joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67b37962
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0xc]
add ecx, 0xc
mov dword [esp + 0x14], 0
cmp eax, ecx
mov ebp, 0
jne 0x67b379a6
jmp 0x67b379e7

Function at 0x67b37f10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x67b37f12
xor ecx, ecx
test ebx, ebx
je 0x67b37f40
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ecx, esi
movzx edx, byte [edi + ebp]
add ecx, edx
inc ebp
cmp ebx, ebp
jne 0x67b37f32
mov esi, dword [esp + 4]
mov edx, dword [esi + 0x3c]
add edx, esi
mov edi, dword [esp]
mov edx, dword [edx + edi*8 + 0x78]
mov edi, dword [esi + edx + 0x18]
mov dword [esp], edi
test edi, edi
je 0x67b37fe2
mov edi, dword [esi + edx + 0x20]
add edi, esi
mov dword [esp + 0xc], edi
mov edi, dword [esi + edx + 0x1c]
add edi, esi
mov dword [esp + 0x1c], edi
mov edx, dword [esi + edx + 0x24]
add edx, esi
mov dword [esp + 0x2c], edx
xor edi, edi
nop
nop
nop
mov edx, dword [esp + 0xc]
mov ebx, dword [edx + edi*4]
add ebx, esi
mov edx, 0xffffffff
xor esi, esi
mov ebp, esi
cmp byte [ebx + edx + 1], 0
lea edx, [edx + 1]
lea esi, [esi + 1]
jne 0x67b37f92
test edx, edx
je 0x67b37fd2
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul edx, eax
movzx esi, byte [ebx]
add edx, esi
inc ebx
dec ebp
jne 0x67b37fb2
cmp edx, ecx
jne 0x67b37fd8
jmp 0x67b37ff2
xor edx, edx
cmp edx, ecx
je 0x67b37ff2
inc edi
cmp edi, dword [esp]
mov esi, dword [esp + 4]
jne 0x67b37f82
push 1
call dword [esp + 0x18]
mov dword [esp + 0x1c], 0
jmp 0x67b38009
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + edi*2]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + eax*4]
add eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 8]
movsx ecx, byte [eax]
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [0x67bb442a]
mov dword [esp], eax
mov eax, dword [0x67bb442e]
mov esi, dword [0x67bb442e]
mov edx, dword [esp + 0x18]
add edx, ecx
mov ecx, dword [esp + 0x10]
lea edi, [ecx + edx + 1]
mov ebx, 0xffffffff
nop
nop
nop
nop

Function at 0x67b38040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
nop
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x67b38042
xor ecx, ecx
test ebx, ebx
je 0x67b38070
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
imul ecx, esi
movzx edx, byte [edi + ebp]
add ecx, edx
inc ebp
cmp ebx, ebp
jne 0x67b38062
mov ebx, dword [esp + 4]
mov edx, dword [ebx + 0x3c]
add edx, ebx
mov esi, dword [esp]
mov edx, dword [edx + esi*8 + 0x78]
Function at 0x4013b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SOFTWARETFTPD32DHCP
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
neg edi
sbb edi, edi
inc edi
je 0x4014d6
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x10]
mov ebp, 4
push ecx
push 0x413cf0
push 0
push 0
push str.IP_Pool
push edx
mov dword [esp + 0x28], ebp
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x413cf4
push 0
push 0
push str.PoolSize
push ecx
mov dword [esp + 0x28], ebp
call ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x413d04
push 0
push 0
push str.BootFile
push eax
mov dword [esp + 0x28], 0x100
call ebx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x413cfc
push 0
push 0
push 0x41119c
push edx
mov dword [esp + 0x28], ebp
call ebx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x413cf8
push 0
push 0
push 0x411258
push ecx
mov dword [esp + 0x28], ebp
call ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x413d00
push 0
push 0
push str.Gateway
push eax
mov dword [esp + 0x28], ebp
call ebx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x413e04
push 0
push 0
push str.DomainName
push edx
mov dword [esp + 0x28], 0x40
call ebx
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x413cf0]
push ecx
call sub.WSOCK32.dll_inet_ntoa
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push eax
push 0xbc2
push esi
call ebx
mov edx, dword [0x413cf8]
push edx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0xbc3
push esi
call ebx
mov eax, dword [0x413cfc]
push eax
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0xbc7
push esi
call ebx
mov ecx, dword [0x413d00]
push ecx
call sub.WSOCK32.dll_inet_ntoa
push eax
push 0xbcd
push esi
call ebx
push 0x413d04
push 0xbca
push esi
call ebx
mov edx, dword [0x413cf4]
push 0
push edx
push 0xbc8
push esi
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 0x413e04
push 0xbd6
push esi
call ebx
mov eax, dword [0x413cf4]
xor esi, esi
cmp eax, esi
je 0x4015a9
shl eax, 5
push eax
call fcn.0040965a
add esp, 4
cmp eax, esi
mov dword [0x413cb0], eax
jne 0x4015a9
push 0x10
push str.Tftpd32
push str.Can_not_allocate_memory
push ebp
call fcn.00402ba0
add esp, 0x10
push esi
push esi
push 0x10
push ebp
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, edi
mov dword [0x413cb4], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x407910
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push str._Tftpd32__by_Ph._Jounin_MutEx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
je 0x407982
call esi
cmp eax, 0xb7
jne 0x407982
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4124e0
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x407967
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
xor eax, eax
pop ebx
ret 0x10
push 0x10
push str.Tftpd32
push str.Tftpd32_is_already_running
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
xor eax, eax
pop ebx
ret 0x10
push str.TFTP_LOG
call fcn.00409e07
add esp, 4
test eax, eax
je 0x4079ad
push str.TFTP_LOG
call fcn.00409e07
push eax
call fcn.00409cf5
add esp, 8
mov dword [0x412618], eax
jmp 0x4079b7
mov dword [0x412618], 8
push 0x104
push 0x415620
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4079d6
call esi
push 0x5c
push 0x415620
call fcn.00409de0
add esp, 8
test eax, eax
jne 0x4079f0
mov eax, 0x415620
jmp 0x4079f1
inc eax
push edi
push str.Tftpd32.hlp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x10]
push esi
push 0
push 0x406ec0
push 0x65
push 0
call fcn.00409160
mov edi, dword [sym.imp.USER32.dll_UnregisterClassA]
add esp, 0x14
push esi
push str.TftpAddIpBackGround
call edi
push esi
push str.SyslogBackGround
call edi
push esi
push str.DhcpBackGround
call edi
push esi
push str.Ttftpd32BackGround
call edi
push esi
push str.Ttftpd32ClientBackGround
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x40d179
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4139b8
cmp edx, dword [eax]
je 0x40d19b
add eax, 8
inc ecx
cmp eax, 0x413a48
jl 0x40d18c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4139b8]
jne 0x40d2c9
mov eax, dword [0x4152ac]
cmp eax, 1
je 0x40d2a3
test eax, eax
jne 0x40d1cc
cmp dword [0x413434], 1
je 0x40d2a3
cmp edx, 0xfc
je 0x40d2c9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d203
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040bfc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040c0f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40d246
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040c0f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40fd28
push edi
call fcn.0040dc50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040bfc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040bfd0
lea eax, [ebp - 0xa0]
push 0x40fd08
push eax
call fcn.0040bfd0
push dword [esi + 0x4139bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040bfd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040de4c
add esp, 0x2c
pop edi
jmp 0x40d2c9
lea eax, [ebp + 8]
lea esi, [esi + 0x4139bc]
push 0
push eax
push dword [esi]
call fcn.0040c0f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x70346a5e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..rsrc
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3654759d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x10002110
mov dword [esp + 0x1c], esi
push eax
mov dword [esp + 0x34], 0x100d4e24
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x100021aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x68
push 0x100d4e78
push 0x100d4eb8
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x100d4ecc
push str.keyboard
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x100021fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x6e
push 0x100d4f34
push str.CreateWnd
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100074d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], edi
call fcn.100078f0
test eax, eax
jne 0x1000753b
cmp byte [edi + 8], al
je 0x100074f6
mov byte [edi + 8], al
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.10006df0
mov ecx, dword [ebp - 4]
cmp ecx, dword [edi]
je 0x1000753b
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
add ecx, 0x14
push eax
push ecx
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.10001870
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x1000758a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
cmp cx, ax
jne 0x10007573
mov ecx, dword [ebp + 8]
mov dl, bl
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov ecx, edi
push ebx
push esi
call fcn.100076c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x100075f3
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0xffffff00
and ax, cx
push 0x12
movzx edi, ax
call esi
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
movzx eax, ax
cmp cx, di
jne 0x100075da
cmp cx, ax
jne 0x100075da
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
push esi
call fcn.100076c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d66e4
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x60]
cmp eax, 9
ja 0x10007612
mov ecx, dword [ebp + 8]
lea edx, [ebx - 0x30]
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x6a]
cmp eax, 5
ja 0x10007634
mov dl, byte [ebx + 0x100dea02]
mov ecx, dword [ebp + 8]
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x70]
cmp eax, 0x17
ja 0x1000765c
mov esi, dword [ebp + 8]
lea eax, [ebx - 0x6f]
push eax
push 0x100d6864
push esi
call fcn.10008f10
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0xba]
cmp eax, 6
jbe 0x10007573
lea eax, [ebx - 0xdb]
cmp eax, 4
jbe 0x10007573
cmp ebx, 0x20
jne 0x10007698
mov ecx, dword [ebp + 8]
push 0x100d686c
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d68c4
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100076c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x514], ebx
push 0
mov dword [ebp - 0x518], edi
mov dword [ebp - 0x51c], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov byte [ebp - 0x104], 0
push 0xff
lea eax, [ebp - 0x103]
mov dword [ebp - 0x508], esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x50c]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x510], eax
push ecx
push eax
push str.ret:__d___s
push 1
push 0xba
push 0x100d68e0
push str.CVirtualKeyManager::GetUnicodeVal
call fcn.100c3e10
mov edx, dword [ebp - 0x510]
add esp, 0x1c
cmp edx, 0xffffffff
jne 0x10007821
mov ebx, dword [ebp - 0x50c]
mov edi, dword [ebp - 0x508]
jmp 0x100077d0
push 0xff
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push edi
push 0
push 0x100
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
js 0x100077d0
mov edi, dword [ebp - 0x518]
mov ebx, dword [ebp - 0x514]
mov edx, dword [ebp - 0x510]
cmp dword [edi + 0x10], 0
je 0x100078bc
cmp byte [edi + 9], 0
je 0x100078bc
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x504], ax
lea eax, [ebp - 0x502]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x504]
lea esi, [edi + 0x14]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
push esi
push dword [edi + 0xc]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0x100
push 0
push esi
mov dword [edi + 0x10], 0
mov byte [edi + 9], 0
mov dword [edi + 0xc], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
mov ecx, ebx
call fcn.10002340
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ce72b
mov esp, ebp
pop ebp
ret 8
cmp edx, 0xffffffff
mov dword [edi + 0x10], esi
mov ecx, 0x40
lea esi, [ebp - 0x104]
sete al
mov byte [edi + 9], al
mov eax, dword [ebp - 0x50c]
mov dword [edi + 0xc], eax
add edi, 0x14
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xffffffff
jne 0x10007899
push 0x100d693c
jmp 0x100078a0
Function at 0x100078f0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d01cb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x77]
mov byte [ebp - 0x78], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x78]
push eax
push str.keyboard_name:__s
push 1
push 0xde
push str..._srcKeyboadHookutilVirtualKeyManager.cpp
push str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.100c3a80
add esp, 0x18
mov dword [ebp - 0x7c], 0xf
cmp byte [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x90], 0
jne 0x1000797d
xor ecx, ecx
jmp 0x1000798c
lea ecx, [ebp - 0x78]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007983
sub ecx, edx
push ecx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x90]
call fcn.10006cf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x90]
mov ebx, dword [ebp - 0x90]
lea edx, [ebp - 0x90]
mov esi, dword [ebp - 0x80]
cmp edi, 0x10
cmovae eax, ebx
cmovae ecx, ebx
add eax, esi
cmp edi, 0x10
cmovae edx, ebx
cmp edx, eax
je 0x100079f8
push dword [sym.imp.MSVCR120.dll_towlower]
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.10007be0
mov edi, dword [ebp - 0x7c]
add esp, 0xc
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x90]
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000000a
push ecx
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007a30
cmp esi, 8
jb 0x10007a30
cmp esi, 8
setne al
test eax, eax
je 0x10007aa1
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000040a
push ecx
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007a68
cmp esi, 8
jb 0x10007a68
cmp esi, 8
setne al
test eax, eax
je 0x10007aa1
cmp edi, 0x10
lea eax, [ebp - 0x90]
mov ecx, 8
cmovae eax, ebx
cmp esi, 8
cmovb ecx, esi
push ecx
push str.0001040a
push eax
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007aa8
cmp esi, 8
jb 0x10007aa8
cmp esi, 8
setne al
test eax, eax
jne 0x10007aa8
mov esi, 1
jmp 0x10007b0a
push str.00000016
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00000416
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00010416
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00000816
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
xor esi, esi
jmp 0x10007b01
mov esi, 2
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
cmp edi, 0x10
jb 0x10007b19
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce72b
mov esp, ebp
pop ebp
ret
Function at 0x1000eff0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0946
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], 0
push str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea ecx, [ebp - 0x428]
call fcn.10006c90
mov dword [ebp - 4], 0
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.10004c90
push eax
push 0x400
lea ecx, [ebp - 0x410]
push ecx
push 0
push str.UniquePC
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x410]
push edx
lea ecx, [ebp - 0x440]
call fcn.10006c90
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44c], esp
lea eax, [ebp - 0x440]
push eax
call fcn.100069d0
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp + 8]
call fcn.10009150
add esp, 0x18
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x444]
or ecx, 1
mov dword [ebp - 0x444], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.10004d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10004d20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce72b
mov esp, ebp
pop ebp
ret
Function at 0x100382f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov eax, dword [ebp + 8]
cmp dword [eax + 0x88], 0
je 0x10038340
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x88]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x88], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], 0
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100383d3
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x8c]
add ecx, 0x28
xor edx, edx
push edx
push ecx
call fcn.10027130
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
cmp dword [ebp - 4], 0
jne 0x100383a1
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
sub ecx, 1
xor esi, esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x98]
cdq
push edx
push eax
push esi
push ecx
call fcn.100ced70
push edx
push eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
call fcn.10025b90
add esp, 0x10
mov eax, 7
jmp 0x100383f6
mov edx, 0x28
shl edx, 0
add edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov ecx, 0x20
mov edx, dword [ebp - 4]
mov word [edx + 0x1c], cx
mov eax, 1
mov ecx, dword [ebp - 4]
mov word [ecx + 0x1e], ax
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
add eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], eax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret