joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ab28
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
push 0x26
push edi
call fcn.01007321
cmp dword [esp + 0x18], 0
mov esi, eax
je 0x100ac06
test esi, esi
jne 0x100ab64
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [edi + 1]
push edi
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
mov byte [edi], 0x26
mov esi, edi
push ebx
xor eax, eax
lea ebx, [esi + 1]
mov al, byte [ebx]
push ebp
mov ebp, dword [sym.imp.USER32.dll_VkKeyScanA]
mov dword [esp + 0x18], esi
push eax
call ebp
mov ecx, dword [esp + 0x20]
and dword [esp + 0x10], 0
cmp word [ecx], 0
mov dword [esp + 0x14], eax
jle 0x100ac04
mov edi, ebx
mov eax, dword [esp + 0x10]
imul eax, eax, 0x16
mov al, byte [eax + ecx + 0x14]
xor al, byte [esp + 0x14]
jne 0x100abda
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
inc edi
cmp byte [esi], 0
je 0x100abe9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push edi
call dword [sym.imp.msvcrt.dll_memmove]
xor eax, eax
mov al, byte [edi]
add esp, 0xc
mov byte [esi], 0x26
push eax
call ebp
or dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
movsx eax, word [ecx]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jl 0x100ab8f
jmp 0x100ac04
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
mov byte [esi], 0x26
pop ebp
pop ebx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100ac0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1039478]
push esi
lea eax, [eax + eax*4]
push edi
shl eax, 4
push dword [eax + 0x1039584]
call fcn.0100c72a
test eax, eax
jne 0x100ac40
call fcn.01022ea0
test eax, eax
je 0x100ad73
cmp dword [0x1039510], 0
mov eax, 0x1001d88
jne 0x100ac53
mov eax, 0x1001d90
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, 0x100
push esi
push 0x10017f8
lea eax, [ebp - 0x120]
push eax
call fcn.0100d647
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push eax
call fcn.0100d647
xor edi, edi
push 5
lea eax, [ebp - 0x120]
inc edi
push eax
mov dword [0x103954c], edi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jbe 0x100ad6f
push 0
push 0x10017ec
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [0x1039504], eax
je 0x100ad73
mov ecx, dword [0x1039480]
mov eax, dword [0x1039488]
mov esi, dword [0x1039484]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
dec eax
mov dword [ebp - 8], eax
mov eax, dword [0x103948c]
sub eax, esi
mov dword [ebp - 4], eax
push 0x10
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], esi
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.USER32.dll_MoveWindow]
add esp, 0xc
push edi
push dword [ebp - 4]
lea ecx, [eax + 2]
push eax
push dword [ebp - 0xc]
mov eax, dword [0x1039478]
push dword [ebp - 0x10]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x1039580]
mov dword [ebp - 0x20], ecx
call esi
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [0x1039504]
call esi
mov eax, dword [0x1039478]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x1039580]
push 0
push 0x429
push dword [0x1039504]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.01017a0e
mov eax, edi
jmp 0x100ad75
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x100c09b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10374c0]
push ebx
xor ebx, ebx
sub eax, ebx
je 0x100c0ba
dec eax
jne 0x100c177
xor eax, eax
inc eax
jmp 0x100c179
push esi
push edi
mov esi, 0x1001824
push esi
call fcn.0100bd6e
mov edi, eax
cmp edi, ebx
jne 0x100c0e5
lea eax, [ebp - 4]
push eax
push esi
call fcn.0100bf1d
push dword [ebp - 4]
mov edi, eax
call fcn.0100d744
cmp edi, ebx
je 0x100c139
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10018c0
push edi
call esi
push 0x10018b4
push edi
mov dword [0x10374bc], eax
call esi
push 0x10018a0
push edi
mov dword [0x10374b8], eax
call esi
push 0x1001894
push edi
mov dword [0x10399b4], eax
call esi
push 0x1001888
push edi
mov dword [0x10374b4], eax
call esi
push 0x1001878
push edi
mov dword [0x10374b0], eax
call esi
mov dword [0x10399b0], eax
cmp dword [0x10374bc], ebx
pop edi
pop esi
je 0x100c16d
cmp dword [0x10374b8], ebx
je 0x100c16d
cmp dword [0x10374b4], ebx
je 0x100c16d
cmp dword [0x10374b0], ebx
je 0x100c16d
cmp dword [0x10399b0], ebx
je 0x100c16d
xor eax, eax
inc eax
mov dword [0x10374c0], eax
jmp 0x100c179
mov dword [0x10374c0], 2
xor eax, eax
pop ebx
leave
ret

Function at 0x100d7be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x100d7e0
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100d7e0
and dword [0x1037954], 0
xor eax, eax
inc eax
jmp 0x100d7ec
mov dword [0x1037954], 3
xor eax, eax
ret 4

Function at 0x100d926
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1001928
mov esi, 0x104
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100d978
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.SharedDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
jne 0x100d995
cmp byte [ebp + 0xc], 1
push esi
push dword [ebp + 8]
jne 0x100d98f
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
jmp 0x100d995
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret 8
Function at 0x100d99a
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebx
push ebp
movzx eax, ax
dec eax
push esi
push edi
mov esi, ecx
je 0x100dab3
dec eax
je 0x100da5f
dec eax
dec eax
je 0x100d9c6
mov dword [0x1037954], 6
xor esi, esi
jmp 0x100dad2
push 1
push 0x1a
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x100d9e8
mov edi, 0x104
push edi
push esi
jmp 0x100da7c
push 0
push esi
call fcn.0100d926
mov edi, 0x104
push edi
push esi
call fcn.0100d8d9
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add eax, esi
push 0x1001d80
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edi
jne 0x100da4c
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push esi
call fcn.0100d8d9
push esi
call ebp
mov ebp, eax
push 0x1001d80
add ebp, esi
push ebp
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100da59
push edi
push 0x10019a0
push esi
call fcn.0100d647
jmp 0x100dac0
and byte [ebp], 0
jmp 0x100dac0
push 1
push 0x1a
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
mov edi, 0x104
push edi
push esi
jl 0x100daab
call fcn.0100d8d9
push edi
push 0x1001d80
push esi
call fcn.0100d647
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100daa2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push esi
call fcn.0100d8d9
jmp 0x100dac0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x100daa2
push esi
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test esi, esi
je 0x100dad2
push edi
push esi
call fcn.0100d8d9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x100dad9
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and dword [0x1037954], 0
push esi
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100db13
test al, 0x10
jne 0x100db2e
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.0100d8d9
lea eax, [ebp - 0x208]
push eax
push 0
push 0x1001d18
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x208]
push eax
call fcn.0100d6cd
mov esi, eax
test esi, esi
je 0x100db79
push esi
call fcn.0102935a
test eax, eax
je 0x100db79
push esi
call fcn.0100d744
mov dword [0x1037954], 1
xor eax, eax
jmp 0x100db7b
mov eax, esi
pop esi
leave
ret
Function at 0x100dce4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and dword [ebp - 4], 0
cmp dword [0x1039510], 0
mov eax, 0x1001d88
jne 0x100dd04
mov eax, 0x1001d90
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
push 0x1001920
lea eax, [ebp - 0x10c]
push eax
call fcn.0100d647
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x10c]
push eax
push 3
lea eax, [ebp - 8]
push eax
mov ebx, 0x1001c88
push ebx
push dword [ebp + 8]
mov edi, 0x1001918
push edi
call esi
cmp eax, 1
jbe 0x100de56
lea eax, [ebp - 0x10c]
push eax
push 0x304
lea eax, [ebp - 0x410]
push eax
push ebx
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp - 0x410], 0
mov esi, eax
lea eax, [ebp - 0x410]
je 0x100ddc1
cmp byte [eax], 0x2c
je 0x100dd9f
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
jne 0x100dd8c
jmp 0x100ddc1
and byte [eax], 0
inc eax
push 0x201
lea esi, [esi + eax + 1]
push eax
push esi
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
and byte [esi + 0x200], 0
mov dword [ebp - 4], esi
mov esi, 0x304
push esi
lea eax, [ebp - 0x410]
push eax
call fcn.0100d8d9
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push eax
call fcn.0100d647
lea eax, [ebp - 0x410]
push 1
push eax
call fcn.0100e383
cmp dword [ebp + 0xc], 0
je 0x100de58
jmp 0x100de4c
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x100de05
mov ecx, 0x1001737
mov eax, dword [0x1039554]
test eax, eax
jne 0x100de1f
mov eax, dword [0x1039478]
lea eax, [eax + eax*4]
shl eax, 4
mov eax, dword [eax + 0x1039580]
mov edx, dword [0x10394e4]
or edx, 0x2011
push edx
push dword [0x1039304]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x100de52
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.0100e383
mov esi, eax
test esi, esi
je 0x100ddf9
mov eax, esi
jmp 0x100de58
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100de5f
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push 1
push 0x1c
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, 0x104
jl 0x100dec4
push edi
push esi
call fcn.0100d8d9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push 0x1001d80
push esi
call fcn.0100d647
push esi
call ebp
cmp eax, 0xffffffff
jne 0x100deb4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x100deb7
xor eax, eax
inc eax
test eax, eax
je 0x100dec4
push edi
push esi
call fcn.0100d8d9
jmp 0x100df14
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push edi
push esi
call fcn.0100d8d9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push 0x1001d80
mov ebx, eax
push esi
add ebx, esi
call fcn.0100d647
push esi
call ebp
cmp eax, 0xffffffff
jne 0x100df0c
push 0x10019a4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call ebp
cmp eax, 0xffffffff
jne 0x100df0c
and byte [ebx], 0
jmp 0x100df13
push edi
push esi
call fcn.0100d8d9
pop ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0xc
push esi
call edi
mov ecx, 0x103
sub ecx, eax
push ecx
push esi
call edi
add eax, esi
push eax
push dword [esp + 0x1c]
call fcn.0100dc41
pop edi
pop esi
pop ebp
ret 8

Function at 0x100e03d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
call fcn.0100d67e
test ax, ax
mov dword [ebp - 4], eax
jne 0x100e05a
xor eax, eax
jmp 0x100e0eb
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
push ebx
call fcn.0100d8d9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call edi
movzx eax, word [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push 0x10019b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call fcn.0100d647
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100e0e6
push esi
push ebx
call fcn.0100d8d9
push 0xc
push ebx
call edi
mov ecx, 0x103
sub ecx, eax
push ecx
push ebx
call edi
add eax, ebx
push eax
push dword [ebp + 8]
call fcn.0100dc41
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x100e0e8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10177dc
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x1039360]
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x10177f8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
cmp word [eax + 0x3a], 0xf
jne 0x1017839
push dword [ebp + 0xc]
push 0xb0
call fcn.01021676
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
call fcn.01023fd2
xor eax, eax
jmp 0x1017a08
cmp dword [0x10398b0], ebx
push edi
jne 0x10178e3
push 1
push 0x32
call fcn.01021676
push eax
call fcn.0100c292
mov edi, eax
cmp edi, ebx
jne 0x1017862
xor eax, eax
jmp 0x1017a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001c3c
push edi
call esi
push 0x1001c48
push edi
mov dword [0x10398b0], eax
call esi
push 0x1001c54
push edi
mov dword [0x10398ac], eax
call esi
push 0x1001c64
push edi
mov dword [0x10398a8], eax
call esi
push 0x1001c74
push edi
mov dword [0x10398a4], eax
call esi
cmp dword [0x10398b0], ebx
mov dword [0x10398a0], eax
je 0x10178d5
cmp dword [0x10398ac], ebx
je 0x10178d5
cmp dword [0x10398a8], ebx
je 0x10178d5
cmp dword [0x10398a4], ebx
je 0x10178d5
cmp eax, ebx
je 0x10178d5
cmp dword [0x10379ec], ebx
jne 0x10178e0
mov dword [0x10398b0], ebx
jmp 0x101785b
mov esi, dword [ebp + 8]
cmp dword [0x1039514], ebx
je 0x1017912
push dword [ebp + 0xc]
push 0x37
call fcn.01021676
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
call fcn.01022031
push dword [0x1039554]
push fcn.01032346
call dword [0x10379ec]
push dword [ebp + 0x10]
movzx eax, word [0x1036aac]
push dword [ebp - 4]
push eax
mov eax, dword [esi + 0xc]
push ebx
push dword [eax + 0x3e]
push dword [ebp + 0xc]
call dword [0x10398b0]
cmp eax, ebx
mov dword [0x1036a94], eax
jle 0x101785b
push esi
call fcn.010176bd
mov esi, eax
cmp esi, ebx
jne 0x10179ea
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001d48
lea eax, [ebp - 0x20c]
push eax
call fcn.0102941e
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.msvcrt.dll_strrchr]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call edi
pop ecx
pop ecx
push esi
mov byte [eax + 1], bl
push 0x1001c80
lea eax, [ebp - 0x108]
push eax
call fcn.0100d647
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
pop ecx
pop ecx
push esi
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0100d647
lea eax, [ebp - 0x108]
push eax
push dword [0x1036a94]
call dword [0x10398ac]
mov esi, eax
push dword [0x1036a94]
call dword [0x10398a0]
or dword [0x1036a94], 0xffffffff
push ebx
push ebx
call dword [0x10379ec]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x101ff4b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
xor esi, esi
mov eax, 0x1037d80
cmp dword [eax], 0
je 0x101ff63
add eax, 0x12
inc esi
cmp eax, 0x1038104
jl 0x101ff53
cmp esi, 0x32
jne 0x101ff88
cmp dword [0x103954c], 0
je 0x101ff81
push 0x424
call fcn.01021676
push eax
call fcn.01023fd2
xor eax, eax
jmp 0x102000c
push edi
push 0x26
push dword [esp + 0x18]
call fcn.01007321
test eax, eax
je 0x101ffbb
movsx eax, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
push dword [esp + 0x14]
lea esi, [esi + esi*8]
shl esi, 1
mov edi, eax
call fcn.01029788
mov dword [esi + 0x1037d88], eax
jmp 0x101ffc8
lea esi, [esi + esi*8]
xor edi, edi
shl esi, 1
and dword [esi + 0x1037d88], edi
mov eax, dword [esp + 0xc]
push dword [esp + 0x10]
mov dword [esi + 0x1037d80], eax
call fcn.01029788
cmp dword [0x1039560], 0
mov word [esi + 0x1037d90], di
mov dword [esi + 0x1037d84], eax
pop edi
je 0x101fff7
or ecx, 0xffffffff
jmp 0x101fffd
mov ecx, dword [0x1039478]
mov dword [esi + 0x1037d8c], ecx
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
pop esi
ret 0xc

Function at 0x102065f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.0101fe24
test edi, edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
je 0x1020759
cmp edi, 0xffffffff
je 0x1020782
cmp dword [esi], 3
jne 0x102073d
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x18]
mov esi, dword [esi + 4]
add eax, edi
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x14]
push eax
push 2
push 0x706a
push dword [ebp + 0xc]
add edx, ebx
mov word [ebp - 0x14], di
mov word [ebp - 0x12], bx
mov word [ebp - 0xe], dx
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [ebp + 0x18], eax
je 0x1020782
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
test eax, eax
mov dword [ebp + 8], eax
je 0x1020732
lea eax, [ebp - 0x30]
push eax
push 0x18
push dword [ebp + 0x18]
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x1020729
push dword [ebp + 0x18]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1020729
push 0xcc0020
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1020782
push 0
push edx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1020782
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
push 0xaa
mov dword [ebp - 0x18], ecx
add ecx, eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [esi + 4]
mov dword [ebp - 0x14], edi
add edi, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edi
call fcn.0102766f
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1024058
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push edi
xor edi, edi
cmp dword [0x1039544], edi
je 0x1024078
mov dword [0x1039544], edi
jmp 0x10241c4
cmp dword [0x1039548], edi
jne 0x10241c4
cmp dword [0x10378b4], 5
jge 0x1024227
inc dword [0x10378b4]
cmp dword [ebp + 0x10], 2
je 0x10240a3
cmp dword [ebp + 0x10], 3
jne 0x10240ad
mov dword [0x1039550], 1
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x10240c8
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10240e6
mov ebx, dword [0x1039554]
jmp 0x10240e6
mov eax, dword [0x1039554]
cmp eax, edi
je 0x10240d5
mov ebx, eax
jmp 0x10240e6
mov eax, dword [0x1039478]
lea eax, [eax + eax*4]
shl eax, 4
mov ebx, dword [eax + 0x1039580]
mov esi, dword [ebp + 0xc]
cmp esi, 2
je 0x102410a
cmp esi, 0x2328
jl 0x10240fe
cmp esi, 0x238b
jle 0x102410a
push dword [ebp + 0x14]
push esi
call fcn.01021676
push eax
jmp 0x1024111
push esi
push dword [0x1039340]
lea eax, [ebp - 0x100]
push 0x10022fc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [0x1039560], edi
je 0x1024138
push edi
push 1
push edi
push edi
call fcn.0101c874
cmp dword [0x1039540], edi
je 0x102414e
push 0x63
push dword [0x1039580]
call dword [sym.imp.USER32.dll_KillTimer]
cmp esi, 2
mov edi, 0x2010
jne 0x102415c
mov eax, edi
jmp 0x1024166
mov eax, dword [0x10394e4]
or eax, 0x2040
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push eax
push dword [0x1039304]
lea eax, [ebp - 0x100]
push eax
push ebx
call esi
test eax, eax
jne 0x10241a5
cmp dword [ebp + 0xc], 2
jne 0x10241a5
mov eax, dword [0x10394e4]
or eax, edi
push eax
push dword [0x1039304]
push dword [0x1039340]
push ebx
call esi
mov dword [ebp + 0x10], 2
cmp dword [0x1039540], 0
pop ebx
je 0x10241c4
push 0
push 0x2710
push 0x63
push dword [0x1039580]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x10]
dec eax
je 0x1024221
dec eax
dec eax
je 0x10241d5
call fcn.0102400e
jmp 0x1024219
call fcn.0100c715
mov esi, eax
push 0x10022ec
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0xc]
push 0x111
push dword [eax + 8]
lea eax, [ebp - 0x214]
push eax
call fcn.0100d647
call fcn.0102400e
push 5
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xffffffffffffffff
call dword [sym.imp.msvcrt.dll__exit]
dec dword [0x10378b4]
pop edi
pop esi
leave
ret 0x10
Function at 0x1029c6c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x1037c9c]
test eax, eax
push esi
mov esi, dword [ebp + 8]
jne 0x1029ca2
push 0x40
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x1029c97
mov ecx, eax
call fcn.0102fd27
jmp 0x1029c99
xor eax, eax
test eax, eax
mov dword [0x1037c9c], eax
je 0x1029cc3
push esi
push eax
call fcn.0102e9b8
test eax, eax
jne 0x1029d04
push esi
call fcn.0100c05d
test eax, eax
jne 0x1029d04
push esi
push dword [0x1037c9c]
call fcn.0102fd47
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x104]
push eax
push esi
push 0x8b
call fcn.01021676
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
call fcn.01023fd2
pop esi
leave
ret 4