joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002fe04
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xddc
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
test edx, edx
je 0x10030029
test esi, esi
je 0x10030029
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x874], ebx
mov dword [ebp - 0x870], ebx
mov dword [ebp - 0x86c], ebx
mov dword [ebp - 0x868], ebx
mov dword [ebp - 0x864], ebx
mov dword [ebp - 0x860], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
sub eax, ebx
je 0x1002fffa
sub eax, 1
je 0x1002fe9c
sub eax, 1
je 0x1002ff62
sub eax, 1
jne 0x10030014
mov edi, dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x20c]
push eax
push dword [edx + 4]
call edi
test eax, eax
je 0x1002fff5
push ebx
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.100189e0
test eax, eax
je 0x1002fff5
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x1002ff5a
push ebx
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.100189e0
test eax, eax
je 0x1002ff5a
cmp dword [ebp + 0x10], 1
jne 0x1002ffba
test byte [ebp - 0x854], 0x10
jne 0x1002fff5
test byte [ebp - 0x624], 0x10
jne 0x1002ff5a
mov ecx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x858], ecx
ja 0x1002ff5a
jb 0x1002fff5
cmp dword [ebp - 0x85c], eax
jb 0x1002fff5
cmp dword [ebp - 0x858], ecx
jb 0x10030014
ja 0x1002ff5a
cmp dword [ebp - 0x85c], eax
jbe 0x10030014
xor ebx, ebx
inc ebx
jmp 0x10030014
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0xddc]
push 0x408
push 0x2b4
push eax
push ebx
push dword [edx + 4]
call edi
test eax, eax
je 0x10030014
push 0x408
push 0x2b4
lea eax, [ebp - 0xb28]
push eax
push ebx
push dword [esi + 4]
call edi
test eax, eax
je 0x10030014
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0xbc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
jmp 0x10030014
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.1002f53c
test al, al
jne 0x1002fff5
push dword [ebp - 0x638]
lea ecx, [ebp - 0x86c]
push dword [ebp - 0x63c]
call fcn.1002f55b
xor ebx, ebx
test al, al
setne bl
jmp 0x10030014
or ebx, 0xffffffff
jmp 0x10030014
push dword [esi + 8]
mov eax, dword [edx]
push dword [edx + 8]
push ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jns 0x10030011
xor eax, eax
jmp 0x10030016
movsx ebx, ax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e6d
mov esp, ebp
pop ebp
ret 0xc
call fcn.10004bd5
int3
Function at 0x100305d6
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x10141110
call fcn.101237ae
mov edi, ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
mov esi, dword [ebp + 8]
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x704], ebx
setne al
test eax, eax
jne 0x10030605
call fcn.10004bd5
mov eax, dword [ebp + 0x10]
sub eax, ebx
je 0x10030733
sub eax, 1
je 0x1003065d
sub eax, 1
je 0x10030635
sub eax, 1
je 0x1003065d
push 0x1014dc14
mov ecx, esi
call fcn.10002cc0
mov eax, esi
call fcn.10123758
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1003061f
lea eax, [ebp - 0x4e8]
push eax
jmp 0x10030624
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1003061f
push ebx
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], ebx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], ebx
push eax
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x434], ebx
call fcn.100189e0
test eax, eax
je 0x1003061f
call fcn.100051b1
push eax
lea ecx, [ebp - 0x700]
call fcn.100025b0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], ebx
jne 0x100306f3
test byte [ebp - 0x428], 0x18
jne 0x1003070b
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov ecx, edi
push dword [ebp - 0x430]
call dword [eax + 0x1a0]
jmp 0x1003070b
mov eax, dword [edi]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov ecx, edi
call dword [eax + 0x1a4]
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.100036e3
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [esi], eax
lea ecx, [ecx - 0x10]
call fcn.100028b0
jmp 0x1003062b
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push ebx
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1003061f
lea eax, [ebp - 0x6f0]
jmp 0x1003065a

Function at 0x100308e2
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.10079e09
call fcn.100082b0
cmp dword [eax + 0x14], 0
jne 0x100308fd
mov ecx, esi
pop esi
jmp fcn.1002fcd9
pop esi
ret

Function at 0x10031694
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10002430
call fcn.100082b0
cmp dword [eax + 0x14], 0
jne 0x100316af
mov ecx, esi
pop esi
jmp fcn.10030f71
pop esi
ret
Function at 0x10032d2e
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x10032d73
test edi, edi
js 0x10032d73
cmp eax, 0x20
je 0x10032d68
cmp bx, 0x71
jne 0x10032d73
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1005dcb4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov edx, 0x104
xor ecx, ecx
mov eax, dword [edi + 4]
cmp eax, edx
ja 0x1005de5d
je 0x1005de87
cmp eax, 0xa1
jb 0x1005deca
cmp eax, 0xa2
jbe 0x1005de87
cmp eax, 0xa3
jbe 0x1005deca
cmp eax, 0xa5
jbe 0x1005de87
cmp eax, 0xa6
jbe 0x1005deca
cmp eax, 0xa8
jbe 0x1005de87
cmp eax, 0x100
jne 0x1005deca
cmp dword [esi + 0xc0], 0xffffffff
je 0x1005de87
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x1005de85
mov eax, dword [edi + 8]
sub eax, 0x21
je 0x1005dde5
sub eax, 1
jne 0x1005de85
mov ecx, dword [esi + 0xc0]
mov eax, dword [esi + 0xbc]
add eax, ecx
lea edi, [ecx + 1]
jmp 0x1005dd98
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x1005dd9e
mov eax, dword [esi + 0xbc]
inc edi
add eax, dword [esi + 0xc0]
cmp edi, eax
jl 0x1005dd6e
jmp 0x1005dddd
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.10015f57
mov edx, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [edx + 0x270]
and dword [esi + 0x24c], 0
xor eax, eax
inc eax
jmp 0x1005def0
mov ecx, dword [esi + 0xc0]
lea edi, [ecx - 1]
add edi, dword [esi + 0xbc]
cmp edi, ecx
jle 0x1005dddd
mov eax, edi
cdq
idiv dword [esi + 0xbc]
mov eax, dword [esi]
mov ecx, edx
mov dword [ebp + 8], ecx
push ecx
mov ecx, esi
call dword [eax + 0x27c]
test eax, eax
jne 0x1005de20
dec edi
cmp edi, dword [esi + 0xc0]
jg 0x1005ddf8
jmp 0x1005dddd
mov eax, dword [esi]
mov ecx, esi
push dword [ebp + 8]
mov dword [esi + 0x24c], 1
call dword [eax + 0x214]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x210]
mov ecx, eax
call fcn.10015f57
mov eax, dword [esi]
mov ecx, esi
push dword [esi + 0xc0]
call dword [eax + 0x270]
jmp 0x1005ddd6
cmp eax, 0x200
jb 0x1005deca
cmp eax, 0x202
jbe 0x1005de87
cmp eax, 0x203
jbe 0x1005deca
cmp eax, 0x205
jbe 0x1005de87
add eax, 0xfffffdf9
cmp eax, 1
ja 0x1005deca
jmp 0x1005de87
xor ecx, ecx
mov eax, dword [esi + 0xfc]
test eax, eax
je 0x1005dea7
cmp dword [eax + 0x20], 0
je 0x1005dea7
push edi
push ecx
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x1005dec8
cmp dword [eax + 0x20], 0
je 0x1005dec8
push edi
push 0
push 0x407
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp dword [edi + 4], 0x203
jne 0x1005dee8
lea eax, [esi + 0x2250]
test eax, eax
je 0x1005dee0
mov ecx, dword [eax + 0x20]
cmp dword [edi], ecx
je 0x1005dddd
push edi
mov ecx, esi
call fcn.100566df
pop edi
pop esi
pop ebp
ret 4
Function at 0x1006679f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
jne 0x100667c2
xor eax, eax
jmp 0x10066898
cmp dword [ebp + 0xc], 0
je 0x100667bb
xor ebx, ebx
call fcn.1000825c
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100667bb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x100667bb
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100668ae
push eax
call fcn.1012ada0
inc eax
pop ecx
mov dword [ebp - 8], eax
lea edx, [eax + eax]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x10066866
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
and eax, ecx
lea ecx, [edx + 8]
cmp eax, 0x400
ja 0x10066848
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.10123e30
mov esi, esp
test esi, esi
je 0x100668ae
mov dword [esi], 0xcccc
jmp 0x10066861
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.10128e50
mov esi, eax
pop ecx
test esi, esi
je 0x100668ae
mov dword [esi], 0xdddd
add esi, 8
jmp 0x10066868
mov esi, ebx
test esi, esi
je 0x100668ae
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.1000519a
test eax, eax
je 0x10066888
mov ecx, dword [ebp - 0x10]
push eax
call fcn.10068146
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call fcn.10068162
pop ecx
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10122e6d
mov esp, ebp
pop ebp
ret 8
call fcn.10004bd5
int3
Function at 0x10071524
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.10015d8f
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
push 0x20
mov ebx, eax
call esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.10011142
mov edi, dword [ebp - 0x18]
mov esi, eax
test edi, 0x1000
je 0x1007159c
cmp esi, 3
jne 0x1007158b
push 2
pop esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1007159c
xor eax, eax
jmp 0x100715f1
cmp esi, 0xa
jl 0x100715a6
cmp esi, 0x11
jle 0x100715ab
cmp esi, 4
jne 0x100715ef
test edi, 0x800
je 0x100715b8
push 2
pop eax
jmp 0x100715f1
mov eax, dword [ebp - 0x1c]
neg ebx
push ebx
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test edi, 0x200
je 0x100715ef
mov eax, esi
sub eax, 4
je 0x1007163c
sub eax, 9
je 0x10071628
sub eax, 1
je 0x10071618
dec eax
sub eax, 1
je 0x10071604
sub eax, 1
je 0x1007163c
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e6d
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setle al
dec eax
and eax, 5
add eax, 0xa
jmp 0x100715f1
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
add eax, 0xb
jmp 0x100715f1
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
lea eax, [eax*2 + 0xa]
jmp 0x100715f1
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setg al
lea eax, [eax*4 + 0xb]
jmp 0x100715f1
Function at 0x1007a472
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1019bfec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x1007a4a4
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1007a4cf
cmp dword [0x101a29a4], 0
jne 0x1007a4cf
lea ecx, [esi - 0x41]
cmp ecx, 0x19
jbe 0x1007a4c2
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x1007a4c6
mov eax, esi
jmp 0x1007a542
push esi
call fcn.10133cb5
pop ecx
jmp 0x1007a542
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10125f70
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1007a554
call fcn.10005abd
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10122e6d
mov esp, ebp
pop ebp
ret 4
call fcn.10004bd5
int3
Function at 0x1007aa65
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x1014418c
call fcn.101237e5
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
call fcn.1004c045
test eax, eax
je 0x1007ac06
lea ecx, [ebp - 0x1c]
xor edi, edi
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x1c], edi
push ecx
lea ecx, [ebx + 4]
call fcn.1007a90c
test eax, eax
je 0x1007aaa8
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.100051b1
push eax
lea ecx, [ebp - 0x18]
call fcn.100025b0
mov esi, 0x104
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.10002a10
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.10004e90
call fcn.100051b1
push eax
lea ecx, [ebp - 0x14]
call fcn.100025b0
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.10002a10
mov esi, dword [ebp - 0x18]
push eax
push edi
push 0x1015f15c
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.10004e90
push edi
push 0x4000100
push 2
push edi
push edi
mov edi, dword [ebp - 0x14]
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x1007ab40
lea ecx, [edi - 0x10]
call fcn.100028b0
lea ecx, [esi - 0x10]
jmp 0x1007ac01
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.1001610f
push 0
push 0x1000
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.1000e8f7
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [ebx + 0x20], 1
push edx
mov byte [ebp - 4], 4
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.1000eef9
and dword [ebx + 0x20], 0
lea ecx, [ebp - 0x88]
call fcn.1000ea07
lea ecx, [ebp - 0x40]
call fcn.100161c4
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
call fcn.10049563
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [edi - 0x10]
call fcn.100028b0
lea ecx, [esi - 0x10]
call fcn.100028b0
xor eax, eax
inc eax
jmp 0x1007ac08
call fcn.100028b0
xor eax, eax
call fcn.10123743
ret 8
Function at 0x100ce16c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1019b76c], 0
push esi
je 0x100ce24d
cmp dword [0x1019bac8], 0xfffffffe
jne 0x100ce23a
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x100ce24d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101a597c]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101a4a08]
cmp eax, dword [ecx + 4]
jle 0x100ce1e4
mov ebx, 0x101a4a08
push ebx
call fcn.101232f9
cmp dword [0x101a4a08], 0xffffffff
pop ecx
jne 0x100ce1e4
mov ecx, 0x101a49e8
call fcn.10036971
push 0x1014c3da
call fcn.10123189
push ebx
call fcn.101232ba
pop ecx
pop ecx
mov ebx, 0x101a49f0
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x101a49d4], 0
jne 0x100ce250
push 0
push 0
push 0x100ce256
call fcn.1012af8c
add esp, 0xc
mov dword [0x101a49d4], eax
test eax, eax
je 0x100ce229
cmp eax, 0xffffffff
je 0x100ce229
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x1019bac8], esi
jmp 0x100ce230
and dword [0x101a49d4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
jmp 0x100ce24d
mov eax, dword [ebp + 8]
mov dword [0x1019bac8], eax
inc eax
neg eax
sbb eax, eax
and dword [0x101a49d4], eax
pop esi
pop ebp
ret
call fcn.10004bd5
int3
Function at 0x100d48ed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1b8]
test al, al
jns 0x100d490c
or ecx, 0xffffffff
jmp 0x100d4912
mov ecx, dword [0x1019b904]
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x2b4]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x1019bb9c
call fcn.10008cd2
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x100d49b6
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x100d49b6
test edi, edi
je 0x100d4967
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x228]
push eax
push 0x1019b950
call fcn.10008cd2
pop ecx
pop ecx
mov ebx, eax
jmp 0x100d4969
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x100d49c1
test ebx, ebx
je 0x100d49a2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c0]
test al, 0x40
je 0x100d49b6
cmp dword [ebp - 4], 0
je 0x100d49a2
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x24c]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x100d49b8
mov eax, dword [esi]
mov ecx, esi
push 5
push 0
push edi
call dword [eax + 0x1f8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 3
jne 0x100d49b6
test edi, edi
je 0x100d49b6
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x184]
test eax, eax
je 0x100d49b6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18c]
test eax, eax
je 0x100d49b6
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x240]
mov eax, dword [esi]
mov ecx, esi
push 0
push 1
push 5
push edi
call dword [eax + 0x34c]
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x100d49b8
Function at 0x100d6794
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x101a597c]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov ebx, ecx
mov eax, dword [0x101a4b24]
cmp eax, dword [edx + 4]
jle 0x100d67ef
mov esi, 0x101a4b24
push esi
call fcn.101232f9
cmp dword [0x101a4b24], 0xffffffff
pop ecx
jne 0x100d67ef
call fcn.100051b1
push eax
mov ecx, 0x101a4b20
call fcn.100025b0
push 0x1014c3f2
call fcn.10123189
push esi
call fcn.101232ba
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100d6891
mov eax, dword [ebx + 0x34c]
test eax, eax
je 0x100d6888
cmp dword [eax + 0x20], 0
je 0x100d6888
test eax, eax
je 0x100d6815
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x100d6888
mov eax, dword [edi + 4]
sub eax, 1
je 0x100d685c
sub eax, 1
je 0x100d6832
sub eax, 1
jne 0x100d6888
mov esi, 0x428e
jmp 0x100d6861
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100d6861
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x340]
test eax, eax
je 0x100d6861
add esi, 3
jmp 0x100d6861
mov esi, 0x3ea0
push esi
call fcn.10004dfb
test eax, eax
je 0x100d6891
push esi
push eax
mov ecx, 0x101a4b20
call fcn.10002710
test eax, eax
je 0x100d6891
mov eax, dword [0x101a4b20]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x100d688a
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.10004bd5
int3
Function at 0x100e66af
Capabilities:
Log keystrokes via polling
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x10149334
call fcn.1012377a
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x100
jne 0x100e6795
mov edi, dword [ebx + 8]
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x100e6795
cmp edi, 0x43
je 0x100e66f4
cmp edi, 0x2d
jne 0x100e6795
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x100e6795
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.100051b1
push eax
lea ecx, [ebp + 8]
call fcn.100025b0
movzx eax, byte [esi + 0xe6]
and dword [ebp - 4], 0
push eax
movzx eax, byte [esi + 0xe5]
push eax
movzx eax, byte [esi + 0xe4]
push eax
lea eax, [ebp + 8]
push str.RGB__d___d___d_
push eax
call fcn.10003879
mov esi, dword [ebp + 8]
add esp, 0x14
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.100028b0
mov esi, dword [ebp - 0x10]
push ebx
mov ecx, esi
call fcn.100e3dd4
call fcn.10123743
ret 4