joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003f88
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x100648d9
call fcn.100641f8
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x24], 0x749a
xor esi, esi
cmp dword [ebp - 0x24], 0x772a
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ebx
jle 0x1000402a
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x18], edi
mov ecx, ebx
mov eax, esi
shl edi, cl
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], esi
mov ecx, eax
mov esi, edi
mov edi, dword [ebp - 0x28]
sar esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10081de8
cdq
push edx
push eax
call fcn.1000d012
inc edi
cmp edi, 0x4428
jl 0x10003fd7
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x1c], eax
push 0
pop esi
cmp eax, 0x5174
jl 0x10003fcb
mov edi, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x656f
jl 0x10003fbc
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x3cde
jl 0x10003fba
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ebx, dword [ebp - 0x2c]
cmp byte [ebp - 0x14], 0
je 0x100040eb
mov edi, dword [ebp + 0x1c]
mov dword [edi], esi
jmp 0x100040e0
mov dword [ebp - 0x18], 0x6887e08a
mov dword [ebp - 0x2c], 0x52275dd3
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], esi
jne 0x100040bf
cmp dword [ebp - 0x18], esi
je 0x100040bd
mov eax, dword [edi]
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 9
jg 0x1000406f
cmp dword [edi], esi
je 0x1000406f
xor ecx, ecx
inc ecx
jmp 0x10004071
mov ecx, esi
mov eax, dword [edi]
add eax, ecx
cmp eax, 0x3e01
jge 0x10004089
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], esi
jne 0x10004089
mov edx, esi
jmp 0x1000408c
xor edx, edx
inc edx
mov eax, dword [ebx]
xor ecx, ecx
cmp dword [eax], edx
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x10]
setle dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp - 0x18]
mov eax, dword [edi]
mov eax, dword [edi]
mov edx, dword [edi]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
mov eax, dword [eax]
add eax, dword [ecx + edx*4]
je 0x100040d9
cmp dword [ebp - 0x18], esi
je 0x100040d9
xor eax, eax
inc eax
jmp 0x100040db
mov eax, esi
mov dword [ebp - 0x2c], eax
inc dword [edi]
cmp dword [edi], 1
jle 0x1000403e
jmp 0x100040f4
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x260417be
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x7145
jge 0x1000410f
mov edx, str.alvymr_uoxel_qthe_aitsd_irh
mov ecx, 0x10081de8
call fcn.1000ff9e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004a66
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x14], ebx
mov edi, ecx
je 0x10004b1f
mov dword [esp + 0x10], 0x4ff2
cmp dword [esp + 0x10], 0x50e0
jle 0x10004af8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0xc], 0xff4
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004ac6
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000205a
add ebx, esi
dec dword [esp + 0xc]
jne 0x10004aaa
inc esi
cmp esi, 0x196b
jl 0x10004aa0
inc edi
cmp edi, 0x7a87
jl 0x10004a9e
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x4ca3
jge 0x10004b0d
push str.sddphefc_goablq_xxqgkyws_geiyowav_mpljbdfs_dda_fxx_pohaxq_zjnx_ykpqco_hmlxgzp_qgggqfnho_ueh
call fcn.1004c39e
pop ecx
cmp byte [ebx], 0
je 0x10004b7e
push 0xd2c
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x10004b7e
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x1c]
mov ecx, dword [ebx]
mov eax, dword [esi]
mov eax, dword [eax + ecx*4]
neg eax
cmp eax, dword [edi]
jle 0x10004b58
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [edi], eax
mov edx, dword [ebx]
cmp dword [edi], 0xedad94e8
mov eax, dword [esi]
sbb ecx, ecx
add ecx, 0xffff0cb6
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [eax + edx*4]
jne 0x10004b58
xor edi, edi
jmp 0x10004b5b
xor edi, edi
inc edi
mov edx, dword [ebx]
mov ecx, dword [esi]
mov esi, dword [ebp + 0x20]
mov eax, dword [esi]
add eax, dword [ecx + edx*4]
lea ecx, [eax + edi]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
inc dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100066ff
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
je 0x1000671f
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x23edb395
jmp 0x1000686d
mov dword [ebp - 0xc], 0x6f7b
cmp dword [ebp - 0xc], 0x701b
jle 0x100067c9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor edi, edi
mov dword [ebp - 8], edi
xor esi, esi
mov dword [ebp - 4], esi
mov eax, edi
xor ebx, ebx
cdq
idiv esi
mov esi, edx
xor edi, edi
lea eax, [edi + ebx]
and eax, esi
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006771
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000205a
inc edi
cmp edi, 0x2042
jl 0x10006757
inc ebx
cmp ebx, 0x1b74
jl 0x10006755
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x53d5
jl 0x1000674c
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x42fb
jl 0x10006747
push 0
push 0xf3e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], 0x2d9e
cmp dword [ebp - 8], 0x3122
jle 0x1000683d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor esi, esi
mov edi, esi
mov ebx, 0x50a6
mov eax, edi
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006808
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1000205a
dec edi
dec ebx
jne 0x100067f1
inc esi
cmp esi, 0xb73
jl 0x100067ea
push 1
push ebx
push 0x1985
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
cmp dword [ebp - 8], 0x2c28
jge 0x10006851
push str.zyx_sapje_jkgbm
call fcn.1004c39e
pop ecx
cmp dword [ebp - 0xc], 0x6dfe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [ecx], eax
jge 0x1000686d
push str.hptndseih_bbgstjbm_roeftign_sztdma_gbxnjv
call fcn.1004c39e
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007d53
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10064a33
call fcn.100641f8
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x1c], 0x2e8c
cmp dword [ebp - 0x1c], 0x3175
push edi
mov dword [ebp - 0x10], esp
jle 0x10007dc4
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, 0x7068
xor edi, edi
mov dword [ebp - 0x14], ebx
mov esi, edi
mov ebx, 0x44b7
mov eax, esi
mov ecx, 0x10081de8
cdq
push edx
push eax
call fcn.1000d012
dec esi
dec ebx
jne 0x10007d9b
mov esi, dword [ebp - 0x18]
add edi, esi
dec dword [ebp - 0x14]
jne 0x10007d94
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x31d9
jl 0x10007d8a
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2cb6
jge 0x10007de0
mov edx, str.qitsfj_lgdwonx_ozjlthe_cgf_vqgmnnpfq_yqdjl_gfaqlmtlq
mov ecx, 0x10081de8
call fcn.1000ff9e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10007e84
mov dword [ebp - 0x1c], 0x2422
cmp dword [ebp - 0x1c], 0x27b6
jle 0x10007e3f
xor esi, esi
xor edi, edi
mov ebx, 0x25f7
mov eax, edi
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007e1e
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000205a
add edi, esi
dec ebx
jne 0x10007e07
inc esi
cmp esi, 0x2f48
jl 0x10007e00
cmp dword [ebp - 0x1c], 0x2412
jge 0x10007e53
push str.uri_jczc_ygfad_blm_peu_xoz_nogpzenae
call fcn.1004c39e
pop ecx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10007e8d
push 0x26aa
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10007e8d
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x260417be
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100080ec
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 4], dl
push ebx
push esi
push edi
test cl, cl
je 0x10008206
cmp byte [ebp + 8], 0
je 0x100081e1
mov dword [ebp - 0x14], 0x4a0e
cmp dword [ebp - 0x14], 0x4c3e
jle 0x100081b0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0xc], edi
xor ebx, ebx
mov eax, edi
and eax, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
mov esi, eax
mov edi, ebx
mov ebx, 0x12be
mov eax, edi
lea ecx, [ebp - 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000816c
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000205a
dec edi
dec ebx
jne 0x10008153
mov ebx, dword [ebp - 8]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, 0x1fff
jl 0x1000814c
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x735b
jl 0x1000813e
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x7a26
jl 0x10008139
cmp dword [ebp - 0x14], 0x4826
jge 0x100081c4
push str.urxj_lqblmkl_dudsp_tzwhh_exxx_njxpnw_fubw_yubpkly_keyb_zilud
call fcn.1004c39e
pop ecx
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10008241
push 0x71ff
push 1
mov ecx, 0x63f9
call fcn.10008432
pop ecx
pop ecx
jmp 0x10008241
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10008241
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x28ec7df
inc dword [edx]
cmp dword [edx], 1
jl 0x100081f2
jmp 0x10008241
test dl, dl
je 0x1000821e
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10008241
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10008241
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xeac8
inc dword [edx]
cmp dword [edx], 2
jl 0x1000822f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008273
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp byte [ebp + 0x20], 0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 0x20], ecx
push edi
mov dword [ebp - 0x1c], ebx
je 0x1000840e
cmp byte [ebp + 0x18], 0
push 0
pop esi
je 0x1000831e
mov dword [ebp + 0x20], 0x76ba
cmp dword [ebp + 0x20], 0x7766
jle 0x100082f7
push 0x74b
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
cdq
lea ecx, [ebp - 0x38]
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100082d3
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.1000205a
inc ebx
cmp ebx, 0x6f09
jl 0x100082bb
inc edi
cmp edi, 0x3038
jl 0x100082b9
push esi
push esi
push esi
push esi
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp dword [ebp + 0x20], 0x75c1
jge 0x1000842b
push str.memiqh_peezoqlxn_sydahwatk_jbn
call fcn.1004c39e
pop ecx
jmp 0x1000842b
mov dword [ebp - 0x14], 0x1426
cmp dword [ebp - 0x14], 0x1690
jle 0x100083b3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov dword [ebp - 0x10], esi
mov dword [ebp + 0x20], esi
mov dword [ebp - 0xc], 0x1d5e
mov edi, dword [ebp + 0x20]
mov ebx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0x20fc
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x50]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10008372
mov eax, dword [eax]
push eax
call fcn.1004c39e
pop ecx
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.1000205a
dec ebx
dec dword [ebp - 4]
jne 0x10008357
mov ebx, dword [ebp - 8]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, 0x59d8
jl 0x1000834d
mov edi, dword [ebp - 0x10]
add dword [ebp + 0x20], edi
dec dword [ebp - 0xc]
jne 0x10008345
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0xf4a
jl 0x1000833b
mov ebx, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], 0x129f
jge 0x100083c7
push str.zowah_mrsh_pjqjqp_xtzhut_gxaxvy_yqazd_njcdvay_kzhzdpch_fwdl
call fcn.1004c39e
pop ecx
mov eax, dword [ebp + 0x28]
mov edi, dword [ebp + 0x24]
mov eax, dword [eax]
cmp dword [eax], esi
jne 0x100083d5
mov eax, dword [edi]
mov ecx, dword [ebx]
xor edx, edx
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [ebp + 8]
setl dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
setne cl
cmp ecx, dword [edi]
jne 0x100083f2
mov eax, dword [ebx]
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov dword [eax], esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
mov eax, dword [edx]
test eax, eax
setg cl
neg ecx
mov dword [edx], ecx
jmp 0x1000842b
cmp byte [ebp + 0x14], 0
je 0x10008423
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x1000842b
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100132f5
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10064f49
call fcn.100641f8
sub esp, 0x24
push ebx
push esi
mov byte [ebp - 0x14], cl
mov eax, edx
mov dword [ebp - 0x24], 0x711b
cmp dword [ebp - 0x24], 0x71b9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], eax
jle 0x10013385
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
and dword [ebp - 0x28], 0
mov eax, edi
cdq
idiv ebx
mov edi, dword [ebp - 0x28]
mov eax, edx
mov dword [ebp - 0x18], eax
xor ebx, ebx
lea ecx, [ebx + edi]
sar eax, cl
mov ecx, 0x10081de8
cdq
push edx
push eax
call fcn.1000d012
mov eax, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x899
jl 0x1001333d
inc edi
cmp edi, 0x760e
jl 0x1001333b
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x4ca5
jl 0x1001332a
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x494a
jl 0x10013325
mov eax, dword [ebp - 0x2c]
cmp byte [ebp - 0x14], 0
je 0x10013423
mov dword [ebp - 0x20], 0x329
cmp dword [ebp - 0x20], 0x6a1
jle 0x100133de
push 0
push 0
push 0x23ef
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10081de8
cdq
push edx
push eax
call fcn.1000d012
inc ebx
cmp ebx, 0x5e36
jl 0x100133b9
inc edi
cmp edi, 0x37d8
jl 0x100133b7
push 0x26aa
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2e4
jge 0x10013407
mov edx, str.wgnvqcmpr_vrzcs_wvotl_iksuchk_wxjsuohu_edmmkxa_equuuzbjh
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x10013429
mov dword [eax], 0x23edb395
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x7036
jge 0x10013448
mov edx, str.mblqf_ojz_lvvlqqgn_rackktqu_imkcn_rfclmc_mngwcfgwb_snjvvizh_uecjkhn_fccu_wqwv_ogoaiq
mov ecx, 0x10081de8
call fcn.1000ff9e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10013bb3
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
test dl, dl
je 0x10013be8
cmp byte [ebp + 0x10], 0
je 0x10013bca
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
add dword [eax], ecx
jmp 0x10013c26
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10013c26
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10013c26
cmp byte [ebp + 0xc], 0
je 0x10013bf9
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x260417be
jmp 0x10013c26
push 0x1d01
push 0x2105
push 0xaa1
push 0x860
push 0x1cb1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov esp, ebp
pop ebp
ret
Function at 0x1002b2c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065581
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002b378
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002b328
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov byte [eax], 1
jmp 0x1002b373
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1002b356
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x1002b373
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10001da4
mov dword [eax], 0xae5a
jmp 0x1002b34b
jmp 0x1002b459
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], 0x3e59
mov dword [ebp - 0x50], str.bwputsc_iafquyg_xtitdoxz_aowpofret_jhgiom_xbcwqc_llccc_iookrpwz
cmp dword [ebp - 0x20], 0x402e
jle 0x1002b406
and dword [ebp - 0x18], 0
jmp 0x1002b3a2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x232f
jge 0x1002b3fe
and dword [ebp - 0x1c], 0
jmp 0x1002b3b8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6cf7
jge 0x1002b3fc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.10001a6a
pop ecx
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.10001c08
push eax
call fcn.1004c39e
pop ecx
lea ecx, [ebp - 0x70]
call fcn.10001bea
jmp 0x1002b3b1
jmp 0x1002b39b
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0x11f3
push 0x2176
push dword [ebp - 0x4c]
call fcn.10017044
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3cd1
jge 0x1002b433
push dword [ebp - 0x50]
call fcn.1004c39e
pop ecx
jmp 0x1002b44f
or dword [ebp - 4], 0xffffffff
jmp 0x1002b459
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034144
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100658a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100341b2
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003419b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x64a6847d
jmp 0x100341ad
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10034298
lea eax, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x1c], 0x6eb7
mov dword [ebp - 0x40], str.oyveit_qyrla_opj_ndhlkgo_vyugihpah_cze
cmp dword [ebp - 0x1c], 0x70b3
jle 0x1003423e
and dword [ebp - 0x14], 0
jmp 0x100341ee
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5889
jge 0x1003422f
and dword [ebp - 0x18], 0
jmp 0x10034204
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2060
jge 0x1003422d
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10081de8
call fcn.1000d012
jmp 0x100341fd
jmp 0x100341e7
push 0
push 0
push 0x1925
call dword [sym.imp.ADVAPI32.dll_CopySid]
push dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
push dword [eax]
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
push dword [eax]
push 1
call fcn.10031683
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6c84
jge 0x10034272
mov edx, dword [ebp - 0x40]
mov ecx, 0x10081de8
call fcn.1000ff9e
jmp 0x1003428e
or dword [ebp - 4], 0xffffffff
jmp 0x10034298
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034a3c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10034a8d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10034a79
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10034a8b
push 0
push 0x910
push 0x15ab
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x10034ac4
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.100312bf
add esp, 0x18
mov esp, ebp
pop ebp
ret