joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002130
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x100191a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.10014e60
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x1001a944
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.10018d16
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x10002197
push 0x64
push ebx
push 8
mov ecx, eax
call fcn.100017a0
jmp 0x10002199
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x10011ea0
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.1000bec0
push 1
push ebx
push ebx
push esi
push 0x10008ea0
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.1000bec0
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10002680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x100026c1
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x100026b5
cmp bl, 0x41
jl 0x100026b5
add bl, 0x20
cmp bl, bh
jne 0x10002694
inc esi
inc esi
inc edi
test bx, bx
jne 0x100026a3
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10003350
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.10010220
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x10003385
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x1002421c]
xor eax, edx
inc ecx
dec esi
jne 0x10003366
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100033a1
push esi
push 0x10022d44
push eax
call dword [0x1001a4b0]
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x10003ba0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x24c
push esi
mov dword [esp + 4], 0
call fcn.100058e0
mov esi, eax
test esi, esi
jne 0x10003bc2
pop esi
add esp, 0x24c
ret
lea eax, [esp + 0x20]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x128]
push ecx
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x194]
push eax
push ecx
push esi
push 0
mov dword [esp + 0x30], 0x64
mov dword [esp + 0x2c], 0xc8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x10003c4c
push 0x1002193c
call dword [0x1001a144]
push 0x10021924
push eax
call dword [0x1001a140]
test eax, eax
je 0x10003c4c
lea edx, [esp + 0xc]
lea ecx, [esp + 0x188]
push edx
push ecx
call eax
test eax, eax
je 0x10003c4c
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
push edx
push eax
push 0x80000003
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, dword [esp + 0xc]
push ecx
call dword [0x1001a13c]
push esi
call fcn.10018d10
mov eax, dword [esp + 8]
add esp, 4
test eax, eax
jne 0x10003d28
push ebx
lea edx, [esp + 0x1c]
push edi
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edx
push esi
push esi
lea eax, [esp + 0x1c]
push esi
lea ecx, [esp + 0x3c]
push eax
push ecx
push esi
push 0x80000003
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
je 0x10003d26
mov ebx, dword [0x1001a390]
test eax, eax
jne 0x10003cf5
push 9
lea edx, [esp + 0x30]
push 0x10021918
push edx
call ebx
add esp, 0xc
test eax, eax
jne 0x10003cf5
push 3
lea eax, [esp + 0x30]
push 0x10021914
push eax
call dword [0x1001a2f8]
lea ecx, [esp + 0x34]
sub ecx, 3
add eax, ecx
push eax
call ebx
add esp, 0xc
test eax, eax
jne 0x10003cf5
lea edx, [esp + 0xc]
lea eax, [esp + 0x2c]
push edx
push eax
push 0x80000003
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x10003d26
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push 0
push 0
push 0
lea eax, [esp + 0x3c]
inc esi
push edx
push eax
push esi
push 0x80000003
mov dword [esp + 0x30], 0xff
call edi
cmp eax, 0x103
jne 0x10003c9e
pop edi
pop ebx
mov eax, dword [esp + 4]
pop esi
add esp, 0x24c
ret

Function at 0x10004150
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x10004160
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x1000417c
cmp al, 0x2b
jne 0x1000417c
mov al, 1
ret
xor al, al
ret
Function at 0x10004b50
Capabilities:
Create process on windows
Create thread
Query or enumerate registry key

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
test eax, eax
push edi
mov dword [esp + 0x10], 0x10021aa8
mov dword [esp + 0x14], 0x10021a9c
mov dword [esp + 0x18], 0x10021a94
jbe 0x10004b7c
lea ebx, [eax - 1]
jmp 0x10004b7e
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
lea edi, [esp + ebx*4 + 0x10]
test eax, eax
jbe 0x10004b8f
dec eax
jmp 0x10004b94
mov eax, 2
cmp ebx, eax
ja 0x10004bbf
mov eax, dword [edi]
push eax
push 0
call ebp
mov esi, eax
test esi, esi
je 0x10004bb5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov eax, dword [esp + 0x20]
inc ebx
add edi, 4
jmp 0x10004b88
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x100055f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push 0x400
mov dword [esp + 0x20], ecx
push 0x40
mov dword [esp + 0x14], 0xff
call dword [0x1001a154]
mov esi, dword [esp + 0x130]
mov ebp, eax
push esi
lea eax, [ebp + 2]
mov byte [ebp], 0x8f
push eax
mov byte [ebp + 1], 0xa
call dword [0x1001a148]
push esi
call dword [0x1001a2f8]
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov ecx, dword [esp + 0x130]
push 0
push 0
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x38]
push edx
push eax
push 0
push ecx
add ebx, 3
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0x103
je 0x10005758
push edi
test eax, eax
jne 0x10005717
push ebp
call dword [0x1001a150]
mov edx, dword [esp + 0x10]
lea ecx, [ebx + edx + 2]
cmp ecx, eax
jbe 0x100056a0
lea edx, [ebx + 0x400]
push 0x42
push edx
push ebp
call dword [0x1001a14c]
mov ebp, eax
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x2c]
mov eax, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0x34]
push 0
lea ebx, [ebx + ecx + 1]
mov ecx, dword [esp + 0x13c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10005716
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x34]
push eax
push edx
push eax
push eax
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1000570b
mov byte [ebx + ebp], 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
inc ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x3c]
inc eax
push ecx
push edx
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x14c]
push eax
mov dword [esp + 0x30], 0xff
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0x103
jne 0x10005673
pop edi
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
call fcn.10001360
push ebp
call dword [0x1001a13c]
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 8
Function at 0x10005c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.10003fb0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x10005ca4
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x10005c73
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10006690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001a8f8
push 0x10018d1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x10006715
test esi, esi
je 0x10006780
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10006780
cmp dword [ebp - 0x134], 1
je 0x1000674f
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10006780
push 0x320
call dword [0x1001a2fc]
push ebx
mov edx, dword [str.___0___f_b_t]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x1001a4b0]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x53c]
push ecx
push 0x80000002
call dword [0x1001a400]
mov dword [ebp - 4], 0xffffffff
call fcn.100067a9
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008f80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001a920
push 0x10018d1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xbe037055
xor esi, esi
push esi
call fcn.100012b0
add esp, 8
cmp eax, esi
jne 0x10008fd0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
push eax
push esi
push 0x400
call dword [0x1001a308]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
je 0x100090b0
lea eax, [ebp - 0x30]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x100090b0
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x38]
push ecx
push esi
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
test eax, eax
jbe 0x100090b0
push eax
call fcn.10018d16
add esp, 4
mov esi, eax
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x100090b0
mov dword [ebp - 0x140], 0x104
mov dword [ebp - 0x144], 0x100
push 0x100
call fcn.10018d16
add esp, 4
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x144]
push edx
push eax
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call 0x100090c2
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
test ebx, ebx
je 0x100090cd
push ebx
call dword [0x1001a11c]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x100090db
push eax
call dword [0x1001a11c]
test esi, esi
je 0x100090e8
push esi
call fcn.10018d10
add esp, 4
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a6d0
Capabilities:
Terminate thread

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
cmp ebx, esi
je 0x1000a836
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x1001a328]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.10018d16
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x1000a806
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x1000a7f2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x1001a31c]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.10001160
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x1000a7a6
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.10001360
mov eax, dword [esp + 0x28]
push eax
call dword [0x1001a324]
push ebp
call fcn.10018d10
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x1000dd40
Capabilities:
Delete registry key
Query service configuration

Disassembly:
sub esp, 0x490
or ecx, 0xffffffff
xor eax, eax
push esi
mov esi, dword [esp + 0x498]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000debe
mov ecx, 0xff
lea edi, [esp + 0x99]
mov byte [esp + 0x98], al
mov dword [esp + 0xc], 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x10021a38
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x1000debe
lea ecx, [esp + 0xc]
lea edx, [esp + 0x98]
push ecx
push edx
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [esp + 0x98]
push edx
call dword [0x1001a2f8]
test eax, eax
je 0x1000debe
lea eax, [esp + 0x98]
push 0x10021a34
push eax
call dword [0x1001a350]
add esp, 8
test eax, eax
je 0x1000debe
push esi
push eax
call dword [0x1001a148]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4a0]
mov dword [esp + 0x54], 0x44
test eax, eax
mov dword [esp + 0x80], 1
mov word [esp + 0x84], ax
je 0x1000de80
mov ecx, dword [0x10021a2c]
mov dl, byte [0x10021a30]
mov dword [esp + 0x20], ecx
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], dl
mov esi, dword [0x1001a12c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x10021a24
push eax
call esi
lea ecx, [esp + 0x20]
push 0x10021a1c
push ecx
call esi
lea edx, [esp + 0x20]
mov dword [esp + 0x5c], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb4]
push 0
push edx
push 0
call dword [0x1001a160]
test eax, eax
je 0x1000debe
mov eax, dword [esp + 0x14]
mov esi, dword [0x1001a11c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
xor al, al
pop esi
add esp, 0x490
ret

Function at 0x1000e0f0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100191b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x1001a944
mov edi, dword [0x1001a118]
lea eax, [esi + 0x18]
push 0
push eax
mov dword [esp + 0x1c], 0
call edi
lea ecx, [esi + 0x10]
push 0
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov edi, dword [0x1001a120]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esi + 0x30]
push 0xffffffffffffffff
push eax
call edi
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x1001a11c]
push ecx
call edi
mov edx, dword [esi + 0x30]
push edx
call edi
mov ecx, dword [esi + 0x34]
test ecx, ecx
je 0x1000e167
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.10011510
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x1000e870
Capabilities:
Enumerate devices by category

Disassembly:
push 0xffffffffffffffff
push 0x1001942b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x828
lea eax, [esp + 0x14]
push ebp
push eax
xor ebp, ebp
push 0x1001df58
push 1
push ebp
push 0x1001dfe8
mov byte [esp + 0x1b], 0
call dword [0x1001a5d8]
cmp eax, ebp
je 0x1000e8c7
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov dword [esp + 8], ebp
mov eax, dword [esp + 0x18]
lea edx, [esp + 8]
push ebp
push edx
mov ecx, dword [eax]
push 0x1001dfd8
push eax
mov dword [esp + 0x844], ebp
call dword [ecx + 0xc]
cmp eax, ebp
je 0x1000e91c
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
cmp eax, ebp
je 0x1000e904
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor al, al
pop ebp
mov ecx, dword [esp + 0x828]
mov dword fs:[0], ecx
add esp, 0x834
ret
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0xc]
cmp eax, ebp
jne 0x1000ea2f
push ebx
mov ebx, dword [0x1001a2a4]
push esi
mov esi, dword [esp + 0x844]
push edi
mov edi, dword [0x1001a2f8]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0x1001aa20
mov ecx, dword [eax]
push 0
push 0
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x1000ea04
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push 0
mov word [esp + 0x2c], 8
mov ecx, dword [eax]
push edx
push 0x10022fa0
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x1000e9fa
mov eax, dword [esp + 0x30]
push eax
call dword [0x1001a374]
add esp, 4
test eax, eax
jbe 0x1000e9fa
test esi, esi
je 0x1000e9f6
mov edx, dword [esp + 0x30]
push 0
push 0
lea ecx, [esp + 0x40]
push 0x800
push ecx
push 0xffffffffffffffff
push edx
push 0
push 0
call ebx
lea eax, [esp + 0x38]
push 0x64
push eax
push esi
call dword [0x1001a31c]
add esp, 0xc
push esi
call edi
push esi
lea ebp, [eax + ebp + 1]
call edi
mov ecx, dword [esp + 0x30]
lea esi, [esi + eax + 1]
push ecx
call dword [0x1001a3d0]
inc byte [esp + 0x13]
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x1000e95a
pop edi
pop esi
pop ebx
mov eax, dword [esp + 0x840]
test eax, eax
je 0x1000ea3c
mov dword [eax], ebp
mov eax, dword [esp + 8]
mov dword [esp + 0x834], 0xffffffff
test eax, eax
je 0x1000ea55
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x82c]
mov al, byte [esp + 7]
pop ebp
mov dword fs:[0], ecx
add esp, 0x834
ret
Function at 0x1000fbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x1000fccd
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x1000fc6b
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x1000fc89
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.10009100
add esp, 4
push eax
push edi
call fcn.10003350
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x1000fc56
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x1000fc13
jmp 0x1000fc89
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x1000fc89
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x1000fccd
cmp eax, ecx
jb 0x1000fccd
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x1000fccf
cmp eax, esi
jb 0x1000fccf
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x1000fccf
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x1000fccd
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x1000fcda
cmp byte [esi], 0
jne 0x1000fcbd
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x1000fccd
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.1000b3c0
add esp, 4
lea eax, [esp + 0x20]
push eax
call fcn.10002680
push 0
push esi
mov edi, eax
call fcn.10009100
add esp, 4
push eax
push esi
call fcn.10003350
and eax, 0x7fffffff
push eax
push edi
call fcn.1000fbc0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret

Function at 0x1000ffe0
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
lea ecx, [esp]
push eax
push 0x24
push ecx
push 0
push edx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
test eax, eax
je 0x1001000f
cmp dword [esp + 4], 4
jne 0x1001000f
mov eax, dword [esp + 0x1c]
add esp, 0x24
ret
xor eax, eax
add esp, 0x24
ret

Function at 0x10010220
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x1002421c
mov eax, edx
mov esi, 8
test al, 1
je 0x1001023c
shr eax, 1
xor eax, 0xedb88320
jmp 0x1001023e
shr eax, 1
dec esi
jne 0x1001022f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x1002461c
jl 0x10010228
pop esi
ret