joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b36d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test esi, esi
je 0x100b383
mov ax, word [esi]
cmp ax, word [esi + 2]
jl 0x100b38a
xor eax, eax
jmp 0x100b4ca
movsx eax, ax
imul eax, eax, 0x16
mov ecx, dword [ebp + 8]
push 0x26
mov dword [eax + esi + 0x10], ecx
mov ecx, dword [ebp + 0xc]
movsx eax, word [esi]
inc eax
push dword [ebp + 0x18]
imul eax, eax, 0x16
mov dword [eax + esi], ecx
mov ecx, dword [ebp + 0x10]
movsx eax, word [esi]
imul eax, eax, 0x16
mov dword [eax + esi + 0x1a], ecx
call fcn.01007829
mov edi, eax
test edi, edi
je 0x100b48f
cmp dword [0x103a780], 0
je 0x100b478
push dword [ebp + 0x18]
call fcn.0102a997
push dword [0x103a818]
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
mov dword [ebp + 0x14], eax
push dword [ebp + 0x18]
call ebx
pop ecx
test eax, eax
pop ecx
je 0x100b40a
inc eax
mov byte [eax], 0x26
lea edi, [eax + 1]
add eax, 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [edi]
jmp 0x100b40d
mov al, byte [edi + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, word [esi]
imul ecx, ecx, 0x16
mov edi, dword [ebp + 0x18]
mov word [ecx + esi + 0x14], ax
push dword [0x103a780]
push edi
call ebx
pop ecx
test eax, eax
pop ecx
je 0x100b43c
lea ecx, [eax + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x14]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x100b461
test cl, cl
je 0x100b45d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x100b461
inc eax
inc eax
inc edi
inc edi
test cl, cl
jne 0x100b43f
xor eax, eax
jmp 0x100b466
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100b49b
push dword [ebp + 0x18]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x100b49b
mov al, byte [edi + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ecx, word [esi]
imul ecx, ecx, 0x16
mov word [ecx + esi + 0x14], ax
jmp 0x100b49b
movsx eax, word [esi]
imul eax, eax, 0x16
and word [eax + esi + 0x14], 0
push dword [ebp + 0x18]
lea edi, [esi + 4]
push edi
call fcn.0100a220
movsx ecx, word [esi]
imul ecx, ecx, 0x16
push dword [ebp + 0x1c]
mov dword [ecx + esi + 8], eax
push edi
call fcn.0100a220
movsx ecx, word [esi]
imul ecx, ecx, 0x16
push 1
mov dword [ecx + esi + 0xc], eax
inc word [esi]
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x100bb8a
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x20]
push 0x26
push edi
call fcn.01007829
cmp dword [esp + 0x1c], 0
mov esi, eax
je 0x100bc64
test esi, esi
jne 0x100bbc9
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [edi + 1]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov byte [edi], 0x26
mov esi, edi
mov al, byte [esi + 1]
mov ebp, dword [sym.imp.USER32.dll_VkKeyScanA]
lea ebx, [esi + 1]
push eax
mov dword [esp + 0x18], esi
call ebp
mov ecx, dword [esp + 0x1c]
and dword [esp + 0x20], 0
mov dword [esp + 0x10], eax
cmp word [ecx], 0
jle 0x100bc64
mov edi, ebx
mov eax, dword [esp + 0x20]
imul eax, eax, 0x16
mov al, byte [eax + ecx + 0x14]
xor al, byte [esp + 0x10]
jne 0x100bc3a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
inc edi
cmp byte [esi], 0
je 0x100bc49
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push edi
call dword [sym.imp.MSVCRT.dll_memmove]
mov al, byte [edi]
add esp, 0xc
mov byte [esi], 0x26
push eax
call ebp
or dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
movsx eax, word [ecx]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jl 0x100bbf1
jmp 0x100bc64
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
mov byte [esi], 0x26
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 8
Function at 0x100bc6d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x103a83c]
push esi
push edi
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103a3c4]
call fcn.0100cc4b
test eax, eax
jne 0x100bc9f
call fcn.01024430
test eax, eax
je 0x100bdcb
cmp dword [0x103a794], 0
mov eax, 0x1001e18
jne 0x100bcb2
mov eax, 0x1001e20
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x120]
push 0x1001860
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x120]
push eax
call esi
push 1
lea eax, [ebp - 0x120]
pop edi
push 5
push eax
mov dword [0x103a6e0], edi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jbe 0x100bdc7
push 0
push 0x1001854
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [0x103a74c], eax
je 0x100bdcb
mov ecx, dword [0x103a7e0]
mov eax, dword [0x103a7e8]
sub eax, ecx
mov esi, dword [0x103a7e4]
cdq
sub eax, edx
push 0x10
sar eax, 1
dec eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], eax
mov eax, dword [0x103a7ec]
sub eax, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_memmove]
mov eax, dword [ebp - 8]
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_MoveWindow]
push edi
lea ecx, [eax + 2]
push dword [ebp - 4]
mov dword [ebp - 0x20], ecx
push eax
mov eax, dword [0x103a83c]
push dword [ebp - 0xc]
lea eax, [eax + eax*4]
push dword [ebp - 0x10]
shl eax, 4
push dword [eax + 0x103a3c0]
call esi
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [0x103a74c]
call esi
mov eax, dword [0x103a83c]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103a3c0]
push 0
push 0x429
push dword [0x103a74c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.01017fbb
mov eax, edi
jmp 0x100bdcd
xor eax, eax
pop edi
pop esi
leave
ret 4
Function at 0x100c2ef
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x10384b8]
push ebx
xor ebx, ebx
push esi
sub eax, ebx
push edi
je 0x100c310
dec eax
jne 0x100c3c9
push 1
pop eax
jmp 0x100c3cb
mov esi, 0x1001880
push esi
call fcn.0100c2b5
mov edi, eax
cmp edi, ebx
jne 0x100c339
lea eax, [ebp - 4]
push eax
push esi
call fcn.0100c93f
push dword [ebp - 4]
mov edi, eax
call fcn.0100e4d8
cmp edi, ebx
je 0x100c38d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001930
push edi
call esi
push 0x1001924
push edi
mov dword [0x10384b4], eax
call esi
push 0x1001910
push edi
mov dword [0x10384bc], eax
call esi
push 0x1001904
push edi
mov dword [0x103a9b4], eax
call esi
push 0x10018f8
push edi
mov dword [0x10384c8], eax
call esi
push 0x10018e8
push edi
mov dword [0x10384c4], eax
call esi
mov dword [0x103a9b0], eax
cmp dword [0x10384b4], ebx
je 0x100c3bf
cmp dword [0x10384bc], ebx
je 0x100c3bf
cmp dword [0x10384c8], ebx
je 0x100c3bf
cmp dword [0x10384c4], ebx
je 0x100c3bf
cmp dword [0x103a9b0], ebx
je 0x100c3bf
push 1
pop eax
mov dword [0x10384b8], eax
jmp 0x100c3cb
mov dword [0x10384b8], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100dd15
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
call fcn.0100dcca
mov ebx, eax
test bx, bx
je 0x100dda5
mov esi, dword [ebp + 0xc]
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
call fcn.0100e8ae
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
movzx eax, bx
push eax
lea eax, [ebp - 0x104]
push 0x1001a10
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call ebx
cmp eax, 0xffffffff
je 0x100dda5
push esi
call fcn.0100e8ae
push 0xc
push esi
call edi
add eax, esi
push eax
push dword [ebp + 8]
call fcn.0100e587
push esi
call ebx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x100dda7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100e0c2
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
movzx eax, word [esp + 4]
push ebx
push ebp
push esi
dec eax
push edi
je 0x100e1d4
dec eax
je 0x100e17d
dec eax
dec eax
je 0x100e0ee
mov dword [0x1038974], 6
xor esi, esi
jmp 0x100e1e4
mov esi, dword [esp + 0x18]
push 1
push 0x1a
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jge 0x100e197
push 0
push esi
call fcn.0100e9b8
push esi
call fcn.0100e8ae
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add eax, esi
push 0x1001e10
push eax
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100e16a
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.0100e8ae
push esi
call edi
mov edi, eax
push 0x1001e10
add edi, esi
push edi
call ebp
push esi
call ebx
cmp eax, 0xffffffff
je 0x100e178
push 0x1001a2c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x100e1e4
and byte [edi], 0
jmp 0x100e1e4
mov esi, dword [esp + 0x18]
push 1
push 0x1a
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jl 0x100e1c0
push esi
call fcn.0100e8ae
push 0x1001e10
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100e1cc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x100e1cc
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.0100e8ae
jmp 0x100e1e4
mov esi, dword [esp + 0x18]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test esi, esi
je 0x100e1f7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
call fcn.0100e8ae
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100e200
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and dword [0x1038974], 0
push esi
lea eax, [ebp - 0x104]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100e23a
test al, 0x10
jne 0x100e254
lea eax, [ebp - 0x104]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
call fcn.0100e8ae
lea eax, [ebp - 0x208]
push eax
push 0
lea eax, [ebp - 0x104]
push 0x1001da0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x208]
push eax
call fcn.0100e461
mov esi, eax
test esi, esi
je 0x100e29f
push esi
call fcn.01029675
test eax, eax
je 0x100e29f
push esi
call fcn.0100e4d8
mov dword [0x1038974], 1
xor eax, eax
jmp 0x100e2a1
mov eax, esi
pop esi
leave
ret
Function at 0x100e556
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x100e578
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100e578
and dword [0x1038974], 0
push 1
pop eax
jmp 0x100e584
mov dword [0x1038974], 3
xor eax, eax
ret 4

Function at 0x100e644
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
and dword [ebp - 4], 0
cmp dword [0x103a794], 0
push ebx
push esi
push edi
mov eax, 0x1001e18
jne 0x100e667
mov eax, 0x1001e20
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push 0x1001990
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10c]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push eax
lea eax, [ebp - 8]
push 3
mov ebx, 0x1001cf8
push eax
push ebx
push dword [ebp + 8]
mov edi, 0x1001988
push edi
call esi
cmp eax, 1
jbe 0x100e7ab
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x410]
push 0x304
push eax
push ebx
push dword [ebp + 8]
push edi
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [ebp - 0x410]
mov esi, eax
lea eax, [ebp - 0x410]
test cl, cl
je 0x100e71b
cmp cl, 0x2c
je 0x100e6f9
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov cl, byte [eax]
jmp 0x100e6e5
and byte [eax], 0
inc eax
push 0x201
push eax
lea esi, [esi + eax + 1]
push esi
call dword [sym.imp.MSVCRT.dll_memmove]
add esp, 0xc
and byte [esi + 0x200], 0
mov dword [ebp - 4], esi
lea eax, [ebp - 0x410]
push eax
call fcn.0100e8ae
push dword [ebp + 8]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x410]
push 1
push eax
jne 0x100e74d
call fcn.0100ddae
jmp 0x100e7ad
call fcn.0100ddae
mov esi, eax
test esi, esi
jne 0x100e7a7
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x100e764
mov ecx, 0x1001770
mov eax, dword [0x103a71c]
test eax, eax
jne 0x100e77e
mov eax, dword [0x103a83c]
lea eax, [eax + eax*4]
shl eax, 4
mov eax, dword [eax + 0x103a3c0]
mov edx, dword [0x103a78c]
or dx, 0x2011
push edx
push dword [0x103a728]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 1
jne 0x100e7a7
push eax
lea eax, [ebp - 0x410]
push eax
jmp 0x100e74d
mov eax, esi
jmp 0x100e7ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100e8ee
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push 0x1c
push esi
xor edi, edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jl 0x100e950
push esi
call fcn.0100e8ae
push esi
call ebp
push 0x1001e10
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100e943
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
jmp 0x100e946
push 1
pop edi
test edi, edi
je 0x100e954
push esi
call fcn.0100e8ae
test edi, edi
jne 0x100e9a0
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
call fcn.0100e8ae
push esi
call ebp
mov edi, eax
push 0x1001e10
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100e99a
push 0x1001a30
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call ebx
cmp eax, 0xffffffff
jne 0x100e99a
and byte [edi], 0
jmp 0x100e9a0
push esi
call fcn.0100e8ae
push 0xc
push esi
call ebp
add eax, esi
push eax
push dword [esp + 0x1c]
call fcn.0100e587
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x100e9b8
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
push 0
mov esi, 0x104
push 0x1001998
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100ea0a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
push 0
push str.SharedDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
jne 0x100ea27
cmp byte [ebp + 0xc], 1
push esi
push dword [ebp + 8]
jne 0x100ea21
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
jmp 0x100ea27
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop esi
leave
ret 8
Function at 0x10176ac
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
mov eax, dword [0x103a6f8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jne 0x10176c9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xc]
cmp word [eax + 0x3a], 0xf
jne 0x1017708
push dword [ebp + 0xc]
push 0xb0
call fcn.01023cda
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
call fcn.01024aef
jmp 0x1017812
cmp dword [0x103a890], ebx
jne 0x10177ab
push 1
push 0x32
call fcn.01023cda
push eax
call fcn.0100c175
mov edi, eax
cmp edi, ebx
je 0x1017812
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001ca0
push edi
call esi
push 0x1001cb0
push edi
mov dword [0x103a890], eax
call esi
push 0x1001cc0
push edi
mov dword [0x103a88c], eax
call esi
push 0x1001cd0
push edi
mov dword [0x103a89c], eax
call esi
push 0x1001ce0
push edi
mov dword [0x103a898], eax
call esi
cmp dword [0x103a890], ebx
mov dword [0x103a894], eax
je 0x10177a0
cmp dword [0x103a88c], ebx
je 0x10177a0
cmp dword [0x103a89c], ebx
je 0x10177a0
cmp dword [0x103a898], ebx
je 0x10177a0
cmp eax, ebx
je 0x10177a0
cmp dword [0x1038abc], ebx
jne 0x10177a8
mov dword [0x103a890], ebx
jmp 0x1017812
mov esi, dword [ebp + 8]
cmp dword [0x103a834], ebx
je 0x10177da
push dword [ebp + 0xc]
push 0x37
call fcn.01023cda
push eax
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x374]
push eax
call fcn.01024477
push dword [0x103a71c]
push fcn.01033dad
call dword [0x1038abc]
push dword [ebp + 0x10]
movzx eax, word [0x1037ac4]
push dword [ebp - 4]
push eax
mov eax, dword [esi + 0xc]
push ebx
push dword [eax + 0x3e]
push dword [ebp + 0xc]
call dword [0x103a890]
cmp eax, ebx
mov dword [0x1037aac], eax
jg 0x1017819
xor eax, eax
jmp 0x10178cf
push esi
call fcn.010178d6
mov esi, eax
cmp esi, ebx
jne 0x10178b2
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push 0x1001dd8
push eax
call fcn.0102a612
lea eax, [ebp - 0x108]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
mov byte [eax + 1], bl
lea eax, [ebp - 0x108]
push 0x1001cec
push eax
call edi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
push dword [0x1037aac]
call dword [0x103a88c]
mov esi, eax
push dword [0x1037aac]
call dword [0x103a894]
or dword [0x1037aac], 0xffffffff
push ebx
push ebx
call dword [0x1038abc]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1020945
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push esi
call fcn.010208d4
test edi, edi
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
je 0x1020a32
cmp edi, 0xffffffff
je 0x1020a60
cmp dword [esi], 3
jne 0x1020a16
lea eax, [ebp + 0xc]
lea edx, [ebp + 0x14]
push eax
lea ecx, [ebp - 0xc]
call fcn.01020a66
mov esi, dword [esi + 4]
lea eax, [ebp - 0xc]
push eax
push 2
push 0x706a
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
mov dword [ebp + 8], eax
je 0x1020a60
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x1020a0b
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x1020a00
push dword [ebp + 8]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
test eax, eax
je 0x1020a00
push 0xcc0020
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push 0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.GDI32.dll_StretchBlt]
test edi, edi
je 0x1020a0b
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1020a60
push 0
push edx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1020a60
cmp edi, 0xffffffff
je 0x1020a60
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
add eax, ecx
push 0xaa
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 0
push eax
push dword [esi + 4]
add edx, edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
call fcn.01027db8
pop edi
pop esi
leave
ret 0x14

Function at 0x1020bce
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
xor esi, esi
mov eax, 0x1038da0
cmp dword [eax], ebx
je 0x1020be9
add eax, 0x12
inc esi
cmp eax, 0x1039124
jl 0x1020bda
cmp esi, 0x32
jne 0x1020c0d
cmp dword [0x103a6e0], ebx
je 0x1020c06
push 0x424
call fcn.01023cda
push eax
call fcn.01024aef
xor eax, eax
jmp 0x1020c8e
push 0x26
push dword [esp + 0x1c]
call fcn.01007829
cmp eax, ebx
je 0x1020c3e
mov al, byte [eax + 1]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
lea esi, [esi + esi*8]
mov edi, eax
push dword [esp + 0x18]
shl esi, 1
call fcn.0102a997
mov dword [esi + 0x1038da8], eax
jmp 0x1020c4b
lea esi, [esi + esi*8]
xor edi, edi
shl esi, 1
mov dword [esi + 0x1038da8], ebx
mov eax, dword [esp + 0x10]
push dword [esp + 0x14]
mov dword [esi + 0x1038da0], eax
call fcn.0102a997
cmp dword [0x103a884], ebx
mov dword [esi + 0x1038da4], eax
mov word [esi + 0x1038db0], di
je 0x1020c78
or eax, 0xffffffff
jmp 0x1020c7d
mov eax, dword [0x103a83c]
mov dword [esi + 0x1038dac], eax
xor eax, eax
cmp dword [esi + 0x1038da4], ebx
setne al
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x102467c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x103a70c], edi
je 0x102469d
mov dword [0x103a70c], edi
jmp 0x10247ea
cmp dword [0x103a700], edi
jne 0x10247ea
cmp dword [0x10388d0], 5
jge 0x102484a
inc dword [0x10388d0]
cmp dword [ebp + 0x10], 2
je 0x10246c8
cmp dword [ebp + 0x10], 3
jne 0x10246d2
mov dword [0x103a858], 1
mov ebx, dword [ebp + 8]
cmp ebx, edi
je 0x10246f0
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10246ec
mov ebx, dword [0x103a71c]
jmp 0x102470e
cmp ebx, edi
jne 0x102470e
mov eax, dword [0x103a71c]
cmp eax, edi
je 0x10246fd
mov ebx, eax
jmp 0x102470e
mov eax, dword [0x103a83c]
lea eax, [eax + eax*4]
shl eax, 4
mov ebx, dword [eax + 0x103a3c0]
mov esi, dword [ebp + 0xc]
cmp esi, 2
je 0x1024732
cmp esi, 0x2328
jl 0x1024726
cmp esi, 0x238b
jle 0x1024732
push dword [ebp + 0x14]
push esi
call fcn.01023cda
push eax
jmp 0x1024739
push esi
push dword [0x103a784]
lea eax, [ebp - 0x100]
push 0x10023dc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [0x103a884], edi
je 0x1024760
push edi
push 1
push edi
push edi
call fcn.0101ce98
cmp dword [0x103a720], edi
je 0x1024776
push 0x63
push dword [0x103a3c0]
call dword [sym.imp.USER32.dll_KillTimer]
cmp esi, 2
mov edi, 0x2010
jne 0x1024784
mov eax, edi
jmp 0x102478d
mov eax, dword [0x103a78c]
or ax, 0x2040
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push eax
push dword [0x103a728]
lea eax, [ebp - 0x100]
push eax
push ebx
call esi
test eax, eax
jne 0x10247cc
cmp dword [ebp + 0xc], 2
jne 0x10247cc
mov eax, dword [0x103a78c]
or eax, edi
push eax
push dword [0x103a728]
push dword [0x103a784]
push ebx
call esi
mov dword [ebp + 0x10], 2
cmp dword [0x103a720], 0
je 0x10247ea
push 0
push 0x2710
push 0x63
push dword [0x103a3c0]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x10]
dec eax
je 0x1024844
dec eax
dec eax
je 0x10247fb
call fcn.01024b31
jmp 0x102483b
call fcn.0100cc36
mov esi, eax
lea eax, [ebp - 0x214]
push 0x10023cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esi + 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.01024b31
lea eax, [ebp - 0x214]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0xffffffffffffffff
call dword [sym.imp.MSVCRT.dll__exit]
pop ecx
dec dword [0x10388d0]
pop edi
pop esi
pop ebx
leave
ret 0x10