joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110f1d10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov esi, ecx
call edi
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
push eax
mov dword [esi], eax
call dword [sym.imp.KeRneL32.DLl_EnterCriticalSection]
call edi
mov dword [esi + 8], eax
sub eax, dword [esi + 4]
cmp eax, 0x64
jb 0x110f1d49
push eax
push 0x111b26d4
call fcn.11147060
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x110f37a0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push 0x14
push pe_nt_image_headers32
call dword [sym.imp.KeRneL32.DLl_LocalAlloc]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jne 0x110f37d2
push 0x1d5f
push 0x111b2880
push 0x111b2d20
call fcn.11029a70
add esp, 0xc
push 1
push esi
call dword [sym.imp.aDvapi32.DLL_InitializeSecurityDescriptor]
push 0
push 0
push 1
push esi
call dword [sym.imp.aDvapi32.DLL_SetSecurityDescriptorDacl]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x3e8
push ecx
push edx
push 1
push 6
push 3
push ebx
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 1
xor edi, edi
call dword [sym.imp.KeRneL32.DLl_CreateNamedPipeA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x110f386b
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push ebx
push 0x111b2cf8
call fcn.11147060
add esp, 0xc
cmp edi, 5
jge 0x110f386b
push 0x3e8
call dword [sym.imp.KeRneL32.DLl_Sleep]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push 0x3e8
push ecx
push edx
push 1
push 6
push 3
push ebx
inc edi
call dword [sym.imp.KeRneL32.DLl_CreateNamedPipeA]
mov esi, eax
cmp esi, 0xffffffff
je 0x110f3820
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KeRneL32.DLl_LocalFree]
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x110f3880
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0
push 0
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 3
call dword [sym.imp.KeRneL32.DLl_SetNamedPipeHandleState]
mov ecx, dword [edi]
test ecx, ecx
jne 0x110f38cb
mov ebx, dword [sym.imp.KeRneL32.DLl_ConnectNamedPipe]
push 0
push esi
call ebx
test eax, eax
jne 0x110f38d2
call dword [sym.imp.KeRneL32.DLl_GetLastError]
cmp eax, 0x217
je 0x110f38d2
push 0x64
call dword [sym.imp.KeRneL32.DLl_Sleep]
mov edx, dword [edi]
test edx, edx
je 0x110f38a7
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 4]
push eax
push esi
mov dword [ebp - 4], 2
call dword [sym.imp.KeRneL32.DLl_SetNamedPipeHandleState]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x110f3930
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push esi
push edi
mov dword [ebp - 4], 4
call fcn.11143bd0
add esp, 0x18
test eax, eax
jne 0x110f3977
cmp dword [ebp - 8], 4
jne 0x110f3977
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x110f3977
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push esi
push edi
call dword [sym.imp.aDvapi32.DLL_RegSetValueExA]
test eax, eax
je 0x110f39a0
mov edx, dword [ebp + 0x10]
push edx
push esi
push eax
push 0x111b2d24
call fcn.11147060
add esp, 0x10
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x110f3b70
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0
push 5
mov ebx, ecx
call fcn.11145c70
add esp, 0xc
test eax, eax
je 0x110f3bf2
push 0
call dword [sym.imp.uSEr32.dll_GetDC]
mov edi, eax
call dword [sym.imp.WinMM.DlL_timeGetTime]
push 0
push 0
push 0
push 0
push 0x4e534735
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.Gdi32.Dll_ExtEscape]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.WinMM.DlL_timeGetTime]
sub eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
push edi
push 0x111b2d74
call fcn.11147060
add esp, 0x10
push edi
push 0
call dword [sym.imp.uSEr32.dll_ReleaseDC]
cmp dword [ebp - 0x1c], 0x4e534735
je 0x110f3cda
push esi
call dword [sym.imp.Gdi32.Dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x110f3cda
push 0x54
push 0x54
push esi
call dword [sym.imp.Gdi32.Dll_CreateCompatibleBitmap]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x110f3cd3
mov ecx, dword [ebx + 0x708]
mov ebx, dword [ebx + 0x70c]
push eax
push edi
mov dword [ebp - 0x18], ecx
call dword [sym.imp.Gdi32.Dll_SelectObject]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
push 0xcc0020
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
add ebx, 0x2a
push ebx
add eax, 0x2a
push eax
push esi
push 0x2a
push 0x2a
push 0x2a
push 0x2a
push edi
mov dword [ebp - 0x18], eax
call dword [sym.imp.Gdi32.Dll_BitBlt]
push 0
push 0x18
push 0x111b2d58
mov eax, 0x2a
lea edx, [ebp - 0x14]
push edx
push 4
push eax
push eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.Gdi32.Dll_ExtTextOutA]
mov eax, dword [ebp - 0x18]
push 0xcc0020
push 0x2a
push 0x2a
push edi
push 0x2a
push 0x2a
push ebx
push eax
push esi
call dword [sym.imp.Gdi32.Dll_BitBlt]
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
sub eax, dword [ebp - 0x1c]
cmp eax, 0x64
jbe 0x110f3cbe
push eax
push 0x111b2d40
call fcn.11147060
add esp, 8
mov ecx, dword [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.Gdi32.Dll_SelectObject]
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.Gdi32.Dll_DeleteObject]
push edi
call dword [sym.imp.Gdi32.Dll_DeleteDC]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x110f4990
Capabilities:
Check for time delay via gettickcount
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x110f4a37
cmp dword [eax + 0x70], 0
je 0x110f4a37
cmp dword [eax + 0x6c], 0
je 0x110f4a37
lea edi, [eax + 0x5c]
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
test al, al
jne 0x110f49e8
push 0x255
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
push ebx
mov ebx, dword [edi + 0xc]
mov edi, dword [esi + 0x14]
mov eax, dword [edi + 0x4c]
mov edx, dword [eax]
lea ecx, [edi + 0x4c]
call edx
test al, al
jne 0x110f4a14
push 0x255
push 0x11195b24
push 0x11195b1c
call fcn.11029a70
add esp, 0xc
mov edi, dword [edi + 0x58]
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 8]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [eax + 0x6c]
push ebx
push edi
push edx
mov edx, dword [eax + 0x70]
push ecx
push edx
call fcn.110ada40
add esp, 0x18
pop ebx
jmp 0x110f4a54
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 8]
push ecx
mov ecx, dword [esi + 4]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.aDvapi32.DLL_LogonUserA]
mov edi, eax
call dword [sym.imp.KeRneL32.DLl_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x64
jb 0x110f4a83
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x110f4a70
mov ecx, 0x111aafc0
push edi
push eax
mov eax, dword [esi]
push ecx
push eax
push 0x111b2fb8
call fcn.11147060
add esp, 0x14
test edi, edi
jne 0x110f4a97
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KeRneL32.DLl_GetLastError]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x110f51f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x111b3120
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call dword [sym.imp.KeRneL32.DLl_LoadLibraryA]
mov dword [esi + 0x30], eax
cmp eax, edi
jne 0x110f5255
push 0x29b7
push 0x111b2880
push 0x111b3110
call fcn.11029a70
add esp, 0xc
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x110f531a
mov edi, dword [sym.imp.KeRneL32.DLl_GetProcAddress]
push 0x111b3104
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x30]
push 0x111b30f8
push eax
call edi
mov ecx, dword [esi + 0x30]
push 0x111b30f0
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x30]
push 0x111b30e4
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x30]
push 0x111b30dc
push eax
call edi
mov ecx, dword [esi + 0x30]
push 0x111b30d4
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x30]
push 0x111b30cc
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x30]
push 0x111b30c4
push eax
call edi
mov ecx, dword [esi + 0x30]
push 0x111b30bc
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x30]
push 0x111b30b4
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x30]
push 0x111b30a8
push eax
call edi
mov ecx, dword [esi + 0x30]
push 0x111b3098
push ecx
mov dword [esi + 0x28], eax
call edi
lea edx, [ebp - 0x194]
push edx
mov dword [esi + 0x2c], eax
mov eax, dword [esi]
push 0x101
call eax
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x110f64d0
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0x1119b66c
push ebx
call fcn.11081e70
add esp, 8
test eax, eax
jne 0x110f650b
mov ecx, dword [0x111ee308]
mov eax, dword [ecx]
mov edx, dword [eax + 0x158]
push 0
push 0
call edx
mov eax, dword [ebp + 0xc]
push eax
push ebx
push 0x111b333c
call fcn.11147060
add esp, 0xc
push 0xf003f
push 0
push 0
call dword [sym.imp.aDvapi32.DLL_OpenSCManagerA]
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x110f6547
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
push edi
push 0x24
push ebx
push esi
call dword [sym.imp.aDvapi32.DLL_OpenServiceA]
mov edi, eax
mov dword [ebp - 0x2c], edi
test edi, edi
jne 0x110f658a
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push ebx
push 0x111b3318
call fcn.11147060
add esp, 0xc
push esi
call dword [sym.imp.aDvapi32.DLL_CloseServiceHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.aDvapi32.DLL_QueryServiceStatus]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp eax, 4
jne 0x110f66af
lea edx, [ebp - 0x20]
push edx
push 1
push edi
call dword [sym.imp.aDvapi32.DLL_ControlService]
test eax, eax
jne 0x110f65ec
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push ebx
push 0x111b32f4
call fcn.11147060
mov esi, dword [sym.imp.aDvapi32.DLL_CloseServiceHandle]
add esp, 0xc
push edi
call esi
mov eax, dword [ebp - 0x28]
push eax
call esi
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x110f66af
jmp 0x110f6600
mov ecx, dword [0x111ee10c]
test ecx, ecx
je 0x110f662a
mov edi, dword [ebp + 0xc]
add edi, 0xfffffed4
cmp esi, edi
jge 0x110f6627
push ebx
push 0x111b32c4
call fcn.11147060
add esp, 8
mov esi, edi
mov edi, dword [ebp - 0x2c]
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.aDvapi32.DLL_QueryServiceStatus]
test eax, eax
je 0x110f6682
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
je 0x110f6644
mov dword [ebp - 0x24], eax
cmp eax, 1
je 0x110f6699
cmp eax, 3
jne 0x110f6672
cmp dword [0x111ee254], 0
jne 0x110f6660
cmp dword [0x111ee268], 0
je 0x110f6672
push 0x1119b66c
push ebx
call fcn.11081e70
add esp, 8
test eax, eax
je 0x110f66a1
push 0x64
call dword [sym.imp.KeRneL32.DLl_Sleep]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x110f6600
jmp 0x110f66af
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
push ebx
push 0x111b32a0
call fcn.11147060
add esp, 0xc
jmp 0x110f66af
push ebx
push 0x111b3294
jmp 0x110f66a7
push ebx
push 0x111b3284
call fcn.11147060
add esp, 8
mov esi, dword [sym.imp.aDvapi32.DLL_CloseServiceHandle]
push edi
call esi
mov eax, dword [ebp - 0x28]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x110f9120
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.uSEr32.dll_CharNextA]
push ebx
call edi
push ebx
mov esi, eax
call edi
cmp byte [esi], 0x22
mov ebx, eax
je 0x110f914f
mov edi, edi
push esi
call edi
mov esi, eax
mov al, byte [esi]
test al, al
je 0x110f9189
cmp al, 0x22
jne 0x110f9140
push esi
call edi
push eax
call edi
push 5
push 0
push eax
push ebx
mov byte [esi], 0
mov eax, dword [0x111ee160]
push 0x11198240
push eax
call dword [sym.imp.ShELL32.dll_ShellExecuteA]
push 0
mov esi, eax
call fcn.11162777
add esp, 4
cmp esi, 0x20
jbe 0x110f9195
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop edi
pop esi
mov eax, 0xd
pop ebx
pop ebp
ret 8
call dword [sym.imp.KeRneL32.DLl_GetLastError]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x110f91b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x111ec774]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x110], eax
mov eax, dword [0x111f1770]
push esi
push edi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x110f92c4
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.110963a0
push eax
call dword [sym.imp.KeRneL32.DLl_GetModuleFileNameA]
lea edx, [ebp - 0x108]
push 0x5c
push edx
call fcn.11081e00
mov ecx, dword [0x111b390c]
mov esi, dword [sym.imp.KeRneL32.DLl_LoadLibraryExA]
mov dword [eax], ecx
mov edx, dword [0x111b3910]
add esp, 8
mov dword [eax + 4], edx
mov ecx, dword [0x111b3914]
push 2
push 0
lea edx, [ebp - 0x108]
push edx
mov dword [eax + 8], ecx
call esi
mov dword [0x111f1770], eax
test eax, eax
jne 0x110f92c4
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KeRneL32.DLl_GetSystemDirectoryA]
lea eax, [ebp - 0x108]
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x110f9260
mov ecx, dword [0x111b390c]
mov edx, dword [0x111b3910]
mov dword [eax], ecx
mov ecx, dword [0x111b3914]
push 2
mov dword [eax + 4], edx
push 0
lea edx, [ebp - 0x108]
push edx
mov dword [eax + 8], ecx
call esi
mov dword [0x111f1770], eax
test eax, eax
jne 0x110f92c4
call dword [sym.imp.KeRneL32.DLl_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x111b38ec
call fcn.11147ad0
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x110]
push ecx
push 0
lea edx, [ebp - 0x10c]
push edx
push 0
push edi
push eax
push 0x900
call dword [sym.imp.KeRneL32.DLl_FormatMessageA]
test eax, eax
jne 0x110f9306
push edi
push 0x111b38d4
call fcn.11147ad0
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10c]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x110f9311
sub eax, esi
add eax, ecx
cmp eax, ecx
jbe 0x110f9333
dec eax
cmp byte [eax], 0x20
jge 0x110f9333
mov byte [eax], 0
mov ecx, dword [ebp - 0x10c]
cmp eax, ecx
ja 0x110f9320
test ebx, ebx
je 0x110f9348
push ebx
push ecx
push 0x1119e724
call fcn.11147ad0
add esp, 0xc
jmp 0x110f9353
push 0
push ecx
call fcn.11142e60
add esp, 8
mov ebx, eax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KeRneL32.DLl_LocalFree]
push 0x111b38cc
push ebx
call fcn.11165250
add esp, 8
test eax, eax
je 0x110f9395
lea esi, [eax + 4]
mov ecx, esi
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x110f9380
sub ecx, edi
inc ecx
push ecx
push esi
push eax
call fcn.11163150
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.11162bb7
mov esp, ebp
pop ebp
ret
Function at 0x110f9a70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, ebx
test ebx, ebx
jne 0x110f9a85
lea edi, [ebp - 0x10]
push 0x44
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.11162be0
mov eax, dword [ebp + 0x24]
add esp, 0xc
test eax, eax
jne 0x110f9a9f
lea eax, [ebp - 0x54]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x18]
push edi
push eax
push ecx
mov ecx, dword [ebp + 8]
push 0
push edx
mov dword [eax], 0x44
mov eax, dword [ebp + 0x14]
push eax
push 0
push 0
push ecx
push 0
call dword [sym.imp.KeRneL32.DLl_CreateProcessA]
mov esi, eax
test esi, esi
je 0x110f9af1
cmp dword [ebp + 0x1c], 0
je 0x110f9adc
mov edx, dword [edi]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KeRneL32.DLl_WaitForSingleObject]
test ebx, ebx
jne 0x110f9af1
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.KeRneL32.DLl_CloseHandle]
push eax
call ebx
mov ecx, dword [edi]
push ecx
call ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x110fa3b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx - 0x1d]
push edi
mov edi, ecx
cmp eax, 0xc4
ja case.0x110fa3ce.30
movzx eax, byte [eax + 0x110fa5b8]
jmp dword [eax*4 + 0x110fa59c]
xor ecx, ecx
cmp dword [0x111f1780], ecx
pop edi
sete cl
pop ebx
mov dword [0x111f1780], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x111f177c], 1
jmp case.0x110fa3ce.30
mov dword [0x111f177c], 0
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 1
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 0
xor ecx, ecx
cmp dword [0x111f1780], ecx
mov dword [0x111f1780], 0
setne cl
mov dword [ebp + 8], ecx
test bl, bl
jns 0x110fa43e
or ecx, 2
mov dword [ebp + 8], ecx
and ebx, 0x7f
lea eax, [ebx - 0x5b]
push esi
cmp eax, 0x17
ja case.0x110fa451.94
movzx edx, byte [eax + 0x110fa68c]
jmp dword [edx*4 + 0x110fa680]
mov esi, ebx
jmp 0x110fa495
cmp dword [ebp + 0x10], 0
je case.0x110fa451.94
xor eax, eax
cmp ebx, 0x71
sete al
or ebx, 0x80
and ecx, 0xfffffffd
mov dword [ebp + 8], ecx
lea esi, [eax*4 + 0x15]
jmp 0x110fa495
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
push ebx
call dword [sym.imp.uSEr32.dll_MapVirtualKeyA]
mov esi, eax
cmp ebx, 0x46
jne 0x110fa4b4
cmp esi, 0x91
jne 0x110fa52b
cmp dword [0x111f177c], 0
je 0x110fa52b
lea esi, [ebx - 0x43]
jmp 0x110fa52b
cmp ebx, 0x37
jne 0x110fa4ce
cmp esi, 0x6a
jne 0x110fa52b
test byte [ebp + 8], 1
je 0x110fa52b
lea esi, [ebx - 0xb]
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x110fa52b
cmp ebx, 0x54
jne 0x110fa4e4
cmp esi, 0x2c
jne 0x110fa52b
lea ebx, [esi - 0x2b]
mov dword [ebp + 8], 0
jmp 0x110fa52b
cmp ebx, 0x45
jne 0x110fa52b
cmp dword [0x111f177c], 0
jne 0x110fa4fb
cmp dword [0x111f1774], 0
je 0x110fa510
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x9d
mov ecx, edi
call eax
mov esi, 0x13
jmp 0x110fa515
cmp esi, 0x13
jne 0x110fa527
mov ecx, dword [ebp + 8]
shr ecx, 1
not ecx
and ecx, 1
mov dword [0x111f1774], ecx
jmp 0x110fa52b
or dword [ebp + 8], 1
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.uSEr32.dll_PeekMessageA]
push 0x90
call dword [sym.imp.uSEr32.dll_GetKeyState]
test al, 1
je 0x110fa57a
test byte [ebp + 8], 1
jne 0x110fa57a
push esi
push 0x111ea890
call fcn.11165010
add esp, 8
test eax, eax
je 0x110fa57a
sub eax, 0x111ea890
mov esi, eax
cmp esi, 9
ja 0x110fa575
add esi, 0x60
jmp 0x110fa57a
mov esi, 0x6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 0
push ecx
push ebx
push esi
mov ecx, edi
call edx
push ebx
mov ecx, edi
call fcn.110f8e60
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x110fa3ee
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx - 0x1d]
push edi
mov edi, ecx
cmp eax, 0xc4
ja case.0x110fa3ce.30
movzx eax, byte [eax + 0x110fa5b8]
jmp dword [eax*4 + 0x110fa59c]
xor ecx, ecx
cmp dword [0x111f1780], ecx
pop edi
sete cl
pop ebx
mov dword [0x111f1780], ecx
mov esp, ebp
pop ebp
ret 0xc
mov dword [0x111f177c], 1
jmp case.0x110fa3ce.30
mov dword [0x111f177c], 0
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 1
jmp case.0x110fa3ce.30
mov dword [0x111f1778], 0
xor ecx, ecx
cmp dword [0x111f1780], ecx
mov dword [0x111f1780], 0
setne cl
mov dword [ebp + 8], ecx
test bl, bl
jns 0x110fa43e
or ecx, 2
mov dword [ebp + 8], ecx
and ebx, 0x7f
lea eax, [ebx - 0x5b]
push esi
cmp eax, 0x17
ja case.0x110fa451.94
movzx edx, byte [eax + 0x110fa68c]
jmp dword [edx*4 + 0x110fa680]
mov esi, ebx
jmp 0x110fa495
cmp dword [ebp + 0x10], 0
je case.0x110fa451.94
xor eax, eax
cmp ebx, 0x71
sete al
or ebx, 0x80
and ecx, 0xfffffffd
mov dword [ebp + 8], ecx
lea esi, [eax*4 + 0x15]
jmp 0x110fa495
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
setne cl
lea ecx, [ecx + ecx + 1]
push ecx
push ebx
call dword [sym.imp.uSEr32.dll_MapVirtualKeyA]
mov esi, eax
cmp ebx, 0x46
jne 0x110fa4b4
cmp esi, 0x91
jne 0x110fa52b
cmp dword [0x111f177c], 0
je 0x110fa52b
lea esi, [ebx - 0x43]
jmp 0x110fa52b
cmp ebx, 0x37
jne 0x110fa4ce
cmp esi, 0x6a
jne 0x110fa52b
test byte [ebp + 8], 1
je 0x110fa52b
lea esi, [ebx - 0xb]
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x110fa52b
cmp ebx, 0x54
jne 0x110fa4e4
cmp esi, 0x2c
jne 0x110fa52b
lea ebx, [esi - 0x2b]
mov dword [ebp + 8], 0
jmp 0x110fa52b
cmp ebx, 0x45
jne 0x110fa52b
cmp dword [0x111f177c], 0
jne 0x110fa4fb
cmp dword [0x111f1774], 0
je 0x110fa510
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x9d
mov ecx, edi
call eax
mov esi, 0x13
jmp 0x110fa515
cmp esi, 0x13
jne 0x110fa527
mov ecx, dword [ebp + 8]
shr ecx, 1
not ecx
and ecx, 1
mov dword [0x111f1774], ecx
jmp 0x110fa52b
or dword [ebp + 8], 1
push 2
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.uSEr32.dll_PeekMessageA]
push 0x90
call dword [sym.imp.uSEr32.dll_GetKeyState]
test al, 1
je 0x110fa57a
test byte [ebp + 8], 1
jne 0x110fa57a
push esi
push 0x111ea890
call fcn.11165010
add esp, 8
test eax, eax
je 0x110fa57a
sub eax, 0x111ea890
mov esi, eax
cmp esi, 9
ja 0x110fa575
add esi, 0x60
jmp 0x110fa57a
mov esi, 0x6e
mov ecx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0x78]
push 0
push ecx
push ebx
push esi
mov ecx, edi
call edx
push ebx
mov ecx, edi
call fcn.110f8e60
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc