joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e290
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449007
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x250], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
call fcn.004043b0
push str.lddownloader_
lea edx, [ebp - 0x234]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24c]
call fcn.0043d400
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0043dd90
cmp dword [ebp - 0x238], 8
mov esi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x43e374
push dword [ebp - 0x24c]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x238], 7
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
jb 0x43e3a5
push dword [ebp - 0x234]
call esi
add esp, 4
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x234]
call fcn.004043b0
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, esp
lea edx, [ebp - 0x234]
push str.lddownloaderlddownloader.log
call fcn.0043d400
add esp, 4
mov ecx, edi
call fcn.0043de30
add esp, 0x18
cmp dword [ebp - 0x220], 8
jb 0x43e418
push dword [ebp - 0x234]
call esi
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00443640
mov esp, ebp
pop ebp
ret 4
Function at 0x440a60
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x302c
call fcn.004441c0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xorps xmm0, xmm0
mov dword [ebp - 0x300c], 0
lea eax, [ebp - 0x302c]
mov esi, edx
push eax
mov edi, ecx
movdqu xmmword [ebp - 0x302c], xmm0
movdqu xmmword [ebp - 0x301c], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x3018]
mov dword [edi], eax
mov dword [esi], eax
mov eax, dword [0x46a1ac]
test al, 1
jne 0x440ae3
push str.GetLogicalProcessorInformation
or eax, 1
push str.kernel32.dll
mov dword [0x46a1ac], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x46a1b0], esi
jmp 0x440ae9
mov esi, dword [0x46a1b0]
test esi, esi
je 0x440b57
push 0x3000
lea eax, [ebp - 0x3004]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x3008], 0x3000
lea eax, [ebp - 0x3008]
push eax
lea eax, [ebp - 0x3004]
push eax
call esi
test eax, eax
je 0x440b57
mov eax, 0xaaaaaaab
xor esi, esi
mul dword [ebp - 0x3008]
shr edx, 4
test edx, edx
je 0x440b57
lea ecx, [ebp - 0x3000]
jmp 0x440b40
mov eax, dword [ecx]
sub eax, 0
je 0x440b4a
dec eax
jmp 0x440b4b
inc esi
add ecx, 0x18
dec edx
jne 0x440b40
test esi, esi
je 0x440b57
mov dword [edi], esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00443640
mov esp, ebp
pop ebp
ret
Function at 0x477880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x475015
lea edi, [esi - 0x74015]
push edi
or ebp, 0xffffffff
jmp 0x4778a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4778a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477898
mov eax, 1
add ebx, ebx
jne 0x4778bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4778b0
jne 0x4778cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4778b0
xor ecx, ecx
sub eax, 3
jb 0x4778e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x477952
mov ebp, eax
add ebx, ebx
jne 0x4778eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4778f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47791c
inc ecx
add ebx, ebx
jne 0x477908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4778fd
jne 0x477919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4778fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47793c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47792d
jmp 0x47789e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47793c
add edi, ecx
jmp 0x47789e
pop esi
mov edi, esi
mov ecx, 0x25e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47795a
cmp byte [edi], 2
jne 0x47795a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x47795f
lea edi, [esi + 0x75000]
mov eax, dword [edi]
or eax, eax
je 0x4779ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x77000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x770c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47798c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x770cc]
or eax, eax
je 0x4779c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4779a9
call dword [esi + 0x770d0]
popal
jmp 0x4011cb

Function at 0x10001000
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov cl, byte [edx + section..data]
mov al, 0xe0
xor cl, 0x70
ror cl, 1
not cl
add cl, 0x7d
xor cl, dl
add cl, 0x1a
ror cl, 2
sub al, cl
xor al, 0x2b
mov byte [edx + section..data], al
inc edx
cmp edx, 0x4405
jb 0x10001002
push 0
push 0
push section..data
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
ret
Function at 0x10004760
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1008c118
push 0x1007293c
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x10090400]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov esi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
mov edi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub ebx, esi
sub ebx, 5
mov byte [esi], 0xe9
mov dword [esi + 1], ebx
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, edi
jae 0x100047d0
mov byte [esi + eax], 0x90
inc eax
jmp 0x100047c2
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x100047ea
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007296b
mov esp, ebp
pop ebp
ret

Function at 0x10004b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10090400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov edi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call esi
push 1
call esi
push dword [ebp + 8]
push edi
mov edi, dword [ebp - 0xc]
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push 1
call esi
push 1
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007296b
mov esp, ebp
pop ebp
ret
Function at 0x10006800
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x10090400]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x138], ecx
mov dword [ebp - 0x134], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10006892
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x10006892
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
push dword [ebp - 0x138]
lea eax, [ebp - 0x10c]
push eax
call edi
add esp, 8
test eax, eax
je 0x10006886
lea eax, [ebp - 0x130]
push eax
push esi
call ebx
test eax, eax
jne 0x10006860
jmp 0x10006892
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x134], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x134]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1007296b
mov esp, ebp
pop ebp
ret
Function at 0x100098c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10090400]
xor eax, ebp
mov dword [ebp - 4], eax
movss xmm0, dword [0x1008b63c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
or esi, 0xffffffff
movss dword [ebp - 8], xmm0
xor ebx, ebx
nop dword [eax + eax]
mov ecx, ebx
call fcn.10006ae0
test eax, eax
jle 0x10009a6e
mov ecx, dword [0x1009283c]
sub ecx, dword [0x10094840]
add ecx, dword [0x1009497c]
mov eax, dword [0x10094a28]
mov cl, byte [ecx + eax]
mov al, bl
not cl
not al
xor cl, al
test cl, 1
je 0x10009a6e
mov eax, dword [0x10092af0]
lea ecx, [ebp - 0x14]
mov edx, ebx
push dword [eax*4 + 0x1008772c]
call fcn.10006b70
add esp, 4
test al, al
je 0x10009a6e
movq xmm0, qword [ebp - 0x14]
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x20]
call fcn.10006c50
add esp, 0xc
test al, al
je 0x10009a6e
mov eax, dword [0x100928a4]
cvttss2si edx, dword [ebp - 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
cvttss2si ecx, dword [ebp - 0x20]
addsd xmm0, qword [eax*8 + 0x1008b650]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1008b564]
cvttss2si eax, xmm0
push eax
mov eax, dword [0x100928a0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008b650]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1008b564]
cvttss2si eax, xmm0
push eax
call fcn.100096f0
movss xmm1, dword [ebp - 8]
add esp, 8
cvtps2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x10009a6e
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x10092a38]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 8], xmm1
comiss xmm0, xmm1
jbe 0x10009a6e
mov ecx, dword [0x10091aec]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x10009a14
jmp dword [eax*4 + 0x10009a98]
mov eax, 1
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 2
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 0x11
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 0x10
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, dword [0x100929b4]
test ecx, ecx
je 0x10009a65
push eax
call edi
test ax, ax
js 0x10009a65
cmp dword [0x10091aec], 0
jne 0x10009a6e
mov esi, ebx
mov byte [0x10091c07], 1
inc ebx
cmp ebx, 0xf
jle 0x100098f0
mov eax, esi
cmp esi, 0xffffffff
jne 0x10009a86
mov byte [0x10091c07], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007296b
mov esp, ebp
pop ebp
ret
Function at 0x10009a1b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10090400]
xor eax, ebp
mov dword [ebp - 4], eax
movss xmm0, dword [0x1008b63c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
or esi, 0xffffffff
movss dword [ebp - 8], xmm0
xor ebx, ebx
nop dword [eax + eax]
mov ecx, ebx
call fcn.10006ae0
test eax, eax
jle 0x10009a6e
mov ecx, dword [0x1009283c]
sub ecx, dword [0x10094840]
add ecx, dword [0x1009497c]
mov eax, dword [0x10094a28]
mov cl, byte [ecx + eax]
mov al, bl
not cl
not al
xor cl, al
test cl, 1
je 0x10009a6e
mov eax, dword [0x10092af0]
lea ecx, [ebp - 0x14]
mov edx, ebx
push dword [eax*4 + 0x1008772c]
call fcn.10006b70
add esp, 4
test al, al
je 0x10009a6e
movq xmm0, qword [ebp - 0x14]
sub esp, 0xc
mov eax, dword [ebp - 0xc]
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x20]
call fcn.10006c50
add esp, 0xc
test al, al
je 0x10009a6e
mov eax, dword [0x100928a4]
cvttss2si edx, dword [ebp - 0x1c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
cvttss2si ecx, dword [ebp - 0x20]
addsd xmm0, qword [eax*8 + 0x1008b650]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1008b564]
cvttss2si eax, xmm0
push eax
mov eax, dword [0x100928a0]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1008b650]
cvtpd2ps xmm0, xmm0
mulss xmm0, dword [0x1008b564]
cvttss2si eax, xmm0
push eax
call fcn.100096f0
movss xmm1, dword [ebp - 8]
add esp, 8
cvtps2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x10009a6e
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movd xmm0, dword [0x10092a38]
cvtdq2ps xmm0, xmm0
movss dword [ebp - 8], xmm1
comiss xmm0, xmm1
jbe 0x10009a6e
mov ecx, dword [0x10091aec]
lea eax, [ecx - 1]
cmp eax, 3
ja case.default.0x10009a14
jmp dword [eax*4 + 0x10009a98]
mov eax, 1
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 2
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 0x11
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, 0x10
mov dword [0x100929b4], eax
jmp 0x10009a50
mov eax, dword [0x100929b4]
test ecx, ecx
je 0x10009a65
push eax
call edi
test ax, ax
js 0x10009a65
cmp dword [0x10091aec], 0
jne 0x10009a6e
mov esi, ebx
mov byte [0x10091c07], 1
inc ebx
cmp ebx, 0xf
jle 0x100098f0
mov eax, esi
cmp esi, 0xffffffff
jne 0x10009a86
mov byte [0x10091c07], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007296b
mov esp, ebp
pop ebp
ret

Function at 0x10009ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x10009b0a
cmp byte [edi*8 + 0x100953b0], 0
lea esi, [edi*8 + 0x100953b4]
je 0x10009aef
cmp dword [esi], 0
je 0x10009b12
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
add ecx, dword [ebp - 4]
cmp ecx, eax
ja 0x10009b12
mov byte [edi*8 + 0x100953b0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [edi*8 + 0x100953b0], 0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10014980
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10090400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10094ba0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
cmp dword [eax], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x10014a59
cmp byte [0x10091af2], 0
jne 0x10014a59
mov esi, dword [0x10094a54]
lea eax, [ebp - 8]
push eax
push 0x40
push 2
add esi, 0xfffffffe
mov byte [0x10091af2], 1
push esi
call ebx
push 1
call edi
push 1
call edi
mov eax, 0xe084
push 1
mov word [esi], ax
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 2
push esi
call ebx
mov esi, dword [0x10094860]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xcc
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov esi, dword [0x1009485c]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xcc
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov eax, dword [0x10094ba0]
mov eax, dword [eax]
test eax, eax
jne 0x10014a72
cmp byte [0x10091af2], 1
jne 0x10014a72
mov byte [0x10091af2], al
cmp dword [0x10092d64], 0
je 0x10014b68
cmp eax, 1
jne 0x10014b11
cmp byte [0x10091af1], 0
jne 0x10014ac8
mov esi, dword [0x10094850]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xcc
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov byte [0x10091af1], 1
cmp dword [0x10091bec], 0
je 0x10014b11
cmp byte [0x10092b06], 0
jne 0x10014b11
mov esi, dword [0x10094850]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xa5
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov byte [0x10092b06], 1
mov eax, dword [0x10094ba0]
cmp dword [eax], 4
jne 0x10014b4b
mov esi, dword [0x10094850]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xa5
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov eax, dword [0x10094ba0]
cmp dword [eax], 0
jne 0x10014ba8
mov byte [0x10092b06], 0
mov dword [0x10091bec], 0
jmp 0x10014ba1
cmp byte [0x10091af1], 1
jne 0x10014ba8
mov esi, dword [0x10094850]
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push esi
call ebx
push 1
call edi
push 1
call edi
push 1
mov byte [esi], 0xa5
call edi
push 1
call edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push esi
call ebx
mov byte [0x10091af1], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007296b
mov esp, ebp
pop ebp
ret
Function at 0x10016130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10094ba0]
inc dword [0x10090ce4]
cmp dword [eax], 1
jne 0x1001623d
mov eax, dword [0x10092ae4]
cmp dword [eax], 0
je 0x1001623d
cmp dword [0x10092a48], 0
je 0x1001623d
mov ecx, dword [0x1009283c]
sub ecx, dword [0x10094840]
add ecx, dword [0x1009497c]
mov eax, dword [0x10094a28]
mov ecx, dword [ecx + eax]
call fcn.10006ae0
test eax, eax
jle 0x100161a7
mov eax, dword [0x10092ae4]
mov ecx, dword [eax]
add ecx, dword [0x1009482c]
call fcn.10017540
mov ecx, dword [0x1009484c]
add ecx, eax
call fcn.10017580
jmp 0x100161aa
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1001623d
mov eax, dword [0x10092ae4]
push edi
push 1
mov edi, dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x10016235
cmp byte [0x100953b8], 0
je 0x100161f2
cmp dword [0x100953bc], 0
je 0x1001623c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x100953bc]
add ecx, 0x96
cmp ecx, eax
ja 0x1001623c
mov byte [0x100953b8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100953bc], eax
mov eax, dword [0x10090ce4]
cmp eax, dword [0x10091bc4]
jl 0x1001623c
push 0
push 2
mov ecx, edi
call dword [0x1009486c]
push 0
push 0
mov ecx, edi
call dword [0x1009486c]
mov dword [0x10090ce4], 0
jmp 0x1001623c
mov byte [0x100953b8], 0
pop edi
mov eax, dword [0x100912f4]
test eax, eax
jne 0x1001624f
mov dword [0x10091bc4], eax
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x10016262
mov dword [0x10091bc4], 0xa
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x10016275
mov dword [0x10091bc4], 0x14
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x10016288
mov dword [0x10091bc4], 0x1e
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x1001629b
mov dword [0x10091bc4], 0x28
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x100162ae
mov dword [0x10091bc4], 0x32
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x100162c1
mov dword [0x10091bc4], 0x3c
mov esp, ebp
pop ebp
ret
cmp eax, 7
jne 0x100162d4
mov dword [0x10091bc4], 0x46
mov esp, ebp
pop ebp
ret
cmp eax, 8
jne 0x100162e7
mov dword [0x10091bc4], 0x50
mov esp, ebp
pop ebp
ret
cmp eax, 9
jne 0x100162fa
mov dword [0x10091bc4], 0x5a
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x1001630d
mov dword [0x10091bc4], 0x64
mov esp, ebp
pop ebp
ret
cmp eax, 0xb
jne 0x10016320
mov dword [0x10091bc4], 0x6e
mov esp, ebp
pop ebp
ret
cmp eax, 0xc
jne 0x1001632f
mov dword [0x10091bc4], 0x78
mov esp, ebp
pop ebp
ret
Function at 0x10016d40
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10094ba0]
sub esp, 0xc
cmp dword [eax], 1
push edi
jne 0x10016e46
mov eax, dword [0x10092ae4]
cmp dword [eax], 0
je 0x10016da3
mov ecx, dword [0x1009283c]
sub ecx, dword [0x10094840]
add ecx, dword [0x1009497c]
mov eax, dword [0x10094a28]
mov ecx, dword [ecx + eax]
call fcn.10006ae0
test eax, eax
jle 0x10016da3
mov eax, dword [0x10092ae4]
mov ecx, dword [eax]
add ecx, dword [0x1009482c]
call fcn.10017540
mov ecx, dword [0x1009484c]
add ecx, eax
call fcn.10017580
jmp 0x10016da6
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10016e46
cmp dword [0x10091af8], eax
je 0x10016e46
mov eax, dword [0x10094974]
lea edx, [ebp - 0xc]
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [0x100948b0]
mov ecx, esp
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push ecx
push eax
push edx
call fcn.100188d0
mov ecx, dword [0x10094a64]
call fcn.10004b10
add esp, 0xc
mov edi, eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
shr ecx, 0x10
test ecx, ecx
je 0x10016e3f
cmp byte [0x100953b8], 0
je 0x10016e22
cmp dword [0x100953bc], 0
je 0x10016e46
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x100953bc]
inc ecx
cmp ecx, eax
ja 0x10016e46
mov byte [0x100953b8], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100953bc], eax
mov dword [edi], 5
pop edi
mov esp, ebp
pop ebp
ret
mov byte [0x100953b8], 0
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10016eb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x10092a50]
mov ebx, ecx
mov dword [ebp - 4], ebx
test esi, esi
jne 0x10016f42
push edi
push 0x28
call fcn.10072b79
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
xorps xmm0, xmm0
mov dword [ebp - 8], esi
push 0x190
movups xmmword [esi], xmm0
movups xmmword [esi + 0x10], xmm0
movq qword [esi + 0x20], xmm0
mov dword [esi + 0xc], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0x433c0000
mov dword [esi + 0x14], 0x41900000
mov dword [esi + 4], 1
call ebx
add esp, 8
mov dword [esi + 8], eax
xor edi, edi
nop word [eax + eax]
push 0x14
call ebx
mov ecx, dword [esi + 8]
add esp, 4
mov dword [edi + ecx], eax
add edi, 4
cmp edi, 0x190
jl 0x10016f20
mov ebx, dword [ebp - 4]
pop edi
mov dword [0x10092a50], esi
cmp dword [esi], 0
jne 0x10016f54
mov ecx, ebx
call fcn.1000a7b0
mov esi, dword [0x10092a50]
movss xmm2, dword [0x1008b5f0]
mov ecx, esi
movss xmm1, dword [0x1008b5d4]
push ebx
call fcn.10009f60
call fcn.1000a390
push 0xa0
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x10016fde
cmp byte [0x100958b0], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x10016fae
cmp dword [0x100958b4], 0
je 0x10016fe5
call esi
mov ecx, dword [0x100958b4]
add ecx, 0xc8
cmp ecx, eax
ja 0x10016fe5
mov byte [0x100958b0], 1
call esi
cmp byte [0x10091b63], 0
pop esi
sete byte [0x10091b63]
mov dword [0x100958b4], eax
cmp byte [0x100923e4], 0
pop ebx
sete byte [0x100923e4]
mov esp, ebp
pop ebp
ret
mov byte [0x100958b0], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret