joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b760
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1000b780
jl 0x1000b777
cmp dword [ebp + 0xc], 0
ja 0x1000b780
xor eax, eax
xor edx, edx
jmp 0x1000b8c2
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x1000b7a2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000c150
jmp 0x1000b8c2
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 8]
call fcn.1000ddf0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x1000b812
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10007e20
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.1000df50
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.100073f0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.1000ded0
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1000b8b3
mov ecx, dword [ebp - 8]
call fcn.1000da10
mov dword [ebp - 0x20], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x1000b882
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1019e292
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x1000b880
xor eax, eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
sbb edx, eax
mov eax, ecx
jmp 0x1000b8c2
jmp 0x1000b82e
cmp dword [ebp - 4], 0
jbe 0x1000b8b3
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1019e292
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100156c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x1001570a
lea edx, [ebp - 0x10c]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000c880
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x10015745
push 0x10208e1c
push 0x1023d9a0
call fcn.1000fe90
add esp, 8
mov dword [ebp - 8], eax
push 0x100101f0
mov ecx, dword [ebp - 8]
call fcn.1000c640
push 0x1020794e
mov ecx, dword [ebp + 8]
call fcn.1000c880
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x10021470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bb293
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x36
mov byte [ebp - 0x19], 0x35
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x15], 0x31
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x35
mov byte [ebp - 0xf], 0x36
mov byte [ebp - 0xe], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x70]
call fcn.1000c880
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x58]
call fcn.1000c880
mov byte [ebp - 4], 1
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.10006320
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.10006dd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.10006dd0
nop
push 1
push 1
lea edx, [ebp - 0x88]
push edx
lea ecx, [ebp - 0x160]
call fcn.10022ca0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.1000c9a0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.10023870
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 4]
call fcn.10014fb0
movzx ecx, al
test ecx, ecx
je 0x10021601
push 0
push 0x10209e9c
lea ecx, [ebp - 0x40]
call fcn.10023360
test eax, eax
jne 0x100215b9
push 0xffffffffffffffff
push 3
lea edx, [ebp - 0xa0]
push edx
lea ecx, [ebp - 0x40]
call fcn.100231f0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x1023e450
call fcn.1000fb20
lea ecx, [ebp - 0xa0]
call fcn.10006dd0
nop
jmp 0x100215fc
push 0
push str.Port
lea ecx, [ebp - 0x40]
call fcn.10023360
test eax, eax
jne 0x100215fc
push 0xffffffffffffffff
push 5
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.100231f0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
mov ecx, 0x1023e438
call fcn.1000fb20
lea ecx, [ebp - 0xb8]
call fcn.10006dd0
nop
jmp 0x10021543
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.10006dd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x160]
call fcn.10021640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.10006dd0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10021800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bae2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov byte [ebp - 0x20], 0x76
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x36
mov byte [ebp - 0x1d], 0x35
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x31
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x35
mov byte [ebp - 0x13], 0x36
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.1000c880
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.10006320
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, 0x1023e468
call fcn.1000fb20
lea ecx, [ebp - 0x50]
call fcn.10006dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10006dd0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100218c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x10209ea8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
push 0x10209eb8
push 0x10209edc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002197d
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1002197d
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
call fcn.1007427f
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.101918b0
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call fcn.10021470
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.1007427a
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10021a00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10021a23
xor al, al
jmp 0x10021ae0
mov dword [ebp - 0x250], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10191e30
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10021ad4
push 0
push 0
push 0x104
lea eax, [ebp - 0x354]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x22c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x24]
call fcn.1000c880
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100238c0
add esp, 8
mov byte [ebp - 1], al
lea ecx, [ebp - 0x24]
call fcn.10006dd0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x10021abf
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x10021ae0
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10021a58
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10021af0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bb2f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
lea eax, [ebp - 0x188]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x10021be8
lea ecx, [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x84]
call fcn.1000c880
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
push 0x10209ef4
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.1000fe50
add esp, 0xc
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.1001cdd0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
push 0x10209eec
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.1000fe50
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.10006dd0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.10006dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.10006dd0
nop
lea ecx, [ebp - 0x3c]
call fcn.10006d10
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
call fcn.10006dd0
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10031510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1003154f
call fcn.1003d497
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1003154f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10031557
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1010ac9a
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10031f61
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10031fed
cmp dword [esi + 0x20], 0
je 0x10031fed
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10031fed
cmp dword [ebp + 8], 0
je 0x10031fed
xor edi, edi
mov ebx, edi
call fcn.1003d497
push 0x101cf2b8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x10031fd1
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10031fed
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1010b720
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10031fe9
mov ecx, esi
call fcn.10031d0a
mov eax, edi
jmp 0x10031fef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10036a51
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101bc0fc
call fcn.1018ecb0
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x10036a77
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10036ad1
lea ecx, [ebp - 0x10]
call fcn.10003770
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.101a082a
push eax
call fcn.10002070
add esp, 0x14
test esi, esi
je 0x10036ac4
push esi
call fcn.1019f37f
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10002420
mov eax, ebx
call fcn.1018ec7e
ret 8
Function at 0x1004a36b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x1004a384
call fcn.1003d497
mov esi, dword [eax + 0xc]
push 0x101d1eec
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1004a3c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1004a3c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1004a3c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1004a3cf
jmp 0x1004a3c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1004dfea
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x1b8]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
mov ecx, dword [0x102335e0]
test al, 0x80
push 0xffffffffffffffff
pop eax
cmovne ecx, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x2b4]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
push dword [ebp - 4]
mov esi, eax
push 0x10233458
mov dword [ebp - 0xc], esi
call fcn.1003d016
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x1004e0ff
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1004e0ff
test ebx, ebx
je 0x1004e08f
mov eax, dword [ebx]
push 0
mov esi, dword [eax + 0x228]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, ebx
call esi
push eax
push 0x10233914
call fcn.1003d016
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x1004e091
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 2
jne 0x1004e108
test eax, eax
je 0x1004e0e1
mov eax, dword [edi]
mov esi, dword [eax + 0x1c0]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
test al, 0x40
je 0x1004e0ff
cmp dword [ebp - 4], 0
je 0x1004e0e1
mov ebx, dword [ebp - 8]
push edi
mov eax, dword [ebx]
mov esi, dword [eax + 0x24c]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, ebx
call esi
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, edi
jmp 0x1004e101
mov eax, dword [edi]
push 5
push 0
push ebx
mov esi, dword [eax + 0x1f8]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp esi, 3
jne 0x1004e0ff
test ebx, ebx
je 0x1004e0ff
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 0x184]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, ebx
call esi
test eax, eax
je 0x1004e0ff
mov eax, dword [edi]
mov esi, dword [eax + 0x18c]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
test eax, eax
je 0x1004e0ff
mov eax, dword [edi]
push 0
mov esi, dword [eax + 0x240]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0
push 1
push 5
mov esi, dword [eax + 0x34c]
mov ecx, esi
push ebx
call dword [0x101cdb00]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x1004e101
Function at 0x10050594
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x10050633
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x1005062f
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1005062f
cmp dword [ebx], eax
jne 0x1005062f
mov eax, dword [ebx + 4]
sub eax, 1
je 0x10050609
sub eax, 1
je 0x100505d9
sub eax, 1
jne 0x1005062f
mov edi, 0x428e
jmp 0x1005060e
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1005060e
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x1005060e
add edi, 3
jmp 0x1005060e
mov edi, 0x3ea0
push edi
mov ecx, 0x1023bb14
call fcn.100036f0
test eax, eax
je 0x10050633
mov eax, dword [0x1023bb14]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x10050628
call fcn.1003bca0
int3
Function at 0x1009bf18
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x1009c076
push esi
push edi
push 0x101d07b8
call fcn.1003d0b5
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x1009bfb1
mov edi, dword [ebx + 0x168]
jmp 0x1009bf9d
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009bf9d
push esi
call fcn.1003157d
push eax
push 0x1023374c
call fcn.1003d016
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x1009bf9d
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x1009bf9d
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x1009bf4c
lea ecx, [ebx + 0x164]
call fcn.1002e3d6
jmp 0x1009c074
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1009c074
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.10026fd1
mov edi, dword [eax]
test edi, edi
jne 0x1009bfdd
xor esi, esi
jmp 0x1009bfe0
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009c064
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1009c064
cmp dword [ebp - 0x10], 0
jne 0x1009c039
push edi
push 0x1023374c
call fcn.1003d016
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x101cdb00]
mov ecx, edi
call esi
push eax
push 0x101d3a50
call fcn.1003d016
pop ecx
pop ecx
test eax, eax
je 0x1009c064
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.1009b0b0
test eax, eax
jne 0x1009c064
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.10098f74
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x1009bfc8
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100b8f2a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x10234000]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100b8f89
cmp dword [ebp + 0xc], 0
mov edx, 0xc009
mov eax, 0x400b
cmove eax, edx
push eax
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [ebp - 0x2b4]
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1018ec70
leave
ret 8
call fcn.1003bca0
int3

Function at 0x100b8f8f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x10234000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], esi
test eax, eax
je 0x100b8ff9
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x100b8fde
lea eax, [ebp - 0x2ac]
push eax
jmp 0x100b8fe3
push 0x101ddb10
call fcn.10025db0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1018ec70
leave
ret 8
call fcn.1003bca0
int3

Function at 0x100b94d7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.1002e2a7
call fcn.1003d4eb
cmp dword [eax + 0x14], 0
jne 0x100b94f2
mov ecx, esi
pop esi
jmp fcn.100b8d3a
pop esi
ret

Function at 0x100bf944
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x101bccdb
call fcn.1018ecb0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.10025db0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x100bf9a6
call fcn.1003d4e5
cmp eax, 1
jne 0x100bf9a6
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1007d5d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1003749e
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.10002420
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x100bf9b8
call fcn.100bfca4
jmp 0x100bf9be
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.10002420
mov eax, esi
call fcn.1018ec7e
ret 0xc
Function at 0x100bfa6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x101bccdb
call fcn.1018ecb0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.10025db0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x100bfacd
call fcn.1003d4e5
cmp eax, 1
jne 0x100bfacd
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1007d5d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1003749e
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10002420
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.10002420
mov eax, esi
call fcn.1018ec7e
ret 0x10

Function at 0x100bfaf4
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x101bccdb
call fcn.1018ecb0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.10025db0
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x100bfb52
call fcn.1003d4e5
cmp eax, 1
jne 0x100bfb52
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1007d5d0
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1003749e
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.10002420
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.10002420
mov eax, esi
call fcn.1018ec7e
ret 0x14