joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022cf0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x61c]
sub esp, 0x61c
push 0xffffffffffffffff
push 0x10045dad
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0x618], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x624]
mov edi, 0x10067a58
mov eax, dword [edi]
mov esi, dword [edi + 4]
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push 0x410
push eax
call fcn.10014f40
add esp, 0xc
lea edx, [ebp]
mov ecx, esi
call fcn.10015ae0
test al, al
je 0x10022d74
cmp word [ebp], 0
je 0x10022dcb
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
jmp 0x10022dcb
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
call fcn.10015d30
mov esi, dword [ebp - 0x14]
test al, al
je 0x10022dab
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x10022dbd
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
add edi, 0xc
cmp edi, 0x10067a94
jne 0x10022d34
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInetStp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022ee9
push eax
lea eax, [ebp + 0x208]
push 0x208
push eax
call fcn.10014f40
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 2
push eax
lea eax, [ebp + 0x208]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.PathWWWRoot
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10022ee9
push esi
lea eax, [ebp + 0x410]
push 0x208
push eax
call fcn.10014f40
add esp, 0xc
lea eax, [ebp + 0x410]
push 0x104
push eax
lea eax, [ebp + 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [ebp + 0x410]
cmp word [ebp + 0x410], cx
je 0x10022ed6
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10022e98
test ecx, ecx
je 0x10022ed6
cmp word [ebp + ecx*2 + 0x40e], 0x5c
je 0x10022ed6
mov eax, 0x5c
mov word [ebp + ecx*2 + 0x410], ax
lea eax, [ecx*2 + 2]
cmp eax, 0x208
jae 0x10022f10
xor ecx, ecx
mov word [ebp + eax + 0x410], cx
lea eax, [ebp + 0x410]
push eax
push str.IIsWWWRootFolder
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0x61c]
pop ebp
ret 4
call fcn.1002cf97
int3
Function at 0x100247c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100463ed
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
mov edx, str.AI_USER_IGNORE_MSI
call fcn.10016940
mov edx, dword [ebp - 0x20]
xor ecx, ecx
add esp, 4
mov eax, edx
cmp word [edx], cx
je 0x10024835
nop
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x10024820
test ecx, ecx
je 0x10024835
xor bl, bl
jmp 0x10024938
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov edi, eax
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test edi, edi
jne 0x10024856
xor bl, bl
jmp 0x1002492d
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002486b
push eax
call esi
cmp byte [ebp + 0xc], 0
mov ecx, str.SELECT__UserName__FROM__AI_UserAccounts__WHERE__UserName____
mov eax, str.SELECT__GroupName__FROM__AI_UserGroups__WHERE__GroupName____
mov dword [ebp - 0x10], 0
cmove eax, ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
push edi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
je 0x1002489a
xor bl, bl
jmp 0x1002491f
push 1
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov byte [ebp - 4], 3
test edi, edi
je 0x1002490f
push ebx
push 1
push edi
call dword [sym.imp.msi.dll_MsiReinstallFeatureW]
test eax, eax
jne 0x1002490f
push edi
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
test eax, eax
jne 0x1002490f
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100248dc
push eax
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
jne 0x100248fd
cmp dword [ebp - 0x14], eax
je 0x100248fd
mov bl, 1
jmp 0x100248ff
xor bl, bl
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10024911
push eax
call esi
jmp 0x10024911
xor bl, bl
mov byte [ebp - 4], 2
test edi, edi
je 0x1002491c
push edi
call esi
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002492d
push eax
call esi
mov byte [ebp - 4], 0
test edi, edi
je 0x10024938
push edi
call esi
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x20], 0
mov al, bl
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027a30
Capabilities:
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x438]
sub esp, 0x438
push 0xffffffffffffffff
push 0x10047075
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0x434], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x1c], esi
push 0
lea eax, [ebp + 0x22c]
push 0x208
push eax
call fcn.10014f40
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x22c]
push eax
push str.CustomActionData
push ebx
call dword [sym.imp.msi.dll_MsiGetSummaryInformationW]
cmp esi, 1
jne 0x10027aba
push str.Stopped
push str.AI_PROCESS_STATE
push ebx
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
mov dword [ebp - 0x30], 0x10053974
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1005bbc4
push esi
call edi
push 0
push 2
call eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x10053944
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 1
lea eax, [ebp]
push 0x22c
push 0
push eax
call fcn.1002e160
push 0
lea eax, [ebp]
push 0x22c
push eax
call fcn.10014f40
add esp, 0x18
mov dword [ebp], 0x22c
push 0x1005bba4
push esi
call edi
push 0x1005bbb4
push dword [ebp - 0x10]
mov esi, eax
call edi
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp]
push eax
push edi
call esi
test eax, eax
je 0x10027ba7
mov esi, dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
lea eax, [ebp + 0x22c]
push eax
lea eax, [ebp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10027b9b
mov eax, dword [ebp - 0x1c]
sub eax, 1
je 0x10027b8e
sub eax, 1
jne 0x10027b9b
push dword [ebp + 8]
push eax
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10027b9b
push str.Running
push str.AI_PROCESS_STATE
push ebx
call esi
lea eax, [ebp]
push eax
push edi
call dword [ebp - 0x20]
test eax, eax
jne 0x10027b55
mov byte [ebp - 4], 0
mov dword [ebp - 0x28], 0x10053944
test edi, edi
je 0x10027bc4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], 0x10053974
test eax, eax
je 0x10027be7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x2c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x434]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0x438]
pop ebp
ret
Function at 0x10027e00
Capabilities:
Enumerate services

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047105
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10067024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x10027f8e
mov esi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 1
push 0x30
push ebx
mov dword [ebp - 0x18], 0
call esi
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
call edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 1
push 0x30
push ebx
call esi
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 1
xor ecx, ecx
imul esi, dword [ebp - 0x10], 0x101
mov edx, 2
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
push 0x40
call edi
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov edi, eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x10], ebx
jbe 0x10027f41
mov esi, dword [ebp - 0x1c]
nop dword [eax]
cmp word [edi], 0
mov ecx, edi
je 0x10027f09
nop dword [eax + eax]
add ecx, 2
cmp word [ecx], 0
jne 0x10027f00
mov edx, dword [esi]
push 0xffffffffffffffff
call fcn.10008a90
add esp, 4
mov ecx, edi
cmp word [edi], 0
je 0x10027f29
nop dword [eax]
add ecx, 2
cmp word [ecx], 0
jne 0x10027f20
push 0xffffffffffffffff
mov edx, 0x100537d4
call fcn.10008a90
inc ebx
add esp, 4
add esi, 0x24
cmp ebx, dword [ebp - 0x10]
jb 0x10027ef0
push edi
push str.AI_SERVICES_LIST
push dword [ebp + 8]
call dword [sym.imp.msi.dll_MsiSummaryInfoGetPropertyCount]
mov byte [ebp - 4], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x10027f61
push edi
call esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10027f80
push eax
call esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10029d50
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100478fd
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str..cab
push dword [edx + 4]
mov edx, str.SELECT__Cabinet__FROM__Media__WHERE__Media_._Cabinet_
lea ecx, [ebp]
call fcn.10029cd0
add esp, 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test eax, eax
je 0x10029dc1
push eax
call edi
push esi
mov dword [ebp - 0x10], 0
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov esi, eax
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 1
cmp word [ebp], 0
je 0x10029e03
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push esi
call dword [sym.imp.msi.dll_MsiEnumClientsA]
test eax, eax
jle 0x10029dfc
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10029e46
call fcn.10016f50
mov byte [ebp - 4], 0
test esi, esi
je 0x10029e0e
push esi
call edi
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10029e21
push ecx
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0x20c]
pop ebp
ret
push 0
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiViewModify]
mov ebx, eax
test ebx, ebx
jle 0x10029e62
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0x10029e69
call fcn.10016f50
mov byte [ebp - 4], 0
test esi, esi
je 0x10029e74
push esi
call edi
test ebx, ebx
js 0x10029e0e
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10029e8d
push eax
call edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
test eax, eax
sete bl
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10029e10
push eax
call edi
jmp 0x10029e10
Function at 0x10029ec0
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x1004794d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10067024]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov esi, ecx
xor eax, eax
lea ecx, [ebp]
push 0xffffffffffffffff
mov edx, str.SELECT__FROM__Condition__WHERE__Condition_._Feature__
mov word [ebp], ax
call fcn.10008a90
add esp, 4
cmp word [eax], 0
je 0x10029f29
nop
add eax, 2
cmp word [eax], 0
jne 0x10029f20
push 0xffffffffffffffff
mov edx, ebx
mov ecx, eax
call fcn.10008a90
add esp, 4
cmp word [eax], 0
je 0x10029f49
nop dword [eax]
add eax, 2
cmp word [eax], 0
jne 0x10029f40
push 0xffffffffffffffff
mov edx, 0x1005c224
mov ecx, eax
call fcn.10008a90
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test ecx, ecx
je 0x10029f88
push ecx
call edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.msi.dll_MsiEnumClientsA]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiViewModify]
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov ebx, dword [sym.imp.msi.dll_MsiRecordClearData]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10029fca
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x10029fea
push dword [ebp - 0x10]
push 6
push dword [ebp - 0x14]
call ebx
jmp 0x10029fc0
push 3
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
test ecx, ecx
je 0x10029ffe
push ecx
call edi
push dword [ebp - 0x18]
mov dword [ebp - 0x10], esi
push 1
push esi
mov esi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call esi
push 0
push 2
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiRecordSetStringW]
push 0x10056584
push 3
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
push 7
push dword [ebp - 0x14]
call ebx
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
sete bl
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1002a04f
push eax
call edi
mov byte [ebp - 4], 0
test esi, esi
je 0x1002a05a
push esi
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1002a06b
push ecx
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1002c803
lea esp, [ebp + 0x20c]
pop ebp
ret
Function at 0x10037422
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004d038
push 0x1004d030
push str.FlsAlloc
push 0x1e
call fcn.10037340
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10037456
push dword [ebp + 8]
mov ecx, esi
call dword [0x10049434]
call esi
jmp 0x1003745c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100374a0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1004d048
push 0x1004d040
push str.FlsGetValue
push 0x20
call fcn.10037340
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100374d7
push dword [ebp + 8]
mov ecx, esi
call dword [0x10049434]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1003a9a0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003aa3d
push ebx
push esi
call fcn.1003a969
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100398f1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003a9ea
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003aa3c
push edi
push eax
call fcn.1003614a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003aa0a
call fcn.1003600b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003aa3b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100398f1
add esp, 0x20
test eax, eax
jne 0x1003aa29
push edi
call fcn.1003600b
jmp 0x1003aa31
push ebx
call fcn.1003600b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x459518
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.0040682c
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x45955f
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00406a14
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x45ed5c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ee95
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x441c40]
call fcn.00442e44
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x45ee6b
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00442f2c
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00406a14
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x45eeb0
call fcn.00406ce8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004431a8
test al, al
je 0x45ee55
lea ecx, [ebp - 4]
mov edx, 0x45ef24
mov eax, dword [ebp - 0xc]
call fcn.00443aa4
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00417890
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x45ee4e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x45ef3c
mov eax, dword [ebp - 8]
push eax
call fcn.0040b09c
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4a8a20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ee55
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ee72
mov eax, dword [ebp - 0xc]
call fcn.00404da8
ret

Function at 0x45efa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x45efe7
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45efca
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x45efdb
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x45efe7
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x46c740
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4af228], 0
je 0x46c881
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4a90f8]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x46c881
mov eax, dword [0x4af22c]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4af228]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x46c850
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4af228]
call fcn.0042ef88
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x46c848
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x46c848
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x46c848
mov eax, dword [ebp - 0x14]
call fcn.00478058
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46c848
push ebp
call fcn.0046c6fc
pop ecx
test al, al
jne 0x46c848
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405034
test al, al
je 0x46c848
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00405034
cmp byte [ebp - 1], 0
je 0x46c848
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040a2ac
test al, al
je 0x46c848
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4af22c]
call fcn.0046be58
inc edi
dec ebx
jne 0x46c7a5
mov eax, dword [0x4af22c]
cmp dword [eax + 8], 0
jle 0x46c868
mov eax, dword [0x4af22c]
call fcn.0046bf10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x46c881
push ebp
mov eax, dword [ebp - 0x18]
call fcn.0046c560
pop ecx
test al, al
jne 0x46c881
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret