joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100234fa
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b356
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10023545
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
call fcn.10023a38
add esp, 0xc
jmp 0x10023699
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x66e
mov dword [ebp - 0x44], 0x1000b890
cmp dword [ebp - 0x24], 0x979
jle 0x10023620
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
and dword [ebp - 0x14], 0
jmp 0x1002357f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6d3f
jge 0x10023620
and dword [ebp - 0x18], 0
jmp 0x10023599
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a76
jge 0x1002361b
and dword [ebp - 0x1c], 0
jmp 0x100235af
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x220d
jge 0x10023616
and dword [ebp - 0x20], 0
jmp 0x100235c5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3cbf
jge 0x10023614
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl edx, cl
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.1000e423
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1001b217
push eax
call fcn.10062533
pop ecx
lea ecx, [ebp - 0x64]
call fcn.1001b20d
jmp 0x100235be
jmp 0x100235a8
jmp 0x10023592
jmp 0x10023578
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002363a
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x1002365d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002365d
push 0x2244
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x486
jge 0x10023673
push dword [ebp - 0x44]
call fcn.10062533
pop ecx
jmp 0x1002368f
or dword [ebp - 4], 0xffffffff
jmp 0x10023699
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100265c5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002664e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002662e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002662c
push 0x937
push 0x1e46
push 0x19a5
push 0
push 0x6c88
push 1
push 0x5c0e
push 1
call fcn.100397e6
add esp, 0x20
jmp 0x1002664c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002664c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1002666a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
call fcn.100236cd
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003897a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100389b4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 8]
push 0x2249
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.100389fb
add esp, 0x14
jmp 0x100389f7
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100389de
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and dword [eax], 0
jmp 0x100389f7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100389f7
push 0x2244
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x1003975e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100397a3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10039796
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
jmp 0x100397a1
push 0x1e5d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x100397bf
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.100260b4
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100397e6
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b967
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100399a9
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10039976
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [0x10624a30]
and eax, 1
jne 0x1003988b
mov eax, dword [0x10624a30]
or eax, 1
mov dword [0x10624a30], eax
and dword [ebp - 4], 0
mov ecx, 0x10624a34
call fcn.1001bc2a
push 0x1007c35e
call fcn.10062509
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
imul eax, dword [eax], 0x3e8
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov dword [ebp - 0x1c], eax
movzx eax, byte [0x106248e8]
test eax, eax
je 0x100398fd
mov ecx, 0x10624a34
call fcn.10039c57
movzx eax, al
test eax, eax
jne 0x100398fd
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x10624a34
call fcn.1001bc15
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x10624a34
call fcn.1001bc07
push eax
lea ecx, [ebp - 0x10]
call fcn.1001bce1
movzx eax, al
test eax, eax
je 0x100398fd
lea ecx, [ebp - 0x10]
call fcn.10039c60
mov ecx, dword [ebp - 0x20]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x100399cd
push dword [ebp - 0x14]
call fcn.1002a590
pop ecx
mov dword [ebp - 0x3c], eax
push 1
mov eax, dword [ebp - 0x18]
push dword [eax]
push 0
push dword [ebp - 0x3c]
call fcn.1002e028
add esp, 0x10
mov dword [ebp - 0x24], eax
movzx eax, byte [0x106248e8]
test eax, eax
je 0x1003993c
mov ecx, 0x10624a34
call fcn.10039c57
movzx eax, al
test eax, eax
jne 0x1003996a
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x10624a34
call fcn.10039c19
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
push 0x6dda
push 0x5e42
push 0x106248e8
push 1
push 1
call fcn.1003975e
add esp, 0x14
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
jmp 0x100399cd
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x100399a7
push 0x72f3
push 0
push 1
push 0x576d
push 0xbaf
call fcn.1003942c
add esp, 0x14
jmp 0x100399cd
lea eax, [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x100399c3
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100399cd
push 0
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003ad12
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1003ad98
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003ad81
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x1003ad96
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xffffffff
jmp 0x1003add5
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1003adbe
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003adbc
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1003add5
push 0
push 0xf7b
push 0x177c
push 0x129d
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov esp, ebp
pop ebp
ret

Function at 0x1003d79e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003d7d0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x7cd
push 0x68e4
push 0
push 0x4388
call fcn.1004a3f0
add esp, 0x14
jmp 0x1003d821
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003d814
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003d812
push 0x1dfa
push 0
push 0
push 0x5688
call fcn.1003d79e
add esp, 0x10
jmp 0x1003d821
push 0x2244
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1003fa3e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003fa96
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003fa7d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003fa7b
push 0x52bd
push 0x60d4
push 0
call fcn.1004b5ad
add esp, 0xc
jmp 0x1003fa94
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1003fa94
push 0x1e5d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x1003fa9e
push 0
call fcn.1003ab7e
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10042c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x10042d11
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10042cee
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10042cd2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10042cec
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1001bad7
and dword [eax], 0
jmp 0x10042cc7
jmp 0x10042d0c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10042d0c
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10042dd8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10042dae
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
push 0
push 0x23cc
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x5c]
push dword [eax]
mov eax, dword [ebp - 0x60]
push dword [eax]
mov eax, dword [ebp - 0x64]
push dword [eax]
push 0x49e5
mov eax, dword [ebp - 0x68]
push dword [eax]
call fcn.100518a7
add esp, 0x20
jmp 0x10042dd8
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
movzx eax, byte [eax]
test eax, eax
je 0x10042dd8
push 0
push 0x79ea
push 0x388a
call fcn.100434df
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100514b4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007be0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1005151f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1005150d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x1005151a
push 0
push 0x983
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x10051668
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x4662
mov dword [ebp - 0x4c], 0x1000ca10
cmp dword [ebp - 0x28], 0x46fc
jle 0x10051601
and dword [ebp - 0x20], 0
jmp 0x10051553
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4e7f
jge 0x100515eb
and dword [ebp - 0x14], 0
jmp 0x1005156d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2504
jge 0x100515e6
and dword [ebp - 0x18], 0
jmp 0x10051583
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x39eb
jge 0x100515e4
and dword [ebp - 0x1c], 0
jmp 0x10051599
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x741
jge 0x100515e2
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.1000e423
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.1001b217
push eax
call fcn.10062533
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.1001b20d
jmp 0x10051592
jmp 0x1005157c
jmp 0x10051566
jmp 0x1005154c
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10051624
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0x10], 0
jmp 0x1005162c
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4551
jge 0x10051642
push dword [ebp - 0x4c]
call fcn.10062533
pop ecx
jmp 0x1005165e
or dword [ebp - 4], 0xffffffff
jmp 0x10051668
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10052781
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100527c7
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100527bd
push 0
push 0
push 0
push 0xe72
push 0x6c5
push 0
push 0x1593
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x100527c5
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x100527df
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x5030
push 0
push dword [ebp - 8]
call fcn.1004593e
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10052bd9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10052c32
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x20], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call fcn.10052cb1
add esp, 0x20
jmp 0x10052cad
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10052ca2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jg 0x10052c8d
mov dword [ebp - 4], 1
jmp 0x10052c91
and dword [ebp - 4], 0
push 1
mov ecx, dword [ebp - 0x48]
call fcn.1001bad7
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x10052cad
push 0x1e5d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x10053457
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1005352a
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100534e0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0xffffffea
jmp 0x100534ad
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xa
jg 0x100534de
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100534dc
push 0x6942
push 0x503
push 0
push 0x1f4a
push 1
call fcn.100532b1
add esp, 0x14
jmp 0x100534a2
jmp 0x10053528
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1005350e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x10053528
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.1001bad7
and dword [eax], 0
jmp 0x10053503
jmp 0x1005357d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10053573
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10053571
push 0x1d1b
push 0
push 0x9d5
push 0
push 0
push 0x1db8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
jmp 0x1005357d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esp, ebp
pop ebp
ret

Function at 0x10053c6f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10053cb4
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10053caa
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x18e961ca
jmp 0x10053cb2
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x10053cd0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.1003bb0f
add esp, 0xc
mov esp, ebp
pop ebp
ret