joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032e60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012afba
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10175120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.LogUtils::LogAppender.0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.100086e0
mov ecx, eax
test ecx, ecx
je 0x10033024
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.100086e0
mov ecx, eax
test ecx, ecx
je 0x1003302e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.100086e0
mov ecx, eax
test ecx, ecx
je 0x10033038
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x10032f42
xor ecx, ecx
jmp 0x10032f60
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032f50
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.10008ee0
push edi
mov ecx, ebx
call fcn.1000dd40
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x10032f7c
xor ecx, ecx
jmp 0x10032f94
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10032f84
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.10008ee0
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.10033980
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.1000dd40
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10032fd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x1003300e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1003300e
cmp dword [esi + 0x10], 0
je 0x10033005
push dword [edi]
call fcn.100eaa13
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.10008440
push 0x80004005
call fcn.10008440
push 0x80004005
call fcn.10008440
int3
Function at 0x10033720
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012b0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10175120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x100338f4
push str.__set_log_lev0
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10033775
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 4]
jmp 0x100338f4
push str.__set_log_lev1
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10033793
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax + 4]
jmp 0x100338f4
push str.__set_log_lev2
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100337b1
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 4]
jmp 0x100338f4
push str.__set_log_lev3
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100337cf
mov eax, dword [edi]
mov ecx, edi
push 3
call dword [eax + 4]
jmp 0x100338f4
push str.__reload_log_switch
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100338f4
lea eax, [edi + 4]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x100337f4
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [edi + 0x2c]
mov dword [edi + 0x1c], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x30], ecx
jb 0x10033827
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
cmp ecx, 8
jae 0x1003383f
movups xmm0, xmmword [eax]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
jmp 0x1003387d
mov esi, ecx
mov eax, SysReAllocString
or esi, 7
lea ecx, [ebp - 0x28]
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
push eax
call fcn.10005ec0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x2c]
push eax
call fcn.100d9250
mov eax, dword [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
push 0x1013988c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.10034110
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100338ab
mov dword [edi + 0x1c], 0
cmp dword [edi + 0x28], 0
je 0x100338e4
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x100338e4
push str._______log_reload_switch
lea ecx, [ebp - 0x4c]
call fcn.1001d880
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x4c]
push edx
mov byte [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x4c]
call fcn.10005ca0
lea ecx, [ebp - 0x28]
call fcn.10005ca0
lea ecx, [ebp - 0x34]
call fcn.100330f0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031d6d
mov esp, ebp
pop ebp
ret 4
Function at 0x10033cf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012b167
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10175120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea esi, [edi + 4]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x10033d3a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, ebx
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033d46
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [edi + 0x2c]
call fcn.10005f30
cmp dword [edi + 0x28], 0
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
jne 0x10033db3
push 0x48
call fcn.100319cc
mov ebx, eax
add esp, 4
mov dword [ebp - 0x38], ebx
mov byte [ebp - 4], 1
test ebx, ebx
je 0x10033da7
push 0x48
push 0
push ebx
call fcn.100d9d50
add esp, 0xc
mov ecx, ebx
push dword [ebp + 0x14]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.10032e60
jmp 0x10033da9
xor eax, eax
mov ebx, dword [ebp - 0x2c]
mov byte [ebp - 4], 0
mov dword [edi + 0x28], eax
xor eax, eax
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0x10], eax
mov ecx, ebx
mov dword [ebp - 0x14], 7
sete al
lea edx, [ecx + 2]
lea eax, [eax*2 + 1]
mov dword [edi + 0x1c], eax
xor eax, eax
mov word [ebp - 0x28], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10033de0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x28]
call fcn.10005f30
push 3
push 0x1013988c
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.10020800
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10033e2f
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], eax
cmp dword [edi + 0x28], 0
je 0x10033e7e
mov eax, dword [edi]
mov ecx, edi
push 1
mov eax, dword [eax + 8]
call eax
test al, al
je 0x10033e7e
push 0x10
xor eax, eax
mov dword [ebp - 0x40], 0
push str._______log_start
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
call fcn.10005f30
mov ecx, dword [edi + 0x28]
lea edx, [ebp - 0x50]
push edx
mov byte [ebp - 4], 3
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0x50]
call fcn.10005ca0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x10033eb4
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10033eaa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033ef1
push edx
push ecx
call fcn.100319fc
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
test esi, esi
je 0x10033ed3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031d6d
mov esp, ebp
pop ebp
ret 0x14
call fcn.100dd3d3
int3
Function at 0x100470b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x100470d5
or esi, 1
push 1
call edi
test ax, ax
jns 0x100470e1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x100470ed
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x100470f9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x10049ed0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
xor esi, esi
lea ecx, [ebx + 0xe0]
call fcn.10017ae0
mov edi, dword [ebp + 8]
test eax, eax
jle 0x10049f2b
nop
push esi
lea ecx, [ebx + 0xe0]
mov byte [ebp + 0xb], 0
call fcn.10043a90
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x1004a05c
lea ecx, [ebx + 0xe0]
inc esi
call fcn.10017ae0
cmp esi, eax
jl 0x10049ef0
sub edi, 0x100
je 0x10049ff1
sub edi, 4
je 0x10049f92
sub edi, 2
jne 0x10049fe6
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call fcn.100e98e0
mov ecx, dword [ebx + 0x58]
lea edx, [ebp + 8]
add esp, 4
mov word [ebp + 8], ax
mov eax, dword [ecx]
push 0x8000000a
push edx
push 0x1004bd50
call dword [eax + 0x14c]
mov esi, eax
test esi, esi
je 0x10049fe6
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x13c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebx + 0x5c], 0
je 0x10049fe6
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x74]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.100470b0
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + pe_nt_image_headers32]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x10049fe6
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x1004a043
mov eax, dword [ecx]
mov eax, dword [eax + 0x110]
call eax
test al, al
je 0x1004a043
mov ecx, dword [ebx + 0x5c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x11c]
call eax
test al, al
je 0x1004a043
mov ecx, dword [ebx + 0x5c]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x10]
push eax
call fcn.100da0cb
add esp, 8
test eax, eax
je 0x1004a043
mov ecx, dword [ebx + 0x5c]
call fcn.10065a80
test al, al
jne 0x10049fe6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.1004b4e0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1004cc40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1004cc85
cmp byte [ebp + 8], 0
je 0x1004cc79
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x1004f9a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x10175120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x10180198
mov dword [ebp - 0x78], 0x6f0053
lea esi, [ebp - 0x78]
mov dword [ebp - 0x74], 0x740066
push edi
mov dword [ebp - 0x70], 0x610077
mov edx, 0x3a
mov dword [ebp - 0x6c], 0x650072
sub esi, eax
mov dword [ebp - 0x68], 0x4d005c
mov dword [ebp - 0x64], 0x630069
mov dword [ebp - 0x60], 0x6f0072
mov dword [ebp - 0x5c], 0x6f0073
mov dword [ebp - 0x58], 0x740066
mov dword [ebp - 0x54], 0x49005c
mov dword [ebp - 0x50], 0x74006e
mov dword [ebp - 0x4c], 0x720065
mov dword [ebp - 0x48], 0x65006e
mov dword [ebp - 0x44], 0x200074
mov dword [ebp - 0x40], 0x780045
mov dword [ebp - 0x3c], 0x6c0070
mov dword [ebp - 0x38], 0x72006f
mov dword [ebp - 0x34], 0x720065
mov dword [ebp - 0x30], 0x4d005c
mov dword [ebp - 0x2c], 0x690061
mov dword [ebp - 0x28], 0x5c006e
mov dword [ebp - 0x24], 0x650046
mov dword [ebp - 0x20], 0x740061
mov dword [ebp - 0x1c], 0x720075
mov dword [ebp - 0x18], 0x430065
mov dword [ebp - 0x14], 0x6e006f
mov dword [ebp - 0x10], 0x720074
mov dword [ebp - 0xc], 0x6c006f
mov dword [ebp - 8], 0x5c
nop dword [eax]
lea ecx, [edx + 0x7fffffc4]
test ecx, ecx
je 0x1004faae
movzx ecx, word [esi + eax]
test cx, cx
je 0x1004faae
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1004fa90
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031d6d
mov esp, ebp
pop ebp
ret
Function at 0x10052b40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1012d3fb
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x10175120]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x231]
xor esi, esi
mov dword [ebp - 0x238], esi
call fcn.1004f2a0
push eax
lea ecx, [ebp - 0x230]
call fcn.1001d880
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [ebp - 4], esi
jb 0x10052b9c
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x230]
push eax
call fcn.10020800
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10052c31
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.100d9d50
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x10052c31
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 1
cmove esi, ecx
mov eax, dword [ebp - 0x238]
test eax, eax
je 0x10052c42
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x21c]
cmp edx, 8
jb 0x10052c7e
mov ecx, dword [ebp - 0x230]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10052c74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10052c9d
push edx
push ecx
call fcn.100319fc
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031d6d
mov esp, ebp
pop ebp
ret 8
call fcn.100dd3d3
int3
Function at 0x100633a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
movzx eax, word [edi + 0xc]
sub eax, 0x41
je 0x10063402
sub eax, 2
je 0x100633e3
sub eax, 0x15
jne 0x10063452
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10063452
push 0
push edi
push dword [ebp + 0xc]
push str.cutkey
jmp 0x10063447
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10063452
push 0
push edi
push dword [ebp + 0xc]
push str.copykey
jmp 0x10063447
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10063452
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], 2
push eax
mov eax, dword [esi + 0x14]
push 0xffffffffffffffff
push 0x102b
mov dword [ebp - 0x30], 2
push dword [eax + 0x558]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push edi
push dword [ebp + 0xc]
push str.selectallkey
push dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
call fcn.1004a7b0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10063f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
mov ebx, ecx
call fcn.10057bb0
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10063f8e
mov ecx, dword [ebx + 0x55c]
mov eax, 5
push edi
xor edi, edi
cmp byte [ebp + 8], 0
cmovne edi, eax
push edi
call fcn.10017ae0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x558]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
pop ebp
ret 4

Function at 0x10067500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x594], 0
je 0x1006756d
cmp dword [ebp + 8], 0x100
jne 0x1006755d
cmp word [ebp + 0xc], 0xd
jne 0x1006755d
cmp byte [esi + 0x59a], 0
je 0x1006753e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1006755d
cmp byte [esi + 0x59b], 0
jne 0x1006755d
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10067556
push 0
push 0
push 0
push str.return
push esi
call fcn.1004a7b0
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x594]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x100684b0
Capabilities:
Check if file exists
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x1017eb8e
push 0x34
call fcn.10031d85
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
je 0x10068529
mov dword [esi], 2
mov dword [esi + 4], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
jmp 0x1006852b
xor esi, esi
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 8
jb 0x10068538
mov edi, dword [edi]
xor ebx, ebx
test edi, edi
je 0x100685af
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100685af
push ebx
push 0x80
push 3
push ebx
push 1
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100685af
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x16
jb 0x100685af
push ebx
push ebx
push ebx
push 2
push ebx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 8], eax
test eax, eax
je 0x100685af
push ebx
push ebx
push ebx
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0xc], eax
test eax, eax
je 0x100685af
push dword [esi + 0x14]
mov ecx, esi
push eax
call fcn.10067e30
mov ebx, eax
test ebx, ebx
jne 0x100685dd
mov eax, dword [esi + 0xc]
test eax, eax
je 0x100685c4
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100685e3
push eax
call edi
mov dword [esi + 8], 0
jmp 0x100685e3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100685f5
push eax
call edi
mov dword [esi + 4], 0xffffffff
pop edi
test ebx, ebx
pop ebx
jne 0x10068614
mov ecx, esi
call fcn.10067af0
push 0x34
push esi
call fcn.100319fc
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1006fb50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x1017eb8e
cmp al, 6
jb 0x1006fb8d
push 0x18
call fcn.10031d85
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1006fbc9
mov ecx, eax
call fcn.1006fbe0
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 0x14
call fcn.10031d85
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x1006fbc9
mov dword [eax], vtable.CGDIPlusImageImpl.0
mov dword [eax + 4], 6
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi], eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret