joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fd10
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x43fd22
add esp, 0xfffffff0
call fcn.00403118
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00412210
mov eax, ebx
call fcn.0044005c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x70], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x43c800
push eax
push 0
push 0
mov eax, dword [0x449ca8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4136d8]
call fcn.00414c10
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x4136d8]
call fcn.00414c10
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x4136d8]
call fcn.00414c10
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.0044043c
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x440358
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x440358
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x440358
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x43fe31
call fcn.00403170
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44013c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4402e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
jne 0x4402c8
mov dl, 1
mov eax, dword [0x40c620]
call fcn.00402de8
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
add eax, 0x2c
call fcn.00403aa0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4402b7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0042eac0
test al, al
je 0x4402aa
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4402f8
lea eax, [ebp - 0x254]
call fcn.004089e4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4402aa
xor eax, eax
push ebp
push 0x4402a3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x440330
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44028c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403cd0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x30]
jne 0x44028c
mov eax, dword [ebp - 4]
add eax, 0x2c
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00403cd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4402aa
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4401ad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov byte [eax + 0x19], 0
mov dl, 1
call fcn.0040f2a4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4402ee
lea eax, [ebp - 0x260]
call fcn.00403aa0
ret

Function at 0x440b34
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x44a7cc]
cmp byte [eax + 0x95], 0
jne 0x440ba5
cmp dword [0x44a7e8], 0
jne 0x440b66
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x440af0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x44a7e8], eax
cmp dword [0x44a7e4], 0
jne 0x440b81
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x44a7e4], eax
cmp dword [0x44a7ec], 0
jne 0x440ba5
push esp
push 0
push 0
push 0x440a94
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x44a7ec], eax
pop edx
ret
Function at 0x440c9c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x440cb3
add esp, 0xfffffff0
call fcn.00403118
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00412210
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x40c320]
call fcn.00402de8
mov dword [ebx + 0x98], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x4c], 0x80000018
mov dword [ebx + 0x68], 0x1f4
mov byte [ebx + 0x6c], 1
xor eax, eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x64], 0x9c4
mov byte [ebx + 0x78], 0
mov byte [ebx + 0x8d], 1
mov dl, 1
mov eax, dword [0x414068]
call fcn.0041b16c
mov esi, eax
mov dword [ebx + 0x88], esi
push 0x440e28
mov eax, dword [0x449bd4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041b53c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x442824
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x449bd4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00409de4
test eax, eax
je 0x440da6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408378
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00409e0c
test eax, eax
je 0x440dba
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x7c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403cd0
mov eax, dword [0x449ad4]
cmp byte [eax], 0
jne 0x440deb
mov eax, ebx
call fcn.00440f14
mov byte [ebx + 0x49], 1
mov byte [ebx + 0x4a], 1
mov byte [ebx + 0x4b], 1
mov byte [ebx + 0x8e], 1
xor eax, eax
mov dword [ebx + 0x90], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x440e1d
call fcn.00403170
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441184
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44a7cc]
cmp dword [eax + 0x24], 0
je 0x441227
cmp dword [ebx + 0x84], 0
jne 0x441221
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x441114
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x80]
cmp dword [eax + 8], 0
je 0x441221
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4411ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x80]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x441221
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x80]
call fcn.0040d9e4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4411f9
inc dword [ebx + 0x84]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x441c34
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x441c69
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403b88
jmp 0x441c73
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403af4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x442b98
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x442bd0
mov eax, esi
call fcn.0042a878
test al, al
je 0x442bd0
mov eax, dword [ebx + 0x74]
call fcn.0042a57c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x442bd0
push 0
mov eax, dword [ebx + 0x74]
call fcn.0042a57c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x443770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403ee4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4437c8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x449e44]
mov dl, 1
mov eax, dword [0x443328]
call fcn.00409400
call fcn.00403570
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00443430
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10004840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10010040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
mov dword [0x10010844], 0
xor esi, esi
lea eax, [esi + 1]
push eax
mov esi, eax
lea eax, [ebp - 0x38]
push str.ACCOUNT_i
push eax
call fcn.10003020
imul eax, dword [0x10010844], 0xb
add esp, 0xc
push str..logins.ini
push 0xc
add eax, 0x100106f8
push eax
push 0x1000d41d
push 0x1000d4ac
lea eax, [ebp - 0x38]
push eax
call ebx
imul eax, dword [0x10010844], 0xb
push str..logins.ini
push 0xc
add eax, 0x10010848
push eax
push 0x1000d41d
push 0x1000d4b4
lea eax, [ebp - 0x38]
push eax
call ebx
mov edx, dword [0x10010844]
imul eax, edx, 0xb
add eax, 0x100106f8
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100048d5
sub eax, edi
cmp eax, 1
jb 0x100048f3
inc edx
mov dword [0x10010844], edx
cmp esi, 0x1e
jl 0x10004865
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009d90
mov esp, ebp
pop ebp
ret
Function at 0x10004cb2
Capabilities:
Create thread

Disassembly:
push 0x34
mov eax, 0x1001e015
call fcn.1001bb08
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xd0], 1
jne 0x10004d76
mov eax, dword [ebp + 8]
cmp dword [eax], 7
jne 0x10004d76
cmp dword [esi + 0x248], ebx
sete al
cmp al, bl
sete al
cmp al, bl
je 0x10004d76
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
push 0x10020b70
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
mov word [ebp - 0x40], ax
call fcn.100074a3
xor eax, eax
push str._self
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
mov word [ebp - 0x30], ax
call fcn.100074a3
mov eax, dword [esi + 0x248]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x10004d40
push 0x80004003
call fcn.1000ee21
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push edx
lea edx, [ebp - 0x30]
push edx
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x40]
push edx
push eax
call dword [ecx + 0xd0]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x30]
push eax
call edi
lea eax, [ebp - 0x40]
push eax
call edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
push eax
call edi
mov eax, dword [esi + 0xd0]
cmp eax, 2
je 0x10004e53
cmp eax, 1
je 0x10004e53
mov eax, dword [esi + 0x244]
or dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
call fcn.100063a6
push dword [ebp + 8]
lea ecx, [esi + 0xe4]
mov eax, dword [ecx]
push eax
mov dword [ebp - 4], 3
call fcn.100084b0
push dword [esi + 0xc0]
lea edi, [esi + 0x240]
cmp dword [edi], ebx
setne byte [ebp - 0xd]
call dword [sym.imp.kernel32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], ebx
je 0x10004de8
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, 1
jne 0x10004e15
cmp dword [esi + 0x23c], ebx
jne 0x10004e15
push edi
push ebx
push esi
push 0x10004c38
push ebx
push ebx
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x23c], eax
jmp 0x10004e53
cmp eax, 0xa
jne 0x10004e47
lea edi, [esi + 0x23c]
cmp dword [edi], ebx
je 0x10004e47
lea eax, [ebp + 8]
push eax
push edi
push 1
push 0xffffffffffffffff
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
test eax, eax
jne 0x10004e53
push dword [edi]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov dword [edi], ebx
jmp 0x10004e53
cmp byte [ebp - 0xd], bl
jne 0x10004e53
mov ecx, esi
call fcn.1000ee21
call fcn.1001bbe0
ret 4
Function at 0x10006690
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x811c9dc5
jmp 0x100066a9
movzx edx, word [ecx]
imul eax, eax, 0x1000193
xor eax, edx
add ecx, 2
cmp ecx, dword [esp + 8]
jne 0x1000669b
ret

Function at 0x1000b06c
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x1000b0ba
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x1000b0cb
push 0xd
pop eax
jmp 0x1000b0f5
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x1000b0ce
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x1000b5af
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.1000ee21
mov ebx, eax
cmp ebx, esi
je 0x1000b622
lea ecx, [ebp - 0x74]
call fcn.10009ecc
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ba56
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x1000b63a
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.1000b5af
cmp eax, esi
jne 0x1000b66c
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000b62a
lea ecx, [ebp - 0x74]
call fcn.10009ecc
push dword [ebp - 0x78]
mov ecx, edi
call fcn.1000af95
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10009ecc
mov eax, esi
jmp 0x1000b608
Function at 0x1000ee21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1000ee30
pop dword [ebp - 0x44]
mov eax, 0xc7000fa0
sub eax, 0xb6ff2170
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x35f74
push 0
mov eax, 0x79cc77a
add eax, 0x86538ca
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3bc2
xor ebx, ebx
add ebx, eax
mov edx, 0xe162d155
add edx, 0x2ea098ab
add edx, dword [ebp - 0x44]
mov edi, 0x2e30185a
add edi, 0xaeaf987d
mov dword [ebp - 8], 0x83d1b8c3
mov esi, dword [edx]
add dword [ebp - 0xc], 0xf28b868d
xor esi, edi
add dword [ebp - 0x40], 0x9ccf63d3
mov dword [ebx], esi
mov dword [ebp - 0x30], 0xd607a4ff
add ebx, 0x8c32dcc4
add ebx, 0x73cd2340
add edx, 0xc56ab7f6
sub edx, 0xc56ab7f2
loop 0x1000ee8b
add eax, 0x64b647d5
add eax, 0x9b4a9a06
mov ebx, eax
add eax, 0xd131cd73
sub eax, 0xd131cd6e
mov ecx, 0xe12a892c
add ecx, 0x2ed576d4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x10011126
Capabilities:
Hide graphical window

Disassembly:
push esi
test ecx, ecx
je 0x10011130
lea esi, [ecx - 0x78]
jmp 0x10011132
xor esi, esi
lea eax, [esi + 0x84]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, dword [esi + 0x50]
test esi, esi
je 0x1001114e
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
ret 8

Function at 0x10011201
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
test eax, eax
je 0x10011213
add eax, 0xffffff84
jmp 0x10011215
xor eax, eax
and dword [ebp + 8], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 7
pop ecx
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 8]
push ecx
push 0x1002244c
lea ecx, [eax + 4]
call fcn.1000d84d
test eax, eax
js 0x1001127e
cmp dword [ebp + 8], 0
je 0x1001127b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
xor edi, edi
call esi
test ax, ax
jns 0x10011253
inc edi
push 0x11
call esi
test ax, ax
jns 0x1001125f
add edi, 2
push 0x12
call esi
test ax, ax
jns 0x1001126b
add edi, 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x1c]
jmp 0x1001127e
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov esi, ecx
test eax, eax
je 0x10011294
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x1001460e
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eac9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014668
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ee21
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014685
call fcn.100060e0
jmp 0x10014687
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100146d3
call fcn.10007f79
jmp 0x100146d3
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret

Function at 0x100146fd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x100307e8]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x1001eaf9
call fcn.1001bb3b
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10014757
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.100178de
pop ecx
pop ecx
push ebx
push edi
call fcn.1000ee21
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.10006d43
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10014774
call fcn.100060e0
jmp 0x10014776
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call dword [sym.imp.msvcr100.dll__mbsnbcpy_s]
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100147c2
call fcn.10007f79
jmp 0x100147c2
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1001ba56
add ebp, 0x20c
leave
ret
Function at 0x10014eb7
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001eb59
call fcn.1001bb3b
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.1000ee21
test eax, eax
je 0x10014ee2
call fcn.10014ea8
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1002051c
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10014f3d
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.100178de
pop ecx
pop ecx
push edi
push esi
call fcn.1000ee21
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10006f58
push eax
push esi
push 0x10023e3c
call fcn.100178de
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x10014f36
ret
cmp ebx, edi
je 0x10014f48
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014fa5
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x10014f01
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x10014ff9
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x10014ff9
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x10014f01
mov eax, esi
call fcn.1001bbe0
ret