joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001bdb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1004612b
call fcn.10008950
sub esp, 0x18
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
mov ebx, dword [esi + 0x5c]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
call fcn.100365ae
cmp dword [esi + 0x54], 0
mov edi, dword [eax + 0xc]
je 0x1001bdfe
call fcn.100365ae
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x54]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1001be0f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x1001be1b
or eax, 0xffffffff
jmp 0x1001bf1e
mov ecx, esi
call fcn.1001b8f0
mov dword [ebp - 0x14], eax
call fcn.1001e800
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0
je 0x1001be5e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x1001be5e
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1001be5e
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
and dword [ebp - 4], 0
push esi
call fcn.1001fe31
push dword [ebp - 0x14]
call fcn.1001e758
push edi
push eax
push ebx
mov ecx, esi
call fcn.1001bba3
xor ebx, ebx
cmp eax, ebx
je 0x1001bed2
test byte [esi + 0x38], 0x10
je 0x1001bea0
push 4
pop edi
mov ecx, esi
call fcn.10020ac6
test ah, 1
je 0x1001be98
push 5
pop edi
push edi
mov ecx, esi
call fcn.1001e1fc
cmp dword [esi + 0x1c], ebx
je 0x1001bed2
push 0x97
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.10020c10
jmp 0x1001bed2
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], ebx
je 0x1001bee6
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], ebx
je 0x1001beff
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x1001beff
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.1001b92a
cmp dword [esi + 0x54], ebx
je 0x1001bf1b
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x40]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x1001bf58
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.100365ae
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x1001bf8f
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.1001bba3
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x1001bfe7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, 0xffff0000
push esi
push edi
mov edi, ecx
mov dword [edi + 0x54], ebx
jne 0x1001c007
cmp dword [edi + 0x50], 0
jne 0x1001c007
movzx eax, bx
mov dword [edi + 0x50], eax
call fcn.100365ae
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0x18]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1001bfae
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x1001f44b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x1001f484
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1000648b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10005989
pop esi
ret 4
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x1002079d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x100207e0
call fcn.100365ae
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x100207e0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100207fb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.1001f902
test ebx, ebx
mov esi, eax
je 0x100207f9
test edi, edi
je 0x100207f9
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x10020c8d
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100464c4
call fcn.10008950
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
jne 0x10020cb2
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10020cfe
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [esi + 0x4c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.10005435
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x10022287
Capabilities:
Get disk information

Disassembly:
mov eax, 0x100472b4
call fcn.10008950
sub esp, 0x150
mov eax, dword [0x1005e5e4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x154]
push eax
push edi
mov esi, 0x104
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x100222cf
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x100222d3
cmp eax, esi
jb 0x100222da
xor eax, eax
jmp 0x100223af
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp - 4], ebx
call fcn.10022245
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x1002239f
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x15c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1002232e
xor esi, esi
jmp 0x100223a2
test byte [ebp - 0x158], 2
jne 0x1002233e
push edi
call dword [sym.imp.USER32.dll_CharUpperA]
test byte [ebp - 0x158], 4
jne 0x1002239f
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1002239f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x154], ebx
je 0x1002232a
cmp dword [ebp - 0x154], edi
jbe 0x1002232a
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, edi
add eax, dword [ebp - 0x154]
cmp eax, esi
jge 0x1002232a
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
inc esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10005435
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.10008880
leave
ret 8
Function at 0x10022748
Capabilities:
Get file system object information

Disassembly:
push ebp
lea ebp, [esp - 0xf0]
sub esp, 0x170
mov eax, dword [0x1005e5e4]
push ebx
push esi
push edi
mov dword [ebp + 0xec], eax
call dword [0x1005d0d0]
xor ebx, ebx
cmp dword [ebp + 0xf8], ebx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x100]
mov dword [ebp - 0x78], ebx
mov byte [eax], bl
je 0x10022894
mov edi, dword [ebp + 0xfc]
push 0x800
push 0x160
lea eax, [ebp - 0x74]
push eax
push ebx
push edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x10022894
test byte [ebp - 0x6a], 1
je 0x10022894
lea eax, [ebp - 0x78]
push eax
push 0x1004dee8
push ebx
push 0x1004def8
lea ecx, [ebp - 0x80]
call fcn.100226ec
test eax, eax
jl 0x10022894
mov eax, dword [ebp - 0x78]
cmp eax, ebx
je 0x10022894
lea edx, [ebp - 0x7c]
push edx
push 0x10051e6c
mov dword [ebp - 0x7c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x10022887
cmp dword [ebp - 0x7c], ebx
je 0x10022887
cmp edi, ebx
jne 0x10022808
xor eax, eax
jmp 0x1002282d
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and eax, 0xfffffffc
call fcn.10007a50
mov eax, esp
push dword [ebp - 0x80]
push esi
push edi
push eax
call fcn.10005517
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ecx]
push ebx
push eax
push ecx
call dword [edx + 0x14]
test eax, eax
jl 0x1002287a
mov eax, dword [ebp + 0xf8]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
push 2
push eax
push ecx
call dword [edx + 0x4c]
test eax, eax
jl 0x1002287a
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push ebx
push ebx
push dword [ebp + 0x104]
push dword [ebp + 0x100]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor ebx, ebx
inc ebx
jmp 0x10022887
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
je 0x10022887
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, ebx
jmp 0x10022896
xor eax, eax
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0xec]
call fcn.10008880
pop edi
pop esi
pop ebx
add ebp, 0xf0
leave
ret 0x10
Function at 0x10023836
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x128
xor ebx, ebx
push ebx
push esi
mov edi, ecx
call fcn.100088f0
add esp, 0xc
push 0x104
push dword [edi + 0xc]
lea eax, [esi + 0x22]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [edi + 4]
cmp eax, dword [0x1004dee4]
je 0x1002393d
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x100238a6
push ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
jne 0x100238ad
cmp ebx, ebx
jne 0x100238ad
xor eax, eax
jmp 0x10023940
mov edi, dword [edi + 0xc]
cmp dword [edi - 0xc], ebx
jne 0x100238ba
mov byte [esi + 0x20], bl
jmp 0x100238ce
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
sete cl
dec cl
and ecx, eax
mov byte [esi + 0x20], cl
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.100071d6
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
call fcn.100071d6
mov ecx, dword [eax]
mov dword [esi + 0x10], ecx
mov eax, dword [eax + 4]
mov dword [esi + 0x14], eax
push 0xffffffffffffffff
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
call fcn.100071d6
mov ecx, dword [eax]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0xc], ecx
mov ecx, dword [esi]
or ecx, dword [esi + 4]
jne 0x10023929
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x1002393d
mov eax, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100245fb
Capabilities:
Get file attributes

Disassembly:
push esi
mov esi, ecx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
mov ecx, esi
push 1
je 0x1002461b
mov eax, dword [esi]
push 0
call dword [eax + 0x98]
jmp 0x10024627
mov eax, dword [esi + 0x20]
mov edx, dword [esi]
push eax
call dword [edx + 0x98]
test eax, eax
jne 0x1002462d
pop esi
ret
xor eax, eax
inc eax
pop esi
ret
Function at 0x1002733e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1005e5e4]
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov eax, 0x100
cmp esi, eax
ja 0x1002738d
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, esi
jne 0x1002738d
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10027399
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.10008880
leave
ret 8

Function at 0x10029360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1005e5e4]
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
mov dword [ebp - 4], eax
je 0x100293ad
push dword [ebp + 8]
call fcn.1003473d
mov esi, eax
test esi, esi
je 0x100293d5
push edi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
pop edi
jmp 0x100293d5
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
push 0x1004a0f4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push dword [esi + 0x64]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop esi
call fcn.10008880
leave
ret 0xc
Function at 0x10029478
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x100295fc
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 8], ebx
je 0x100295fb
push esi
push edi
mov edi, dword [ebx]
add edi, 0x40
push edi
call fcn.10007a39
mov esi, eax
test esi, esi
pop ecx
je 0x100295f9
push edi
push ebx
push esi
call fcn.10007e00
mov edi, dword [esi]
add esp, 0xc
add edi, esi
and dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0xc]
mov ecx, dword [edi + ecx*4]
xor eax, eax
cmp ecx, dword [eax*8 + 0x1004ca88]
je 0x100294ee
inc eax
cmp eax, 4
jb 0x100294dd
jmp 0x10029550
cmp dword [ebp + 0x10], 0
je 0x1002950a
cmp dword [eax*8 + 0x1004ca8c], 0x12
je 0x10029550
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], 0xffffff
jmp 0x10029550
lea ebx, [eax*8 + 0x1004ca8c]
push dword [ebx]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetSysColor]
push dword [ebx]
movzx eax, ah
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
mov ch, al
mov eax, ebx
push dword [eax]
shl ecx, 8
mov dword [ebp + 8], ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp + 8]
shr eax, 0x10
movzx eax, al
or ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], ecx
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x100294d5
mov edi, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
mov dword [ebp + 0x10], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
test eax, eax
mov dword [ebp - 4], eax
je 0x100295db
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov edi, eax
push edi
call ebx
mov cl, byte [esi + 0xe]
push 0xcc0020
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push esi
lea ecx, [ecx + edx*4 + 0x28]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
push edi
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp - 0xc]
push edi
call ebx
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x10]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.10007458
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002c4ed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov esi, ecx
call fcn.1001ced1
test eax, eax
jne 0x1002c6dd
mov edi, dword [edi + 4]
push ebx
mov ecx, esi
call fcn.10006474
test byte [esi + 0x7c], 0x20
mov dword [ebp - 0x10], eax
mov ebx, 0x201
jne 0x1002c531
cmp edi, ebx
je 0x1002c531
cmp edi, 0x202
jne 0x1002c68a
cmp edi, 0x200
jb 0x1002c541
cmp edi, 0x209
jbe 0x1002c559
cmp edi, 0xa0
jb 0x1002c68a
cmp edi, 0xa9
ja 0x1002c68a
call fcn.100365d4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x30
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.100088f0
mov eax, dword [esi]
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x14]
mov ecx, esi
push dword [ebp - 0x18]
mov dword [ebp - 0x48], 0x28
call dword [eax + 0x6c]
cmp dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], eax
je 0x1002c5b7
push dword [ebp - 0x24]
call fcn.10007458
pop ecx
cmp edi, ebx
jne 0x1002c5ca
test byte [ebp - 0x41], 0x80
je 0x1002c5ca
mov dword [ebp - 8], 1
jmp 0x1002c5e8
and dword [ebp - 8], 0
cmp edi, ebx
je 0x1002c5e8
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1002c5e8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x78]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x1002c654
cmp dword [ebp - 8], 0
jne 0x1002c654
cmp edi, 0x202
jne 0x1002c614
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xc8
push 0xe001
jmp 0x1002c63c
test byte [esi + 0x78], 8
jne 0x1002c645
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x1002c645
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx + 0x78]
je 0x1002c681
push 0x12c
push 0xe000
mov ecx, esi
call fcn.1002bb9e
jmp 0x1002c681
push dword [ebp - 4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x160]
jmp 0x1002c681
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x1002c667
cmp dword [ebp - 8], 0
je 0x1002c681
mov eax, dword [esi]
push 0xffffffffffffffff
mov ecx, esi
call dword [eax + 0x160]
push 0xe001
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x78], eax
mov ecx, esi
call fcn.1001f118
test eax, eax
pop ebx
je 0x1002c69c
cmp dword [eax + 0x64], 0
jne 0x1002c6e2
cmp dword [ebp - 0x10], 0
je 0x1002c6c4
mov edi, dword [ebp - 0x10]
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
jne 0x1002c6dd
mov ecx, edi
call fcn.1001f0d9
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x1002c6a2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002c6e2
push dword [ebp + 8]
mov ecx, esi
call fcn.1001d96a
jmp 0x1002c6e4
xor eax, eax
inc eax
jmp 0x1002c6e4
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x1002d313
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x10047203
call fcn.10008950
sub esp, 0x1d0
mov eax, dword [0x1005e5e4]
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push 6
push edi
push edi
push dword [ebp + 0x14]
mov esi, ecx
lea ecx, [ebp - 0x1d4]
mov dword [ebp - 0x10], eax
call fcn.10019d71
mov dword [ebp - 4], edi
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1d8], eax
push dword [ebp + 0xc]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x1d8]
mov byte [ebp - 4], bl
call fcn.100057cb
lea ecx, [ebp - 0x1d4]
call fcn.10019b3f
mov ecx, dword [ebp + 0x10]
add eax, 0x34
or dword [eax], ecx
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0x14], eax
mov byte [ebp - 4], 2
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 3
je 0x1002d3d5
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x1d4]
call fcn.10019b3f
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.1002d196
jmp 0x1002d41f
mov eax, dword [esi + 8]
cmp eax, edi
mov dword [ebp - 0x1dc], eax
je 0x1002d41f
add esi, 4
lea eax, [ebp - 0x1dc]
push eax
mov ecx, esi
call fcn.10006535
mov eax, dword [eax]
neg ebx
sbb ebx, ebx
lea ecx, [ebp + 0xc]
and ebx, ecx
push ebx
push eax
lea ecx, [ebp - 0x1d4]
call fcn.10019b3f
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.1002d196
xor ebx, ebx
cmp dword [ebp - 0x1dc], edi
jne 0x1002d3e5
call fcn.10020d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0x18], eax
push 0xf002
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 4
call fcn.100057cb
mov esi, dword [ebp + 0x18]
push dword [esi - 0xc]
lea ecx, [ebp + 0x14]
push esi
call fcn.100057eb
push edi
lea ecx, [ebp + 0x14]
call fcn.100057a3
push 0x1004de98
lea ecx, [ebp + 0x14]
call fcn.1003401e
push edi
lea ecx, [ebp + 0x14]
call fcn.100057a3
lea ecx, [ebp - 0x1d4]
call fcn.10019b3f
add eax, 0x14
inc dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.10019b3f
mov edi, dword [ebp + 0x14]
lea ecx, [ebp - 0x1d4]
mov dword [eax + 0xc], edi
call fcn.10019b3f
mov ecx, dword [ebp - 0x1d8]
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp + 8]
push 0x104
call fcn.100054c8
lea ecx, [ebp - 0x1d4]
mov ebx, eax
call fcn.10019b3f
lea ecx, [ebp - 0x1d4]
mov dword [eax + 0x1c], ebx
call fcn.10019b43
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
mov ebx, eax
call fcn.10005989
xor eax, eax
cmp ebx, 1
sete al
lea ecx, [esi - 0x10]
mov ebx, eax
call fcn.10005435
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10005435
lea ecx, [edi - 0x10]
call fcn.10005435
mov ecx, dword [ebp - 0x1d8]
add ecx, 0xfffffff0
call fcn.10005435
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d4]
call fcn.10019d30
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, ebx
pop ebx
call fcn.10008880
leave
ret 0x14
Function at 0x100335c4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
cmp dword [ebp + 0xc], 0x800
mov eax, dword [0x1005e5e4]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
jne 0x10033622
push 0x10049888
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.10008a03
add esp, 0x10
cmp eax, 0xffffffff
je 0x10033636
cmp eax, esi
jae 0x10033636
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x10033638
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x100335ed
jmp 0x10033639
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
call fcn.10008880
leave
ret