joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001df5d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x1001df77
mov edi, dword [esi + 0xc]
jmp 0x1001dfb7
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x1001df90
call fcn.1000d733
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1001dfa5
call fcn.1000d733
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1001dfb7
call fcn.1000d733
call fcn.1000827c
cmp dword [eax + 0x3c], 0
je 0x1001dfcc
push edi
mov ecx, ebx
call fcn.1001d75a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1001e1a0
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x1001dff5
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x1001e001
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1002fe2a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, edx
je 0x1003004f
test esi, esi
je 0x1003004f
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x868], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x860], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
sub eax, ebx
je 0x10030020
sub eax, 1
je 0x1002fec2
sub eax, 1
je 0x1002ff88
sub eax, 1
jne 0x1003003a
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x20c]
push eax
push dword [edx + 4]
call edi
test eax, eax
je 0x1003001b
push ebx
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10018a04
test eax, eax
je 0x1003001b
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x1002ff80
push ebx
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10018a04
test eax, eax
je 0x1002ff80
cmp dword [ebp + 0x10], 1
jne 0x1002ffe0
test byte [ebp - 0x854], 0x10
jne 0x1003001b
test byte [ebp - 0x624], 0x10
jne 0x1002ff80
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x858], ecx
ja 0x1002ff80
jb 0x1003001b
cmp dword [ebp - 0x85c], eax
jb 0x1003001b
cmp dword [ebp - 0x858], ecx
jb 0x1003003a
ja 0x1002ff80
cmp dword [ebp - 0x85c], eax
jbe 0x1003003a
xor ebx, ebx
inc ebx
jmp 0x1003003a
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0xddc]
push 0x408
push 0x2b4
push eax
push ebx
push dword [edx + 4]
call edi
test eax, eax
je 0x1003003a
push 0x408
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push ebx
push dword [esi + 4]
call edi
test eax, eax
je 0x1003003a
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
jmp 0x1003003a
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.1002f562
test al, al
jne 0x1003001b
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.1002f581
xor ebx, ebx
test al, al
setne bl
jmp 0x1003003a
or ebx, 0xffffffff
jmp 0x1003003a
push dword [esi + 8]
mov eax, dword [edx]
push dword [edx + 8]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x10030037
xor eax, eax
jmp 0x1003003c
movsx ebx, ax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e96
mov esp, ebp
pop ebp
ret 0xc
call fcn.10004bf5
int3
Function at 0x100305fc
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x10141133
call fcn.101237d7
mov edi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x704], ebx
setne al
test eax, eax
jne 0x1003062b
call fcn.10004bf5
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x10030759
sub eax, 1
je 0x10030683
sub eax, 1
je 0x1003065b
sub eax, 1
je 0x10030683
push 0x1014dc14
mov ecx, esi
call fcn.10002ce0
mov eax, esi
call fcn.10123781
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x10030645
lea eax, [ebp - 0x4e8]
push eax
jmp 0x1003064a
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x10030645
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
call fcn.10018a04
test eax, eax
je 0x10030645
call fcn.100051d1
push eax
lea ecx, [ebp - 0x700]
call fcn.100025d0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
jne 0x10030719
test byte [ebp - 0x428], 0x18
jne 0x10030731
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov ecx, edi
push dword [ebp - 0x430]
call dword [eax + 0x1a0]
jmp 0x10030731
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov ecx, edi
call dword [eax + 0x1a4]
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.10003703
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.100028d0
jmp 0x10030651
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x10030645
lea eax, [ebp - 0x6f0]
jmp 0x10030680

Function at 0x10030908
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10079e2a
call fcn.100082d0
cmp dword [eax + 0x14], 0
jne 0x10030923
mov ecx, esi
pop esi
jmp fcn.1002fcff
pop esi
ret

Function at 0x100316ba
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10002450
call fcn.100082d0
cmp dword [eax + 0x14], 0
jne 0x100316d5
mov ecx, esi
pop esi
jmp fcn.10030f97
pop esi
ret
Function at 0x10032d54
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x10032d99
test edi, edi
js 0x10032d99
cmp eax, 0x20
je 0x10032d8e
cmp bx, 0x71
jne 0x10032d99
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1005dcd9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov edx, 0x104
xor ecx, ecx
mov eax, dword [edi + 4]
cmp eax, edx
ja 0x1005de82
je 0x1005deac
cmp eax, 0xa1
jb 0x1005deef
cmp eax, 0xa2
jbe 0x1005deac
cmp eax, 0xa3
jbe 0x1005deef
cmp eax, 0xa5
jbe 0x1005deac
cmp eax, 0xa6
jbe 0x1005deef
cmp eax, 0xa8
jbe 0x1005deac
cmp eax, 0x100
jne 0x1005deef
cmp dword [esi + 0xc0], 0xffffffff
je 0x1005deac
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1005deaa
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x1005de0a
sub eax, 1
jne 0x1005deaa
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0xbc]
add eax, ecx
lea edi, [ecx + 1]
jmp 0x1005ddbd
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x1005ddc3
mov eax, dword [esi + 0xbc]
inc edi
add eax, dword [esi + 0xc0]
cmp edi, eax
jl 0x1005dd93
jmp 0x1005de02
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.10015f7b
mov edx, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [edx + 0x270]
and dword [esi + 0x24c], 0
xor eax, eax
inc eax
jmp 0x1005df15
mov ecx, dword [esi + 0xc0]
lea edi, [ecx - 1]
add edi, dword [esi + 0xbc]
cmp edi, ecx
jle 0x1005de02
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x1005de45
dec edi
cmp edi, dword [esi + 0xc0]
jg 0x1005de1d
jmp 0x1005de02
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.10015f7b
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [eax + 0x270]
jmp 0x1005ddfb
cmp eax, 0x200
jb 0x1005deef
cmp eax, 0x202
jbe 0x1005deac
cmp eax, 0x203
jbe 0x1005deef
cmp eax, 0x205
jbe 0x1005deac
add eax, 0xfffffdf9
cmp eax, 1
ja 0x1005deef
jmp 0x1005deac
xor ecx, ecx
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x1005decc
cmp dword [eax + 0x20], 0
je 0x1005decc
push edi
push ecx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x1005deed
cmp dword [eax + 0x20], 0
je 0x1005deed
push edi
push 0
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp dword [edi + 4], 0x203
jne 0x1005df0d
lea eax, [esi + 0x2250]
test eax, eax
je 0x1005df05
mov ecx, dword [eax + 0x20]
cmp dword [edi], ecx
je 0x1005de02
push edi
mov ecx, esi
call fcn.10056704
pop edi
pop esi
pop ebp
ret 4
Function at 0x100667c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
jne 0x100667e6
xor eax, eax
jmp 0x100668bc
cmp dword [ebp + 0xc], 0
je 0x100667df
xor ebx, ebx
call fcn.1000827c
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100667df
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100667df
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100668d2
push eax
call fcn.1012adc0
inc eax
pop ecx
mov dword [ebp - 8], eax
lea edx, [eax + eax]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x1006688a
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
and eax, ecx
lea ecx, [edx + 8]
cmp eax, 0x400
ja 0x1006686c
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.10123e50
mov esi, esp
test esi, esi
je 0x100668d2
mov dword [esi], 0xcccc
jmp 0x10066885
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.10128e70
mov esi, eax
pop ecx
test esi, esi
je 0x100668d2
mov dword [esi], 0xdddd
add esi, 8
jmp 0x1006688c
mov esi, ebx
test esi, esi
je 0x100668d2
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.100051ba
test eax, eax
je 0x100668ac
mov ecx, dword [ebp - 0x10]
push eax
call fcn.10068168
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call fcn.10068184
pop ecx
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10122e96
mov esp, ebp
pop ebp
ret 8
call fcn.10004bf5
int3
Function at 0x10071545
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.10015db3
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
push 0x20
mov ebx, eax
call esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.10011166
mov edi, dword [ebp - 0x18]
mov esi, eax
test edi, 0x1000
je 0x100715bd
cmp esi, 3
jne 0x100715ac
push 2
pop esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x100715bd
xor eax, eax
jmp 0x10071612
cmp esi, 0xa
jl 0x100715c7
cmp esi, 0x11
jle 0x100715cc
cmp esi, 4
jne 0x10071610
test edi, 0x800
je 0x100715d9
push 2
pop eax
jmp 0x10071612
mov eax, dword [ebp - 0x1c]
neg ebx
push ebx
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test edi, 0x200
je 0x10071610
mov eax, esi
sub eax, 4
je 0x1007165d
sub eax, 9
je 0x10071649
sub eax, 1
je 0x10071639
dec eax
sub eax, 1
je 0x10071625
sub eax, 1
je 0x1007165d
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e96
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setle al
dec eax
and eax, 5
add eax, 0xa
jmp 0x10071612
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
add eax, 0xb
jmp 0x10071612
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
lea eax, [eax*2 + 0xa]
jmp 0x10071612
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setg al
lea eax, [eax*4 + 0xb]
jmp 0x10071612
Function at 0x1007a493
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x1007a4c5
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1007a4f0
cmp dword [0x101a29a4], 0
jne 0x1007a4f0
lea ecx, [esi - 0x41]
cmp ecx, 0x19
jbe 0x1007a4e3
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1007a4e7
mov eax, esi
jmp 0x1007a563
push esi
call fcn.10133cd5
pop ecx
jmp 0x1007a563
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10125f90
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1007a575
call fcn.10005add
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e96
mov esp, ebp
pop ebp
ret 4
call fcn.10004bf5
int3
Function at 0x1007aa86
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x101441af
call fcn.1012380e
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
call fcn.1004c067
test eax, eax
je 0x1007ac27
lea ecx, [ebp - 0x1c]
xor edi, edi
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x1c], edi
push ecx
lea ecx, [ebx + 4]
call fcn.1007a92d
test eax, eax
je 0x1007aac9
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100051d1
push eax
lea ecx, [ebp - 0x18]
call fcn.100025d0
mov esi, 0x104
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.10002a30
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.10004eb0
call fcn.100051d1
push eax
lea ecx, [ebp - 0x14]
call fcn.100025d0
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.10002a30
mov esi, dword [ebp - 0x18]
push eax
push edi
push 0x1015f15c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.10004eb0
push edi
push 0x4000100
push 2
push edi
push edi
mov edi, dword [ebp - 0x14]
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x1007ab61
lea ecx, [edi - 0x10]
call fcn.100028d0
lea ecx, [esi - 0x10]
jmp 0x1007ac22
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.10016133
push 0
push 0x1000
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.1000e91b
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [ebx + 0x20], 1
push edx
mov byte [ebp - 4], 4
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.1000ef1d
and dword [ebx + 0x20], 0
lea ecx, [ebp - 0x88]
call fcn.1000ea2b
lea ecx, [ebp - 0x40]
call fcn.100161e8
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
call fcn.10049585
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [edi - 0x10]
call fcn.100028d0
lea ecx, [esi - 0x10]
call fcn.100028d0
xor eax, eax
inc eax
jmp 0x1007ac29
call fcn.100028d0
xor eax, eax
call fcn.1012376c
ret 8
Function at 0x100ce195
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1019b76c], 0
push esi
je 0x100ce276
cmp dword [0x1019bac8], 0xfffffffe
jne 0x100ce263
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x100ce276
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101a597c]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101a4a08]
cmp eax, dword [ecx + 4]
jle 0x100ce20d
mov ebx, 0x101a4a08
push ebx
call fcn.10123322
cmp dword [0x101a4a08], 0xffffffff
pop ecx
jne 0x100ce20d
mov ecx, 0x101a49e8
call fcn.10036996
push 0x1014c3fa
call fcn.101231b2
push ebx
call fcn.101232e3
pop ecx
pop ecx
mov ebx, 0x101a49f0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x101a49d4], 0
jne 0x100ce279
push 0
push 0
push 0x100ce27f
call fcn.1012afac
add esp, 0xc
mov dword [0x101a49d4], eax
test eax, eax
je 0x100ce252
cmp eax, 0xffffffff
je 0x100ce252
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x1019bac8], esi
jmp 0x100ce259
and dword [0x101a49d4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
jmp 0x100ce276
mov eax, dword [ebp + 8]
mov dword [0x1019bac8], eax
inc eax
neg eax
sbb eax, eax
and dword [0x101a49d4], eax
pop esi
pop ebp
ret
call fcn.10004bf5
int3
Function at 0x100d4916
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1b8]
test al, al
jns 0x100d4935
or ecx, 0xffffffff
jmp 0x100d493b
mov ecx, dword [0x1019b904]
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x2b4]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x1019bb9c
call fcn.10008cf2
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x100d49df
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x100d49df
test edi, edi
je 0x100d4990
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x228]
push eax
push 0x1019b950
call fcn.10008cf2
pop ecx
pop ecx
mov ebx, eax
jmp 0x100d4992
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x100d49ea
test ebx, ebx
je 0x100d49cb
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c0]
test al, 0x40
je 0x100d49df
cmp dword [ebp - 4], 0
je 0x100d49cb
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x24c]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x100d49e1
mov eax, dword [esi]
mov ecx, esi
push 5
push 0
push edi
call dword [eax + 0x1f8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 3
jne 0x100d49df
test edi, edi
je 0x100d49df
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x184]
test eax, eax
je 0x100d49df
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18c]
test eax, eax
je 0x100d49df
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x240]
mov eax, dword [esi]
mov ecx, esi
push 0
push 1
push 5
push edi
call dword [eax + 0x34c]
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x100d49e1
Function at 0x100d67bd
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x101a597c]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov ebx, ecx
mov eax, dword [0x101a4b24]
cmp eax, dword [edx + 4]
jle 0x100d6818
mov esi, 0x101a4b24
push esi
call fcn.10123322
cmp dword [0x101a4b24], 0xffffffff
pop ecx
jne 0x100d6818
call fcn.100051d1
push eax
mov ecx, 0x101a4b20
call fcn.100025d0
push 0x1014c412
call fcn.101231b2
push esi
call fcn.101232e3
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100d68ba
mov eax, dword [ebx + 0x34c]
test eax, eax
je 0x100d68b1
cmp dword [eax + 0x20], 0
je 0x100d68b1
test eax, eax
je 0x100d683e
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x100d68b1
mov eax, dword [edi + 4]
sub eax, 1
je 0x100d6885
sub eax, 1
je 0x100d685b
sub eax, 1
jne 0x100d68b1
mov esi, 0x428e
jmp 0x100d688a
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100d688a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x340]
test eax, eax
je 0x100d688a
add esi, 3
jmp 0x100d688a
mov esi, 0x3ea0
push esi
call fcn.10004e1b
test eax, eax
je 0x100d68ba
push esi
push eax
mov ecx, 0x101a4b20
call fcn.10002730
test eax, eax
je 0x100d68ba
mov eax, dword [0x101a4b20]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x100d68b3
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.10004bf5
int3
Function at 0x100e66d8
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x10149357
call fcn.101237a3
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x100e67be
mov edi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x100e67be
cmp edi, 0x43
je 0x100e671d
cmp edi, 0x2d
jne 0x100e67be
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100e67be
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.100051d1
push eax
lea ecx, [ebp + 8]
call fcn.100025d0
movzx eax, byte [esi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 0xe5]
push eax
movzx eax, byte [esi + 0xe4]
push eax
lea eax, [ebp + 8]
push str.RGB__d___d___d_
push eax
call fcn.10003899
mov esi, dword [ebp + 8]
add esp, 0x14
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.100028d0
mov esi, dword [ebp - 0x10]
push ebx
mov ecx, esi
call fcn.100e3dfd
call fcn.1012376c
ret 4