joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d02c8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10246e44]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
push eax
call fcn.10001ea0
add esp, 4
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.10010310
add esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x1000d1f0
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0
lea ecx, [ebp - 0x14]
call fcn.10008e70
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
call fcn.101b5fa9
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x1000a791
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
push 6
call fcn.101a86ea
jmp 0x1000a799
lea ecx, [ebp - 0x14]
call fcn.10063b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10012190
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10060a40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10060a64
xor eax, eax
jmp 0x10060ae4
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10060a7b
xor eax, eax
jmp 0x10060ae4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10060ac7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10060ac7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10060a9e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10060ad3
xor eax, eax
jmp 0x10060ae4
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10060ae1
xor eax, eax
jmp 0x10060ae4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10069685
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x100696d8
push esi
push dword [ebp + 8]
call fcn.10069871
mov edi, eax
test edi, edi
je 0x100696d3
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100696d3
mov eax, dword [ebp - 8]
jmp 0x100696ea
mov eax, dword [ebp + 0x10]
jmp 0x100696ea
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
pop edi
pop esi
leave
ret 0xc

Function at 0x100696f0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d2340
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.101a6560
mov eax, dword [0x10246e44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edi
mov dword [ebp - 0x1024], eax
je 0x10069824
push 0
push edx
call fcn.10069871
mov ebx, eax
test ebx, ebx
jne 0x10069758
push esi
jmp 0x1006984c
call fcn.1006591e
push eax
lea ecx, [ebp - 0x1014]
call fcn.10009460
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x1024]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x101c], eax
test eax, eax
jne 0x100697e3
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.100176e0
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x1024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x101c], eax
call fcn.100270d0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x101c], 0
jne 0x10069811
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.100095b0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.100096e0
jmp 0x10069853
push esi
mov ecx, edi
call fcn.100105f0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x1006980a
test esi, esi
jne 0x1006982d
mov esi, 0x101e2362
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.100105f0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101a654a
leave
ret 0x10
Function at 0x1006afc5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
mov eax, ecx
push edi
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], esi
je 0x1006b00a
call fcn.10066a47
push 0xf0
push dword [ebp + 0xc]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1006b007
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1006b04f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
push ebx
xor ebx, ebx
inc ebx
test esi, esi
je 0x1006b02e
mov ecx, dword [eax]
push dword [ebp + 0x10]
push esi
mov esi, dword [ecx + 0x20]
mov ecx, esi
push edi
call dword [0x101e0a88]
mov ecx, dword [ebp - 4]
call esi
mov ebx, eax
mov edi, dword [edi + 0x70]
test edi, edi
je 0x1006b04c
mov edx, dword [edi]
push dword [ebp + 0x10]
mov esi, dword [edx + 0xa0]
mov ecx, esi
call dword [0x101e0a88]
mov ecx, edi
call esi
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0xc

Function at 0x1006d85d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.10074e46
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x1006d899
call fcn.1006db1c
mov dword [esi + 0xc], 1
jmp 0x1006d89e
call fcn.1006db1c
cmp dword [esi], 0
je 0x1006d8e7
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x1006d8c1
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.1006b7d6
jmp 0x1006d8d2
push 0xff
mov ecx, esi
call fcn.100176e0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, esi
call fcn.100270d0
jmp 0x1006d90b
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x1006d90b
push dword [esi]
push dword [ebp - 4]
call fcn.1007bd15
pop esi
leave
ret 0xc

Function at 0x1006da73
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.1006db1c
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x1006dabb
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1006b7d6
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100270d0
jmp 0x1006dac6
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1007bd15
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1006fd8a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x1006fdc9
call fcn.10066a47
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1006fdc9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1006fdd1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.1008af5a
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100707c7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10070853
cmp dword [esi + 0x20], 0
je 0x10070853
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10070853
cmp dword [ebp + 8], 0
je 0x10070853
xor edi, edi
mov ebx, edi
call fcn.10066a47
push 0x101f1940
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
test eax, eax
je 0x10070837
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10070853
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.1008ba2f
mov edi, eax
add esp, 0xc
test edi, edi
je 0x1007084f
mov ecx, esi
call fcn.10070569
mov eax, edi
jmp 0x10070855
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10075269
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101d229a
call fcn.101a72dc
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x1007528f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x100752ef
call fcn.1006591e
push eax
lea ecx, [ebp - 0x10]
call fcn.10009460
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101e0a88]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.101b6d00
push eax
call fcn.100644a3
add esp, 0x14
test esi, esi
je 0x100752e2
push esi
call fcn.101b6d90
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.100096e0
mov eax, ebx
call fcn.101a72a5
ret 8
Function at 0x10075b1f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x10075b4a
cmp dword [edi + 0x80], 0
jne 0x10075b4a
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.10066a47
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.10075dbe
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10075b77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.10066a47
push 5
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10075baa
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.10075bbd
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10077999
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x101d29f6
call fcn.101a7347
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x10077aa3
cmp ebx, dword [esi + 0xc]
jge 0x10077aa3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x100779f0
cmp ebx, dword [edi + 8]
jl 0x10077a91
cmp dword [ebp + 0xc], 0
je 0x10077a91
xor ebx, ebx
jmp 0x10077a2a
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call fcn.100773f7
mov edi, eax
test edi, edi
je 0x10077a0a
mov dword [edi], vtable.CThreadData.0
jmp 0x10077a0c
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x14]
push edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.100778c5
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x14], edi
mov esi, dword [ebp - 0x14]
cmp dword [edi + 0xc], ebx
jne 0x10077a45
push 4
push dword [esi + 0xc]
call fcn.1006576d
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x10077a5d
push 2
push 4
push dword [esi + 0xc]
call fcn.1006576d
pop ecx
pop ecx
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x10077aca
mov ecx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push ebx
push eax
call fcn.101ab4e0
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10077aa3
cmp ebx, dword [edi + 8]
jge 0x10077aa3
mov eax, dword [ebp + 0xc]
mov dword [ecx + ebx*4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.101a72a5
ret 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.100644e7
int3
Function at 0x1008d4a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x1008d4f7
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1008d4d0
call fcn.1006ca32
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x1008d4e5
call fcn.1006ca32
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x1008d4f7
call fcn.1006ca32
call fcn.10066a47
cmp dword [eax + 0x3c], 0
je 0x1008d50c
push edi
mov ecx, ebx
call fcn.1008cbd1
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.1008d6de
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x1008d535
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x1008d541
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100a704f
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10246e44]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x128
xor edi, edi
push edi
push esi
call fcn.101ab4e0
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.101b6d00
push eax
call fcn.100644a3
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x101f47cc]
je 0x100a71b9
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x100a71cd
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100a71cd
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
jne 0x100a70e8
mov eax, edi
jmp 0x100a7117
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x100a7105
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.100a6df2
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x28]
jmp 0x100a710e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.1006c012
test eax, eax
je 0x100a713c
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.1006b82e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x100a7140
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.1006c012
test eax, eax
je 0x100a7167
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.1006b82e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x100a716b
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.1006c012
test eax, eax
je 0x100a7193
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.1006b82e
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x100a7195
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x100a71a7
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x100a71b9
mov eax, edi
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101a654a
leave
ret 4
xor eax, eax
jmp 0x100a71bc
Function at 0x100abfcf
Capabilities:
Get file system object information

Disassembly:
push 0x394
mov eax, 0x101d498c
call fcn.101a7310
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x3a0], edi
test ecx, ecx
je 0x100ac166
mov eax, dword [ebp + 0x10]
xor esi, esi
sub eax, esi
je 0x100ac138
sub eax, 1
je 0x100ac04e
sub eax, 1
je 0x100ac026
sub eax, 1
je 0x100ac04e
push 0x101e2362
mov ecx, edi
call fcn.100105f0
mov eax, edi
call fcn.101a72ba
ret 0x10
push 0x408
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x100ac010
lea eax, [ebp - 0x28c]
push eax
jmp 0x100ac015
lea eax, [ebp - 0x114]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x100ac010
push esi
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x238], esi
push eax
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov dword [ebp - 0x228], esi
call fcn.100a71d1
test eax, eax
je 0x100ac010
call fcn.1006591e
push eax
lea ecx, [ebp - 0x3a0]
call fcn.10009460
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x100ac0ee
test byte [ebp - 0x21c], 0x18
jne 0x100ac110
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
push dword [ebp - 0x220]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x224]
call dword [0x101e0a88]
mov ecx, ebx
call esi
jmp 0x100ac110
mov eax, dword [ebx]
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x234]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x101e0a88]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x3a0]
add eax, 0xfffffff0
push eax
call fcn.100095b0
pop ecx
mov ecx, dword [ebp - 0x3a0]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.100096e0
jmp 0x100ac01c
push 0x208
push 0x160
lea eax, [ebp - 0x39c]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x100ac010
lea eax, [ebp - 0x390]
jmp 0x100ac04b
call fcn.100644cd
int3

Function at 0x100ac2f9
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10130ed4
call fcn.10066a9b
cmp dword [eax + 0x14], 0
jne 0x100ac314
mov ecx, esi
pop esi
jmp fcn.100ab5f6
pop esi
ret

Function at 0x100b3358
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x100b3371
call fcn.10066a47
mov esi, dword [eax + 0xc]
push 0x101f8bf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x100b33b3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100b33b3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x100b33b3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.100b33bc
jmp 0x100b33b5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100cc7b8
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10246e44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x100cc7e7
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x100cc814
cmp dword [0x1024dee4], 0
jne 0x100cc814
lea eax, [esi - 0x41]
cmp eax, 0x19
jbe 0x100cc810
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x100cc810
push esi
call fcn.101ad223
pop ecx
jmp 0x100cc881
mov eax, esi
jmp 0x100cc881
xor eax, eax
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
call fcn.10067469
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov al, byte [ebp - 0x10c]
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x107], 0
call dword [sym.imp.USER32.dll_CharUpperA]
movsx eax, byte [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101a654a
leave
ret 4