joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f70a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x1003f72d
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x1003f7ca
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.1003ec17
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1003f750
push ebx
call fcn.1011013b
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x1003f7a6
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x101b8028]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x1003f77b
call fcn.1011013b
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x1003f7a6
push esi
push 1
push eax
call fcn.1010ff94
push ebx
mov esi, eax
call fcn.1011013b
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x1003f7af
push dword [ebp - 4]
call dword [0x101b802c]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x1003f7c9
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.1003f674
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10050d7c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10160b88
push dword [ebp + 8]
call fcn.1010f2de
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10050dd9
push ebx
push edi
push esi
call fcn.101130dd
push eax
call fcn.101133d0
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x10050db8
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x10050dce
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.1010ff94
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.1011013b
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x10050e19
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 8]
call fcn.10051850
mov ebx, eax
test ebx, ebx
je 0x10050e88
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x10050e6c
cmp dword [ebp + 0x14], edi
jae 0x10050e51
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10050e6c
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x10050e6c
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x10050e70
xor eax, eax
jmp 0x10050e87
push edi
push eax
push dword [ebp + 0x10]
call fcn.100e4bc0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x10057605
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov ecx, dword [edi + 8]
call fcn.100577aa
test eax, eax
jne 0x10057717
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x10057633
call fcn.1004687d
mov esi, eax
jmp 0x10057635
xor esi, esi
push ebx
push 0x2800
call fcn.1010e66d
mov edi, eax
mov dword [esp], 0x5000
call fcn.1010e66d
mov ebx, eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
push dword [eax]
push str.Warning:_no_object__s_of_type:_d_in_SOUI__
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10057bd9
add esp, 0x1c
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x10057696
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.1010e678
pop ecx
test esi, esi
je 0x100576d2
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
call dword [eax + 0x2c]
test al, al
je 0x100576d2
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SObjectFactoryMgr::CreateObject
push 0x3d
push str.f:workspace_soui_soui_srccore_sobjectfactory.cpp
push edi
push str.soui
push 3
push 0
call dword [eax + 0x34]
jmp 0x1005770b
mov ebx, 0x2800
push ebx
call fcn.1010e66d
push 0x3d
push str.f:workspace_soui_soui_srccore_sobjectfactory.cpp
push str.SOUI::SObjectFactoryMgr::CreateObject
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
mov esi, eax
push ebx
push esi
call fcn.10057bba
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.1010e678
pop ecx
push edi
call fcn.1010e678
pop ecx
xor eax, eax
pop ebx
jmp 0x10057733
mov ecx, dword [edi + 8]
push esi
call fcn.10057466
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, eax
mov ecx, edi
push esi
call fcn.10057a2a
mov eax, esi
pop edi
pop esi
pop ebp
ret 4

Function at 0x10060701
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x170]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x10060727
call fcn.1005d633
jmp 0x10060753
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1005cae3
mov eax, dword [esi + 0x180]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x10060753
push 1
push ecx
push ecx
push eax
push 0x10166648
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc
Function at 0x1006969e
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10158fab
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101b87d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x54]
call fcn.10067e67
lea ecx, [esi + 0x40]
call fcn.100695e6
lea ecx, [esi + 0x30]
call fcn.1004b05b
lea ecx, [esi + 0x18]
call fcn.100695a2
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100696f2
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x10069701
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10069710
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006971f
add ecx, 0xc
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi], vtable.SOUI::TObjRefImpl_struct_SOUI::IUiDefInfo_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006c1bb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x78
pop ecx
mov ax, word [edi + 0x210]
add ax, word [ebp + 0xc]
cwde
cdq
idiv ecx
movzx eax, ax
mov dword [ebp + 0xc], eax
cwde
mov word [edi + 0x210], dx
cdq
xor eax, edx
sub eax, edx
movzx ebx, ax
xor eax, eax
cmp ax, bx
jge 0x1006c259
xor ecx, ecx
cmp word [ebp + 0xc], ax
setle cl
mov dword [ebp - 4], ecx
mov eax, dword [edi]
push 0
push ecx
push 1
mov ecx, edi
call dword [eax + 0x100]
test eax, eax
je 0x1006c224
mov ecx, edi
call fcn.1006da10
mov ecx, dword [ebp - 4]
inc esi
cmp si, bx
jl 0x1006c201
cmp si, bx
jge 0x1006c259
push dword [ebp + 0x14]
mov edx, ebx
push dword [ebp + 0x10]
sub edx, esi
mov eax, edx
neg eax
cmp word [ebp + 0xc], 0
movzx ecx, ax
movzx eax, dx
cmovg ecx, eax
movsx eax, cx
mov ecx, edi
imul eax, eax, 0x78
movzx eax, ax
push eax
push dword [ebp + 8]
call fcn.1005cc85
test bx, bx
je 0x1006c298
mov ecx, edi
call fcn.1005ac8b
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
movzx edx, word [ebp + 0x14]
mov edi, eax
movzx ecx, word [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
shl edx, 0x10
or edx, ecx
push edx
push dword [ebp + 8]
push 0x200
push edi
call esi
push 0x2000001
push edi
push 0x20
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1006e51c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101b87d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.100e5140
add esp, 0xc
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea eax, [ebp - 0x120]
push eax
call esi
test eax, eax
jne 0x1006e577
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call esi
test eax, eax
je 0x1006e58b
cmp byte [ebp - 6], 1
jne 0x1006e58b
cmp dword [ebp - 0x11c], 6
jne 0x1006e58b
xor eax, eax
inc eax
jmp 0x1006e58d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100bcd31
mov esp, ebp
pop ebp
ret
Function at 0x10079d67
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x5c
mov eax, 0x10159f88
call fcn.100bd9b7
mov esi, ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.10051dfb
mov dword [ebp - 0x68], 0x101693a8
mov dword [ebp - 0x60], 0x101693bc
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x68]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x44], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], edi
call dword [eax + 0x94]
cmp dword [ebp - 0x40], ebx
jne 0x10079f6a
cmp dword [ebp + 0x10], ebx
je 0x10079dd5
imul ecx, edi, 0xc
xor eax, eax
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], ebx
sete al
mov dword [ecx + 8], eax
jmp 0x10079f2a
cmp dword [esi + 0x264], ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x10079dec
cmp dword [esi + 0x260], 0
je 0x10079e0e
push 0x11
call ebx
test ax, ax
jns 0x10079e0e
cmp edi, 0xffffffff
je 0x10079f38
imul ecx, edi, 0xc
xor eax, eax
add ecx, dword [esi + 0x26c]
cmp dword [ecx + 8], eax
jmp 0x10079dca
cmp dword [esi + 0x264], 0
jne 0x10079e24
cmp dword [esi + 0x260], 0
je 0x10079ebf
push 0x10
call ebx
test ax, ax
jns 0x10079ebf
cmp edi, 0xffffffff
je 0x10079f38
xor eax, eax
mov ecx, edi
cmp dword [ebp + 8], 0xffffffff
cmovne eax, dword [ebp + 8]
cmp eax, edi
mov dword [ebp + 8], eax
mov edx, eax
cmovg ecx, eax
cmp ecx, eax
mov dword [ebp - 0x10], ecx
cmove edx, edi
xor ebx, ebx
mov dword [ebp + 0x10], edx
xor ecx, ecx
mov eax, dword [esi + 0x268]
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x10079e7d
cmp dword [eax + 0x1a4], 0
jle 0x10079e7d
mov eax, dword [esi + 0x270]
jmp 0x10079e7f
xor eax, eax
cmp ebx, eax
jge 0x10079f38
mov edx, dword [esi + 0x26c]
mov eax, dword [edx + ecx + 8]
mov dword [ebp - 0x14], eax
cmp ebx, dword [ebp + 0x10]
jl 0x10079ea3
cmp ebx, dword [ebp - 0x10]
jg 0x10079ea3
xor eax, eax
inc eax
jmp 0x10079ea5
xor eax, eax
mov dword [edx + ecx + 8], eax
cmp dword [ebp - 0x14], eax
je 0x10079eb9
push ebx
mov ecx, esi
call fcn.1007a4b2
mov ecx, dword [ebp + 0xc]
inc ebx
add ecx, 0xc
jmp 0x10079e5f
or dword [esi + 0x220], 0xffffffff
xor ebx, ebx
xor ecx, ecx
mov eax, dword [esi + 0x268]
mov dword [ebp + 0xc], ecx
test eax, eax
je 0x10079ee8
cmp dword [eax + 0x1a4], 0
jle 0x10079ee8
mov eax, dword [esi + 0x270]
jmp 0x10079eea
xor eax, eax
cmp ebx, eax
jge 0x10079f15
mov eax, dword [esi + 0x26c]
cmp ebx, edi
je 0x10079f0f
cmp dword [eax + ecx + 8], 0
je 0x10079f0f
and dword [eax + ecx + 8], 0
mov ecx, esi
push ebx
call fcn.1007a4b2
mov ecx, dword [ebp + 0xc]
inc ebx
add ecx, 0xc
jmp 0x10079eca
cmp edi, 0xffffffff
je 0x10079f38
imul eax, edi, 0xc
add eax, dword [esi + 0x26c]
mov dword [eax + 8], 1
push edi
mov ecx, esi
mov dword [esi + 0x220], edi
call fcn.1007a4b2
push esi
lea ecx, [ebp - 0x3c]
call fcn.10051dfb
mov dword [ebp - 0x3c], 0x1016942c
mov dword [ebp - 0x34], 0x10169440
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], edi
call dword [eax + 0x94]
call fcn.100bd980
ret 0xc
Function at 0x1007e141
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, esi
push edi
mov edi, ecx
sub eax, 9
je 0x1007e1a2
sub eax, 1
je 0x1007e184
sub eax, 3
je 0x1007e184
test dword [edi + 0x370], 0x2000
je 0x1007e1bd
push esi
call fcn.10113dc7
pop ecx
test eax, eax
jne 0x1007e1bd
cmp esi, 0x2d
je 0x1007e1bd
cmp esi, 0x2e
je 0x1007e1bd
cmp esi, 0x2c
je 0x1007e1bd
jmp 0x1007e1d8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1007e1bd
test dword [edi + 0x370], 0x1000
jmp 0x1007e1bb
test byte [edi + 0x374], 0x80
jne 0x1007e1bd
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1007e1d8
mov eax, dword [edi + 0x380]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [edi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1007e4aa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x2c
mov eax, 0x1015a309
call fcn.100bd9b7
mov esi, ecx
push esi
lea ecx, [ebp - 0x38]
call fcn.10051dfb
mov dword [ebp - 0x38], 0x10169a8c
mov dword [ebp - 0x30], 0x10169aa0
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x38]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x18], edi
call dword [eax + 0x94]
cmp byte [ebp - 0x10], bl
jne 0x1007e535
cmp edi, 0xd
jne 0x1007e519
test dword [esi + 0x370], 0x1000
jne 0x1007e519
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1007e535
mov eax, dword [esi + 0x380]
push ebx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x6c]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
jmp 0x1007e538
mov dword [esi + 0x10], ebx
call fcn.100bd980
ret 0xc
Function at 0x1007eeba
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], edi
test esi, esi
jne 0x1007efd4
cmp dword [ebx], 0x74
je 0x1007efd4
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x1007eef0
call fcn.1004687d
mov esi, eax
jmp 0x1007eef2
xor esi, esi
push 0x2800
call fcn.1010e66d
mov edi, eax
mov dword [esp], 0x5000
call fcn.1010e66d
mov dword [esp], str.set_default_char_format_failed__only_CHARFORMAT2W_can_be_set_for_default_char_format
mov ebx, eax
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.10057bd9
add esp, 0x10
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x1007ef4c
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.1010e678
pop ecx
test esi, esi
je 0x1007ef8b
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
call dword [eax + 0x2c]
test al, al
je 0x1007ef8b
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SRichEdit::OnSetCharFormat
push 0x550
push str.f:workspace_soui_soui_srccontrol_srichedit.cpp
push edi
push str.soui
push 3
push 0
call dword [eax + 0x34]
jmp 0x1007efc9
mov ebx, 0x2800
push ebx
call fcn.1010e66d
mov dword [esp], 0x550
mov esi, eax
push str.f:workspace_soui_soui_srccontrol_srichedit.cpp
push str.SOUI::SRichEdit::OnSetCharFormat
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.10057bba
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.1010e678
pop ecx
push edi
call fcn.1010e678
pop ecx
xor eax, eax
jmp 0x1007f015
mov eax, dword [edi + 0x380]
push 0
push ebx
push esi
mov ecx, dword [eax + 0xc]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0xc]
test esi, esi
jne 0x1007f012
mov eax, dword [ebp - 4]
add edi, 0x218
push 0x1d
pop ecx
mov esi, ebx
mov edx, 0x20000
mov eax, dword [eax + 0x380]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xc]
push edx
push edx
mov eax, dword [ecx]
call dword [eax + 0x4c]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10080dc5
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28
mov eax, 0x1015a5c5
call fcn.100bd9b7
mov ebx, ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
and eax, 0x8000
push 0x10
mov dword [ebp - 0x10], eax
call esi
and eax, 0x8000
and edi, 0x8000
jne 0x10080e2d
lea esi, [ebx + 0x170]
cmp dword [ebp - 0x10], edi
jne 0x10080e17
test eax, eax
jne 0x10080e10
inc eax
xor ecx, ecx
jmp 0x10080e70
push 2
pop eax
push 4
jmp 0x10080e6f
test eax, eax
jne 0x10080e22
push 4
pop eax
push 2
jmp 0x10080e6f
push 6
pop eax
push 0x10
mov word [esi], ax
pop eax
jmp 0x10080e73
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x10080e48
test eax, eax
jne 0x10080e44
push 8
pop eax
lea esi, [ebx + 0x170]
inc ecx
jmp 0x10080e70
test ecx, ecx
je 0x10080e57
test eax, eax
jne 0x10080e53
push 0x40
pop eax
push 3
jmp 0x10080e69
test ecx, ecx
jne 0x10080e62
test eax, eax
je 0x10080e62
push 0x20
pop eax
push 5
jmp 0x10080e69
mov eax, 0x80
push 7
lea esi, [ebx + 0x170]
pop ecx
mov word [esi], cx
test word [ebx + 0x174], ax
je 0x10080e86
mov ax, word [ebx + 0x176]
mov word [esi], ax
push ebx
lea ecx, [ebp - 0x34]
call fcn.10051dfb
mov dword [ebp - 0x34], 0x1016a2e0
mov dword [ebp - 0x2c], 0x1016a2f4
mov ax, word [esi]
lea ecx, [ebp - 0x34]
and dword [ebp - 4], 0
mov word [ebp - 0x12], ax
mov ax, word [ebx + 0x172]
mov word [ebp - 0x14], ax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x94]
call fcn.100bd980
ret

Function at 0x10098cc7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x10098cd4
xor eax, eax
jmp 0x10098d02
push dword [ecx + 4]
call fcn.1006add5
pop ecx
test eax, eax
je 0x10098cef
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x98]
test al, 2
jne 0x10098cd0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4
Function at 0x10098e27
Capabilities:
Log keystrokes via polling

Disassembly:
push 4
mov eax, 0x1015bdfa
call fcn.100bd9b7
mov ebx, ecx
mov edi, dword [ebp + 8]
push edi
call fcn.10098cc7
test eax, eax
je 0x10098e62
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, ebx
and al, 1
movzx eax, al
push eax
call fcn.1009875a
xor eax, eax
inc eax
jmp 0x10098f64
push dword [ebx + 4]
call fcn.1006add5
mov esi, eax
mov dword [ebp - 0x10], esi
pop ecx
test esi, esi
je 0x10098f0e
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
je 0x10098f0e
cmp edi, 0x25
je 0x10098e9b
cmp edi, 0x27
je 0x10098ea9
cmp edi, 0x26
je 0x10098e9b
cmp edi, 0x28
jne 0x10098f0e
cmp edi, 0x27
je 0x10098ea9
cmp edi, 0x28
je 0x10098ea9
push 2
jmp 0x10098eab
push 3
pop edi
jmp 0x10098eb9
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x10098ef8
push edi
mov ecx, esi
call fcn.1005b52b
mov esi, eax
test esi, esi
jne 0x10098eae
mov ecx, dword [ebp - 0x10]
cmp edi, 3
setne al
push eax
call fcn.1005b225
mov ecx, eax
jmp 0x10098ee8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x64]
test eax, eax
jne 0x10098ef8
push edi
mov ecx, esi
call fcn.1005b52b
mov esi, eax
test esi, esi
jne 0x10098eda
jmp 0x10098e5a
push 1
mov ecx, esi
call fcn.1005b458
push eax
mov ecx, ebx
call fcn.1009923c
jmp 0x10098e5a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
shr eax, 0xf
lea ecx, [ebp + 8]
and al, 1
movzx eax, al
push eax
push edi
call fcn.1009bb4f
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
mov ecx, ebx
call fcn.10098fb8
xor ebx, ebx
lea ecx, [ebp + 8]
test al, al
setne bl
call fcn.1009bbab
mov eax, ebx
call fcn.100bd980
ret 4
Function at 0x1009b30e
Capabilities:
Print debug messages

Disassembly:
push 0x20
mov eax, 0x1015c059
call fcn.100bd9b7
mov esi, ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1009b296
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 4]
call fcn.1009b2d3
mov ecx, dword [ebp + 0x14]
mov esi, eax
call fcn.1005b458
mov dword [esi], eax
mov ecx, dword [0x101c1010]
test ecx, ecx
je 0x1009b35c
call fcn.1004687d
mov edi, eax
jmp 0x1009b35e
xor edi, edi
push 0x2800
call fcn.1010e66d
mov ebx, eax
mov dword [esp], str.CacheResultForID_parent:
mov esi, 0x1018cab0
mov dword [ebp - 0x18], ebx
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], ebx
lea edx, [ebx + 0x2800]
mov dword [ebp - 0x14], edx
call fcn.10020f00
mov ecx, dword [ebp + 8]
call fcn.1005b458
push 0
push eax
push str._I64u
lea ecx, [ebp - 0x18]
call fcn.1009b1c8
push str._nId:
push esi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x1018d1a0
call fcn.10020db0
mov esi, eax
push str._nDeep
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
push dword [ebp + 0x10]
mov ecx, esi
push 0x1018d1a0
call fcn.10020db0
mov esi, eax
push str._result:
push 0x1018cab0
mov ecx, esi
call fcn.10020f00
mov ecx, dword [ebp + 0x14]
call fcn.1005b458
push 0
push eax
push str._I64u
mov ecx, esi
call fcn.1009b1c8
test edi, edi
je 0x1009b445
mov eax, dword [edi]
mov ecx, edi
push 2
push 0
call dword [eax + 0x2c]
test al, al
je 0x1009b445
push dword [ebp + 4]
mov eax, dword [edi]
mov ecx, edi
push str.SOUI::SWindowFinder::CacheResultForID
push 0x44
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push ebx
push str.soui
push 2
push 0
call dword [eax + 0x34]
jmp 0x1009b4b0
mov esi, 0x1018d010
lea ecx, [ebp - 0x18]
push esi
mov edi, 0x1018cab0
push edi
call fcn.10020f00
push str.SOUI::SWindowFinder::CacheResultForID
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push str.f:workspace_soui_soui_srchelper_swndfinder.cpp
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x1018d014
push edi
lea ecx, [ebp - 0x18]
call fcn.10020f00
push 0x44
push 0x1018d1a0
lea ecx, [ebp - 0x18]
call fcn.10020db0
push 0x1018d018
push edi
mov ecx, eax
call fcn.10020f00
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
call fcn.1010e678
pop ecx
lea ecx, [ebp - 0x24]
call fcn.10008910
call fcn.100bd980
ret 0x10