joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10085bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push edi
push edx
pop edx
mov bh, bh
mov cl, cl
mov edi, dword [esp + 0x1c]
push 5
push edi
call fcn.10052960
add esp, 8
mov eax, eax
test eax, eax
jne 0x10085c16
mov eax, edi
pop edi
add esp, 0x14
ret
push ebx
push ebp
push esi
push 0
push eax
call fcn.10052960
add esp, 8
mov esi, eax
mov ebx, ebx
mov ecx, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
push ebx
pop ebx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10085ce4
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
nop
mov edi, esi
push edx
pop edx
test ebx, ebx
jne 0x10085c63
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10085c88
xchg ebx, eax
xchg ebx, eax
lea eax, [esp + 0x14]
push eax
push esi
call ebp
mov bl, bl
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x10085cc4
push 2
push esi
call fcn.10052960
add esp, 8
mov esi, eax
mov ebp, ebp
cmp edi, esi
je 0x10085ce4
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ebx, ebx
sub eax, dword [esp + 0x10]
cmp eax, dword [0x1019d8bc]
jae 0x10085ce0
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10085c50
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push esi
call fcn.10085bf0
add esp, 0x10
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret
xor edi, edi
mov ebx, ebx
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x100863d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [esp + 0x28]
jne 0x10086466
cmp dword [esi], 0
je 0x10086466
mov al, 0x69
mov dl, 0x54
mov cl, 0x6f
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x1a], 0
mov esi, esi
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esi + 0x10], eax
mov al, al
mov esi, dword [esi + 0x10]
test esi, esi
je 0x1008648a
push 1
push edi
call esi
push eax
pop eax
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.100fc49a
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.100fc49a
add esp, 0x18
ret

Function at 0x100864a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push edi
xor edi, edi
push ebx
pop ebx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0x14
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov ecx, ecx
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x33
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0
push ecx
pop ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
mov cl, cl
test esi, esi
je 0x1008659d
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0x57
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x77
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], 0x78
mov byte [esp + 0x35], 0
mov ecx, ecx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov eax, eax
test eax, eax
je 0x10086594
lea ecx, [esp + 8]
push ecx
call eax
mov ecx, ecx
mov edi, 1
mov al, al
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov ebp, ebp
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.100fc49a
add esp, 0x34
ret
Function at 0x10086c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
mov cl, cl
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
mov bh, bh
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
push edx
pop edx
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
push ecx
pop ecx
test esi, esi
jne 0x10086d1d
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100fc49a
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
push ecx
pop ecx
mov dl, dl
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.100fcf90
add esp, 0xc
push edx
pop edx
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x10086d55
mov edi, dword [esp + 0x34]
mov bh, bh
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov al, al
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100fc49a
add esp, 0x5c
ret
Function at 0x100874c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dl, 0x47
mov byte [esp], 0x52
mov byte [esp + 1], 0x71
mov byte [esp + 2], dl
mov byte [esp + 3], dl
mov byte [esp + 4], 0x6a
mov byte [esp + 5], 0x4a
mov byte [esp + 6], 0x41
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x77
mov byte [esp + 9], 0x4c
mov byte [esp + 0xa], 0x58
mov byte [esp + 0xb], 0x79
mov byte [esp + 0xc], 0x70
mov byte [esp + 0xd], 0
push ebx
pop ebx
test eax, eax
je 0x1008753f
push eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetPropA]
mov ebx, ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100fc49a
add esp, 0x14
ret
lea edx, [esp]
push edx
push ecx
call dword [sym.imp.USER32.dll_RemovePropA]
mov ch, ch
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100fc49a
add esp, 0x14
ret

Function at 0x10087560
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov cl, 0x47
mov byte [esp], 0x52
mov byte [esp + 1], 0x71
mov byte [esp + 2], cl
mov byte [esp + 3], cl
mov byte [esp + 4], 0x6a
mov byte [esp + 5], 0x4a
mov byte [esp + 6], 0x41
mov byte [esp + 7], 0x46
mov byte [esp + 8], 0x77
mov byte [esp + 9], 0x4c
mov byte [esp + 0xa], 0x58
mov byte [esp + 0xb], 0x79
mov byte [esp + 0xc], 0x70
mov byte [esp + 0xd], 0
push ecx
pop ecx
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetPropA]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100fc49a
add esp, 0x14
ret
Function at 0x10089b10
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1016095b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b23cc]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, eax
mov ah, ah
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov edx, edx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10089b8b
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10089b8b
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10089b8b
cmp esi, edi
je 0x10089b8b
mov eax, esi
jmp 0x10089d09
push 5
push edi
call fcn.10052960
add esp, 8
mov ebx, ebx
xor ebx, ebx
push ebx
push eax
call fcn.10052960
add esp, 8
mov edi, eax
mov cl, cl
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
nop
mov esi, edi
push edx
pop edx
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
mov edi, edi
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10089d07
nop
mov edi, esi
mov ah, ah
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x10089cd0
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10089cd0
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.100fcf90
add esp, 0xc
mov edx, edx
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100899b0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x10089c70
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10006900
mov ecx, ecx
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov dl, dl
cmp eax, ebx
jne 0x10089cd0
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10089cc7
cmp dl, bl
je 0x10089cc3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10089cc7
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10089ca7
xor eax, eax
jmp 0x10089ccc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10089d07
push 2
push esi
call fcn.10052960
add esp, 8
mov esi, eax
mov edx, edx
cmp edi, esi
je 0x10089d07
call ebp
nop
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019d8bc]
jae 0x10089d03
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10089c10
jmp 0x10089d07
xor edi, edi
mov ah, ah
mov eax, edi
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100fc49a
add esp, 0x13c
ret
Function at 0x10089d40
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.10089b10
add esp, 4
mov esi, eax
mov ah, ah
test esi, esi
je 0x10089da6
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10089da6
push ebx
push ebp
push edi
mov ebp, ebp
push 0
push esi
call fcn.10052920
add esp, 8
mov esi, eax
push eax
pop eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov dh, dh
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
mov edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov ebx, ebx
push 0
push esi
push edi
call ebx
push eax
pop eax
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1008a2b0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1016095b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b23cc]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x158]
xor ebx, ebx
cmp eax, ebx
jne 0x1008a304
call dword [sym.imp.USER32.dll_GetDesktopWindow]
nop
jmp 0x1008a485
cmp eax, 1
jne 0x1008a483
call dword [sym.imp.USER32.dll_GetDesktopWindow]
nop
push 5
push eax
call fcn.10052960
add esp, 8
mov dh, dh
push ebx
push eax
call fcn.10052960
add esp, 8
mov edi, eax
mov eax, eax
mov esi, edi
mov ah, ah
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
mov eax, eax
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
xchg ebx, eax
xchg ebx, eax
cmp edi, ebx
je 0x1008a47f
mov edi, esi
mov edi, edi
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1008a450
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008a450
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.100fcf90
add esp, 0xc
mov eax, eax
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100899b0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x1008a3f0
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10006900
push ecx
pop ecx
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, esi
cmp eax, ebx
jne 0x1008a450
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1008a447
cmp dl, bl
je 0x1008a443
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1008a447
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x1008a427
xor eax, eax
jmp 0x1008a44c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x1008a47f
push 2
push esi
call fcn.10052960
add esp, 8
mov esi, eax
mov dl, dl
call ebp
mov bh, bh
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019d8bc]
jae 0x1008a47b
cmp esi, ebx
jne 0x1008a390
mov eax, edi
jmp 0x1008a485
xor edi, edi
mov ah, ah
mov eax, edi
jmp 0x1008a485
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.100fc49a
add esp, 0x13c
ret
Function at 0x1008a7e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x1008a7fc
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push edi
call ebp
test eax, eax
jne 0x1008a820
pop edi
xor eax, eax
pop ebp
ret
mov eax, dword [esp + 0xc]
push eax
call fcn.10089b10
add esp, 4
mov dword [esp + 0x10], eax
mov dh, dh
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebp
test eax, eax
je 0x1008a7f7
mov edi, dword [esp + 0x10]
push ebx
push esi
push 5
push edi
call fcn.10052960
add esp, 8
test eax, eax
je 0x1008a8ac
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
push ebx
pop ebx
push 0
push edi
call fcn.10052920
add esp, 8
mov edi, eax
push ecx
pop ecx
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ebx, ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
nop
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, edx
push ebx
call ebp
test eax, eax
je 0x1008a8ac
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008a8ac
mov esi, ebx
mov al, al
push ebx
call ebp
test eax, eax
je 0x1008a8ac
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov edi, edi
cmp esi, dword [esp + 0x18]
je 0x1008a8a6
push esi
call edi
mov esi, eax
mov cl, cl
push esi
call ebp
test eax, eax
jne 0x1008a890
jmp 0x1008a8ac
mov dword [esp + 0x18], ebx
mov edi, edi
mov ebp, dword [esp + 0x1c]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1008a8b5
sub eax, edx
mov edi, eax
mov cl, cl
lea ebx, [edi + edi + 2]
push ebx
call fcn.100fbefc
add esp, 4
mov esi, eax
xchg ebx, eax
xchg ebx, eax
test esi, esi
jne 0x1008a8de
pop esi
pop ebx
pop edi
pop ebp
ret
push ebx
push 0
push esi
call fcn.100fcf90
add esp, 0xc
xchg ebx, eax
xchg ebx, eax
add edi, 1
push edi
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push ecx
pop ecx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008a905
sub eax, edx
sar eax, 1
mov ebx, eax
mov esi, esi
mov al, al
xor edi, edi
test ebx, ebx
jle 0x1008a96c
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x1008a930
movzx ecx, word [esi + edi*2]
mov edx, dword [esp + 0x18]
push 0x4000001
push ecx
push 0x102
push edx
call fcn.10052950
push ecx
pop ecx
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x37fc]
test eax, eax
je 0x1008a965
lea ecx, [ebx - 1]
cmp edi, ecx
jge 0x1008a965
push eax
call ebp
push edx
pop edx
add edi, 1
cmp edi, ebx
jl 0x1008a930
push esi
call fcn.100fbfbf
add esp, 4
mov bl, bl
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
ret
Function at 0x1008a990
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x1008a9aa
mov eax, dword [esp + 8]
push eax
call fcn.10089b10
add esp, 4
mov ebx, eax
mov al, al
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1008a9b7
pop ebx
ret
push 5
push ebx
call fcn.10052960
add esp, 8
test eax, eax
je 0x1008aa4f
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
mov ebx, ebx
push 0
push ebx
call fcn.10052920
add esp, 8
mov edi, eax
mov ah, ah
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov bh, bh
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov dh, dh
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ah, ah
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call edi
test eax, eax
je 0x1008aa4c
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008aa4c
mov esi, ebp
mov esi, esi
push ebp
call edi
test eax, eax
je 0x1008aa4c
jmp 0x1008aa30
cmp esi, ebx
je 0x1008aa48
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov edx, edx
push esi
call edi
test eax, eax
jne 0x1008aa30
jmp 0x1008aa4c
mov ebx, ebp
push eax
pop eax
pop edi
pop esi
pop ebp
push 0
push 0
push 0x302
push ebx
call fcn.10052950
mov ecx, ecx
mov eax, 1
pop ebx
ret

Function at 0x1008b080
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push 5
push eax
call fcn.10052960
add esp, 8
mov bl, bl
test eax, eax
jne 0x1008b09c
add esp, 8
ret
push ebx
push ebp
push esi
push edi
push 0
push eax
call fcn.10052960
add esp, 8
mov esi, eax
mov dh, dh
push ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x14], eax
mov dh, dh
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1008b165
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], esi
mov ecx, ecx
push edi
push ebx
mov ecx, ebp
mov edx, esi
call fcn.1008aa70
add esp, 8
test eax, eax
je 0x1008b10c
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, esi
call fcn.1008aa70
add esp, 8
test eax, eax
jne 0x1008b16f
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push ebx
push ebp
push esi
call fcn.1008b080
add esp, 0x1c
push ecx
pop ecx
test eax, eax
jne 0x1008b167
push 2
push esi
call fcn.10052960
add esp, 8
mov esi, eax
push ecx
pop ecx
cmp dword [esp + 0x10], esi
je 0x1008b165
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, ecx
sub eax, dword [esp + 0x14]
cmp eax, dword [0x1019d8bc]
jae 0x1008b165
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1008b0d8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10091140
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x101611a3
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b23cc]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa78]
mov esi, dword [esp + 0xa80]
lea eax, [esp + 0x824]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov ecx, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x834], eax
mov dword [esp + 0x838], ecx
mov dword [esp + 0xa70], 1
mov edx, dword [esp + 0x834]
mov byte [edx], bl
mov dword [esp + 0xa70], 2
mov ah, ah
push ebx
pop ebx
push 0x800
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.100fcf90
add esp, 0xc
mov ah, ah
mov dword [esp + 0x18], ebx
mov ah, ah
push ecx
pop ecx
push 0x128
lea ecx, [esp + 0x840]
push ebx
push ecx
call fcn.100fcf90
add esp, 0xc
mov cl, cl
mov dword [esp + 0x83c], 0x128
push ebx
pop ebx
push ebx
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
mov cl, cl
cmp edi, 0xffffffff
jne 0x1009123c
lea edx, [esp + 0x824]
push edx
mov ecx, ebp
call fcn.10009650
mov dword [esp + 0x1c], 1
jmp 0x10091387
lea ecx, [esp + 0x14]
call fcn.1001d1b0
mov byte [esp + 0xa70], 3
mov dl, dl
cmp esi, ebx
jne 0x10091257
xor eax, eax
jmp 0x1009126b
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10091260
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.1002dc70
mov ah, ah
lea ecx, [esp + 0x14]
call fcn.100603f0
push eax
pop eax
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32First
push ebx
pop ebx
cmp eax, ebx
je 0x1009133d
jmp 0x100912a0
push ebx
pop ebx
xor eax, eax
jmp 0x100912b0
mov cl, byte [esp + eax + 0x860]
mov byte [esp + eax + 0x964], cl
add eax, 1
cmp cl, bl
jne 0x100912b0
mov ah, ah
lea ecx, [esp + 0x964]
push ecx
call fcn.100414c0
add esp, 4
mov ch, ch
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x964]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10091304
cmp dl, bl
je 0x10091300
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10091304
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100912e4
xor eax, eax
jmp 0x10091309
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10091325
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x844]
mov dword [esp + eax*4 + 0x24], edx
add eax, 1
mov dword [esp + 0x18], eax
mov ebx, ebx
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32Next
mov cl, cl
cmp eax, ebx
jne 0x100912a0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
pop eax
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x1009135f
lea ecx, [esp + 0x824]
push ecx
mov ecx, ebp
call fcn.10009650
jmp 0x1009136e
push eax
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.1008fab0
add esp, 0xc
mov dword [esp + 0x1c], 1
mov byte [esp + 0xa70], 2
lea ecx, [esp + 0x14]
call fcn.1001d220
mov byte [esp + 0xa70], bl
lea ecx, [esp + 0x824]
call fcn.10006900
mov eax, ebp
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.100fc49a
add esp, 0xa60
ret