joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100680ac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
mov eax, dword [ebp - 8]
call fcn.100045b4
mov eax, dword [ebp - 0xc]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10068181
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10068166
xor edx, edx
push ebp
push 0x1006815f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.100045c4
push eax
push 0
push 2
push 0x110
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.100045c4
push eax
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCreateKeyExA
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068166
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068188
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.10004128
ret

Function at 0x1006818c
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10068236
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10068220
xor eax, eax
push ebp
push 0x10068219
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.advapi32.dll_RegDeleteKeyA
push ebx
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068220
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006823d
lea eax, [ebp - 4]
call fcn.10004104
ret
Function at 0x10068244
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x100682e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100682d2
xor eax, eax
push ebp
push 0x100682cb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
push 1
push ebx
call sub.advapi32.dll_RegCreateKeyA
push ebx
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100682d2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100682ef
lea eax, [ebp - 4]
call fcn.10004104
ret

Function at 0x100682f4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x1006839d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10068387
xor eax, eax
push ebp
push 0x10068380
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
call sub.advapi32.dll_RegSetValueExA
push ebx
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068387
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100683a4
lea eax, [ebp - 4]
call fcn.10004104
ret

Function at 0x100685b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
mov eax, dword [ebp - 8]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10068651
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10068664
call sub.user32.dll_InvalidateRect
mov esi, eax
push 0x10068670
push esi
call sub.user32.dll_GetMenuItemInfoA
mov edi, eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.100045c4
mov esi, eax
push esi
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
push 0
call edi
test eax, eax
jne 0x10068636
test bl, bl
je 0x10068636
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push esi
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068658
lea eax, [ebp - 8]
mov edx, 2
call fcn.10004128
ret
Function at 0x10068738
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x100687be
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
mov edx, 0x1e
call fcn.10006ef0
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x100687d4
mov edx, dword [ebp - 4]
call fcn.10004410
mov eax, dword [ebp - 0x28]
call fcn.100045c4
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100687c5
lea eax, [ebp - 0x28]
call fcn.10004104
lea eax, [ebp - 4]
call fcn.10004104
ret

Function at 0x10068c24
Capabilities:
Execute anti-debugging instructions
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x10068d00
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetClassNameA
push eax
call sub.user32.dll_GetMenuItemID
mov ebx, eax
call sub.user32.dll_GetClipboardData
push eax
call sub.user32.dll_GetScrollRange
mov esi, eax
push 0x100
call sub.user32.dll_GetClassNameA
push eax
call sub.user32.dll_MessageBoxA
push 0xf
call sub.user32.dll_GetClipboardData
push eax
call sub.user32.dll_OffsetRect
push 0xa
call sub.KERNEL32.DLL_lstrlenA
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.KERNEL32.DLL_lstrlenA
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.user32.dll_GetClipboardData
push eax
call sub.user32.dll_OffsetRect
push ebx
call sub.user32.dll_GetClassNameA
push eax
call sub.user32.dll_MessageBoxA
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
fild qword [ebp - 0x14]
fdiv dword [0x10068d10]
call fcn.10002aac
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.100086fc
mov edx, dword [ebp - 0xc]
mov eax, edi
mov ecx, 0x10068d1c
call fcn.10004410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10068d07
lea eax, [ebp - 0xc]
call fcn.10004104
ret
Function at 0x10069ab4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
mov eax, dword [ebp - 8]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10069b38
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x10069b44
push 0x80000002
call sub.user32.dll_SetWindowPlacement
mov eax, dword [ebp - 8]
call fcn.100043c4
push eax
mov eax, dword [ebp - 8]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_ShowCursor
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetParent
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10069b3f
lea eax, [ebp - 8]
mov edx, 2
call fcn.10004128
ret

Function at 0x10069b74
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10069bd7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
push 0x10069be4
push 0x80000002
call sub.user32.dll_SetWindowPlacement
mov eax, dword [ebp - 4]
call fcn.100045c4
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetScrollPos
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetParent
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10069bde
lea eax, [ebp - 4]
call fcn.10004104
ret

Function at 0x10069d0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.100045b4
xor eax, eax
push ebp
push 0x10069d8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov esi, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x10069d6a
inc ebx
xor edi, edi
mov eax, dword [ebp - 8]
call fcn.100043c4
push eax
lea eax, [edi + 1]
pop edx
mov ecx, edx
cdq
idiv ecx
mov eax, edx
mov edx, dword [ebp - 8]
mov al, byte [edx + eax - 1]
xor byte [esi], al
inc esi
inc edi
dec ebx
jne 0x10069d48
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.10019304
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10069d93
lea eax, [ebp - 8]
call fcn.10004104
ret
Function at 0x1006c5a8
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1006c6f7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
mov dl, 1
mov eax, dword [0x1001562c]
call fcn.10003318
mov dword [ebp - 0x1c], eax
xor edx, edx
push ebp
push 0x1006c6cd
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 1
push 0
call sub.netapi32.dll_NetUserEnum
mov edi, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x1006c697
inc esi
lea eax, [ebp - 0x20]
mov edx, dword [ebx]
call fcn.1000432c
push dword [ebp - 0x20]
push 0x1006c710
lea eax, [ebp - 0x24]
mov edx, dword [ebx + 0x14]
call fcn.1000432c
push dword [ebp - 0x24]
push 0x1006c710
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.10004484
mov eax, dword [ebx + 0xc]
sub eax, 1
jb 0x1006c65b
je 0x1006c66a
dec eax
je 0x1006c679
jmp 0x1006c686
lea eax, [ebp - 0x18]
mov edx, 0x1006c71c
call fcn.100043cc
jmp 0x1006c686
lea eax, [ebp - 0x18]
mov edx, 0x1006c72c
call fcn.100043cc
jmp 0x1006c686
lea eax, [ebp - 0x18]
mov edx, 0x1006c740
call fcn.100043cc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
add ebx, 0x20
dec esi
jne 0x1006c61a
mov eax, dword [ebp - 0x10]
push eax
call sub.netapi32.dll_NetApiBufferFree
cmp edi, 0xea
je 0x1006c5ef
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006c6d4
mov eax, dword [ebp - 0x1c]
call fcn.10003348
ret

Function at 0x1006c748
Capabilities:
Delete user account

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
xor eax, eax
push ebp
push 0x1006c78b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.10004efc
push eax
push 0
call sub.netapi32.dll_NetUserDel
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006c792
lea eax, [ebp - 4]
call fcn.10004104
ret

Function at 0x1006c798
Capabilities:
Change user account password

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.100045b4
mov eax, dword [ebp - 8]
call fcn.100045b4
mov eax, dword [ebp - 0xc]
call fcn.100045b4
xor eax, eax
push ebp
push 0x1006c810
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.10004efc
push eax
mov eax, dword [ebp - 8]
call fcn.10004efc
push eax
mov eax, dword [ebp - 4]
call fcn.10004efc
push eax
push 0
call sub.netapi32.dll_NetUserChangePassword
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006c817
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.10004128
ret
Function at 0x1006c820
Capabilities:
Log keystrokes
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb8
mov dword [esp + 4], ecx
mov ebx, edx
mov dword [esp], eax
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], 1
mov eax, dword [esp]
push eax
call sub.user32.dll_SetFocus
test eax, eax
je 0x1006c9bc
mov eax, dword [esp]
push eax
call sub.user32.dll_SetClassLongA
mov edi, eax
mov eax, dword [esp]
push eax
call sub.user32.dll_SetCursor
movzx ebp, byte [eax]
mov eax, ebp
shl eax, 2
lea eax, [eax + eax*2]
add eax, 0x1b
inc eax
mov esi, eax
mov eax, dword [esp + 4]
cmp esi, dword [eax]
jbe 0x1006c88e
mov eax, dword [esp + 4]
mov dword [eax], esi
push 0x7a
call sub.user32.dll_MapVirtualKeyA
jmp 0x1006c9bc
push 0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x14]
mov edx, 0x1006c9c8
mov eax, ebx
call fcn.1000946c
cmp byte [edi], 0
jne 0x1006c8b8
cmp byte [edi + 1], 0
je 0x1006c926
push 5
mov eax, ebx
call fcn.10008e10
add eax, ebx
xor edx, edx
mov dl, byte [edi]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x20], 0
xor edx, edx
mov dl, byte [edi + 1]
mov dword [esp + 0x24], edx
mov byte [esp + 0x28], 0
xor edx, edx
mov dl, byte [edi + 2]
mov dword [esp + 0x2c], edx
mov byte [esp + 0x30], 0
xor edx, edx
mov dl, byte [edi + 3]
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 0
xor edx, edx
mov dl, byte [edi + 4]
mov dword [esp + 0x3c], edx
mov byte [esp + 0x40], 0
xor edx, edx
mov dl, byte [edi + 5]
mov dword [esp + 0x44], edx
mov byte [esp + 0x48], 0
lea ecx, [esp + 0x1c]
mov edx, 0x1006c9d0
call fcn.1000946c
jmp 0x1006c96b
push 0
mov eax, ebx
call fcn.10008e10
add eax, ebx
xor edx, edx
mov dl, byte [edi + 5]
xor ecx, ecx
mov cl, byte [edi + 4]
shl ecx, 8
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + 3]
shl ecx, 0x10
add edx, ecx
xor ecx, ecx
mov cl, byte [edi + 2]
shl ecx, 0x18
add edx, ecx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x14]
mov edx, 0x1006c9ec
call fcn.1000946c
mov eax, ebx
call fcn.10008e10
mov esi, eax
mov edi, ebp
dec edi
test edi, edi
jb 0x1006c9b4
inc edi
xor ebp, ebp
push 0
push ebp
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_SetClipboardData
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x14]
mov edx, 0x1006c9f0
lea eax, [esi + ebx]
call fcn.1000946c
mov eax, ebx
call fcn.10008e10
mov esi, eax
inc ebp
dec edi
jne 0x1006c97e
mov dword [esp + 8], 0xffffffff
mov eax, dword [esp + 8]
add esp, 0x48
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1006c9f4
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
xor ebp, ebp
xor eax, eax
mov dword [esp + 0xc], eax
xor esi, esi
mov edi, 1
xor ebx, ebx
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push edi
mov eax, dword [esp + 0x10]
push eax
call sub.user32.dll_SetCursorPos
test eax, eax
jne 0x1006ca6f
call sub.user32.dll_GetKeyboardLayout
cmp eax, 0x7a
jne 0x1006ca97
mov eax, dword [esp + 0xc]
push eax
push 8
call sub.user32.dll_GetMenuState
push eax
call sub.user32.dll_InflateRect
mov ebx, eax
test ebx, ebx
je 0x1006ca97
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push esi
push ebx
push edi
mov eax, dword [esp + 0x10]
push eax
call sub.user32.dll_SetCursorPos
test eax, eax
je 0x1006ca97
mov ecx, dword [esp + 8]
mov eax, dword [ebx]
mov edx, dword [esp + 4]
call fcn.1006c820
test eax, eax
je 0x1006ca97
push ebx
push 0
call sub.user32.dll_GetMenuState
push eax
call sub.user32.dll_InsertMenuA
test eax, eax
je 0x1006ca97
or ebp, 0xffffffff
mov eax, ebp
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1006caa4
Capabilities:
Get keyboard layout
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeec
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.10004104
test bl, bl
je 0x1006caf9
lea eax, [esp + 8]
push eax
push 0
push 0x1006cb7c
call fcn.10006ab4
push eax
call fcn.10006c34
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.user32.dll_IsWindow
mov esi, eax
push esp
push 8
push esi
call sub.user32.dll_SetMenu
mov ebx, eax
push esi
call sub.user32.dll_DefFrameProcA
jmp 0x1006cb2b
push esp
push 0xffffffffffffffff
push 8
call sub.user32.dll_GetClipboardData
push eax
call sub.user32.dll_SetMenuItemInfoA
mov ebx, eax
test ebx, ebx
jne 0x1006cb2b
call sub.user32.dll_GetKeyboardLayout
cmp eax, 0x3f0
jne 0x1006cb2b
push esp
push 8
call sub.user32.dll_GetClassNameA
push eax
call sub.user32.dll_SetMenu
mov ebx, eax
test ebx, ebx
je 0x1006cb72
lea eax, [esp + 0xc]
mov edx, 0x105
call fcn.10006ef0
mov dword [esp + 4], 0x105
lea ecx, [esp + 4]
lea edx, [esp + 0xc]
mov eax, dword [esp]
call fcn.1006c9f4
test eax, eax
je 0x1006cb69
mov eax, edi
lea edx, [esp + 0xc]
mov ecx, 0x105
call fcn.10004374
mov eax, dword [esp]
push eax
call sub.user32.dll_DefFrameProcA
add esp, 0x114
pop edi
pop esi
pop ebx
ret
Function at 0x100759c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x10075be5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.10068710
test al, al
je 0x10075bb1
mov eax, dword [0x1007ac74]
cmp byte [eax], 0
je 0x10075b4d
mov eax, dword [0x1007a924]
cmp byte [eax], 0
je 0x10075a77
push 0x104
lea eax, [ebp - 0x10d]
push eax
push 0x10075bf4
call sub.user32.dll_GetDesktopWindow
lea eax, [ebp - 0x114]
lea edx, [ebp - 0x10d]
mov ecx, 0x105
call fcn.10004374
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 8]
mov ecx, 0x10075c0c
call fcn.10004410
jmp 0x10075a87
lea eax, [ebp - 8]
mov edx, dword [0x1007acfc]
mov edx, dword [edx]
call fcn.1000419c
lea edx, [ebp - 0x11c]
xor eax, eax
call fcn.10002a04
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.10008cc4
mov eax, dword [ebp - 0x118]
push eax
lea edx, [ebp - 0x120]
mov eax, dword [ebp - 8]
call fcn.10008cc4
mov eax, dword [ebp - 0x120]
pop edx
call fcn.10069c14
test al, al
je 0x10075ad4
call fcn.10075678
jmp 0x10075bbf
call fcn.1007577c
test al, al
jne 0x10075bbf
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x124]
xor eax, eax
call fcn.10002a04
mov eax, dword [ebp - 0x124]
call fcn.100045c4
push eax
call sub.user32.dll_DestroyIcon
mov ebx, eax
push 0
push ebx
call sub.user32.dll_GetKeyNameTextA
mov edi, eax
mov eax, edi
call fcn.100026dc
mov esi, eax
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push ebx
call sub.user32.dll_IsWindowEnabled
push ebx
call sub.user32.dll_DefFrameProcA
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.10075254
mov eax, esi
call fcn.100026fc
jmp 0x10075bbf
lea edx, [ebp - 0x128]
mov eax, 1
call fcn.10002a04
mov eax, dword [ebp - 0x128]
mov edx, 0x10075c34
call fcn.10004510
jne 0x10075b76
call fcn.10075678
jmp 0x10075bbf
call fcn.1007577c
test al, al
jne 0x10075bbf
push 0
lea edx, [ebp - 0x12c]
xor eax, eax
call fcn.10002a04
lea eax, [ebp - 0x12c]
mov edx, 0x10075c40
call fcn.100043cc
mov eax, dword [ebp - 0x12c]
call fcn.100045c4
push eax
call sub.user32.dll_ReleaseDC
jmp 0x10075bbf
call fcn.1007577c
test al, al
jne 0x10075bbf
call fcn.10075678
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10075bec
lea eax, [ebp - 0x12c]
mov edx, 7
call fcn.10004128
lea eax, [ebp - 8]
call fcn.10004104
ret
Function at 0x474f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474f42
call fcn.0047a885
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474f42
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474f39
xor eax, eax
jmp 0x474f4a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474f50
pop edi
pop esi
pop ebx
ret 4

Function at 0x47adb5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ade3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ae01
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047ad1b
jmp 0x47ae01
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ae01
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047ad1b
test edi, edi
mov eax, edi
jne 0x47adeb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x10011be
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x174
mov eax, dword [0x1002018]
push 0x104
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x174], ecx
push 1
lea ecx, [ebp - 0x174]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ecx
push eax
call fcn.01001149
cmp eax, 1
jl 0x100129e
push ebx
xor ebx, ebx
cmp byte [ebp - 0x160], bl
push esi
lea esi, [ebp - 0x160]
je 0x1001238
cmp byte [esi], 0x3a
je 0x100121b
inc esi
cmp byte [esi], bl
jne 0x100120f
jmp 0x100121e
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x1001238
push 0x10010ac
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x100123e
lea esi, [ebp - 0x160]
push 0x29
lea eax, [ebp - 0x58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100129c
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x100129c
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x100129c
push ebx
lea eax, [ebp - 0x170]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.01001324
leave
ret 0x10