 4
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.1000f03c
lea eax, [ebp - 0x30c]
push eax
lea eax, [edi + 1]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_WriteProcessMemory
call fcn.1000f03c
mov eax, dword [ebp - 0x320]
mov edx, dword [ebp - 0x30c]
sub edx, dword [eax + 4]
inc edx
mov eax, dword [ebp - 0x320]
mov dword [eax], edx
inc edi
add esi, 8
dec ebx
jne 0x1000f510
lea eax, [ebp - 0x300]
push eax
mov eax, dword [ebp - 0x310]
push eax
push 0xc
call sub.KERNEL32.DLL_WinExec
mov esi, eax
test esi, esi
jne 0x1000f592
call fcn.1000ed94
mov eax, dword [ebp - 0x304]
call fcn.1000f3ec
mov eax, dword [ebp - 0x304]
mov word [eax], 0x200c
mov eax, dword [ebp - 0x304]
mov dword [eax + 8], esi
mov ebx, dword [ebp - 0x310]
dec ebx
test ebx, ebx
jl 0x1000f5d6
inc ebx
lea eax, [ebp - 0x2fc]
lea edx, [ebp - 0x100]
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 8
dec ebx
jne 0x1000f5c9
push ebp
mov ebx, dword [ebp - 0x310]
dec ebx
mov eax, ebx
call fcn.1000f408
pop ecx
test al, al
je 0x1000f636
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x314]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
call fcn.1000f03c
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
call sub.KERNEL32.DLL_lstrcmpiA
call fcn.1000f03c
mov eax, dword [ebp - 0x318]
mov edx, eax
mov eax, dword [ebp - 0x31c]
call dword [ebp - 0x308]
push ebp
mov eax, ebx
call fcn.1000f438
pop ecx
test al, al
jne 0x1000f5d6
jmp 0x1000f657
push ebx
mov eax, dword [ebp - 0x304]
push eax
call sub.KERNEL32.DLL_VirtualQueryEx
call fcn.1000f03c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100197dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x100197ff
add esp, 0xfffffff0
call fcn.10003654
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x10019905
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x10019887
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.10008a40
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.100196d4
cmp dword [ebx + 4], 0
jge 0x100198ea
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.10008d44
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x1c]
call fcn.1000b66c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x1007ad98]
mov dl, 1
mov eax, dword [0x10014d74]
call fcn.1000bf90
call fcn.10003abc
jmp 0x100198ea
movzx edx, di
mov eax, esi
call fcn.100089c4
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.100196d4
cmp dword [ebx + 4], 0
jge 0x100198ea
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.10008d44
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x24]
call fcn.1000b66c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x1007a900]
mov dl, 1
mov eax, dword [0x10014dd0]
call fcn.1000bf90
call fcn.10003abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1001990c
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.10004128
ret

Function at 0x1001d304
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x1001d31d
add esp, 0xfffffff0
call fcn.10003654
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x1001d3ae
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.10003318
call fcn.1001d0a4
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], bl
push esi
push 4
lea eax, [esi + 8]
push eax
mov ecx, 0x1001d25c
xor edx, edx
xor eax, eax
call fcn.100040b8
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x1001d398
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x10]
call fcn.1000b66c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x1007ad0c]
mov dl, 1
mov eax, dword [0x10015da8]
call fcn.1000bf90
call fcn.10003abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1001d3b5
lea eax, [ebp - 0x10]
call fcn.10004104
ret

Function at 0x1001fb08
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x1001fb0e
ret
Function at 0x10021a44
Capabilities:
Enumerate gui resources
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x10021ae0
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayout
mov ebx, eax
test ebx, ebx
je 0x10021ac2
push 0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x400
push ebx
push 0
push 0x1000
call sub.user32.dll_EnumWindows
test eax, eax
je 0x10021ac2
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.10004374
mov ecx, dword [ebp - 0x104]
mov dl, 1
mov eax, dword [0x10015154]
call fcn.1000be98
call fcn.10003abc
jmp 0x10021ac7
call fcn.100219f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10021ae7
lea eax, [ebp - 0x104]
call fcn.10004104
ret
Function at 0x100284dc
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, eax
push edx
mov eax, dword [esi + 4]
push eax
call sub.user32.dll_ReleaseCapture
sub eax, 0xffffffff
je 0x1002850e
dec eax
je 0x10028506
sub eax, 0x80
je 0x10028502
sub eax, 0x82
je 0x1002850a
jmp 0x1002851a
mov bl, 2
jmp 0x1002851c
xor ebx, ebx
jmp 0x1002851c
mov bl, 1
jmp 0x1002851c
mov bl, 3
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 8], eax
jmp 0x1002851c
mov bl, 3
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x10057698
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10057718
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x100576f6
inc ebx
xor edi, edi
mov eax, dword [ebp - 8]
call fcn.100043c4
push eax
lea eax, [edi + 1]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, edx
mov edx, dword [ebp - 8]
mov al, byte [edx + eax - 1]
xor byte [esi], al
inc esi
inc edi
dec ebx
jne 0x100576d4
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.10019304
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1005771f
lea eax, [ebp - 8]
call fcn.10004104
ret

Function at 0x10058474
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10058505
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.10004104
mov eax, dword [ebp - 4]
call fcn.100043c4
mov ebx, eax
test bx, bx
jbe 0x100584e7
mov di, 1
movzx eax, di
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax - 1]
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
mov dx, word [ebp - 6]
xor dx, 0xd8
call fcn.100042ec
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.100043cc
inc edi
dec bx
jne 0x100584b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1005850c
lea eax, [ebp - 0xc]
call fcn.10004104
lea eax, [ebp - 4]
call fcn.10004104
ret