joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013ea4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff800
mov esi, edx
mov edi, eax
mov eax, esi
xor edx, edx
call fcn.10005940
push 0x400
lea eax, [esp + 4]
push eax
mov eax, edi
call fcn.100059cc
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
mov ebx, eax
cmp ebx, 0x400
jge 0x10013eeb
mov edx, esp
mov eax, esi
mov ecx, ebx
call fcn.10005a7c
jmp 0x10013f04
mov edx, ebx
dec edx
mov eax, esi
call fcn.10005ca4
push ebx
mov eax, dword [esi]
call fcn.100059cc
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableW
add esp, 0x800
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100235b8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.100232bc
dec esi
jne 0x100235da
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x10024784
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x100afe90
cmp dword [edi], 0
jne 0x10024800
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x100afe8c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x100a1cd4
mov ecx, 2
call fcn.1000316c
mov edx, 0x1002475c
lea eax, [esi + 5]
call fcn.1002477c
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.1002477c
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x100247d5
mov dword [0x100afe8c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x1003d800
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x1003d8b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.1003d798
test al, al
je 0x1003d89a
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.10005a7c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x1003d89a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.100059cc
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.100059cc
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.10005aec
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x1003d853
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003d8bf
lea eax, [ebp - 0x2c]
call fcn.10005930
lea eax, [ebp - 4]
call fcn.10005930
ret

Function at 0x1003d9c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.100059cc
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
je 0x1003da18
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x100aa728]
mov dl, 1
mov eax, dword [0x1003d310]
call fcn.10011474
call fcn.10004714
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.1003d498
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1003efbc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x1003efc2
ret
Function at 0x100466b0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1004672c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov edx, dword [ebp - 8]
inc edx
lea eax, [ebp - 4]
call fcn.100058d4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.100057ec
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x1004670d
mov edx, dword [ebp - 8]
dec edx
lea eax, [ebp - 4]
call fcn.100058d4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.10005b90
jmp 0x10046716
mov eax, ebx
xor edx, edx
call fcn.10005940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10046733
lea eax, [ebp - 4]
call fcn.10005620
ret
Function at 0x10047bec
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.10005928
xor eax, eax
push ebp
push 0x10047cf2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.1000c0c4
cmp dword [ebp - 8], 0
je 0x10047c35
mov eax, dword [ebp - 8]
mov edx, 0x10047d0c
call fcn.100060cc
jne 0x10047c47
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x10047d1c
call fcn.10005dfc
jmp 0x10047c63
mov ebx, 0x65
mov eax, dword [ebp - 8]
call fcn.1000bc64
test al, al
jne 0x10047c63
mov eax, dword [ebp - 8]
call fcn.1000bc88
dec ebx
jne 0x10047c4c
mov eax, dword [ebp - 4]
call fcn.100059cc
push eax
call sub.kernel32.dll_GetFileAttributesW
test al, 1
je 0x10047c7f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.1000bd9c
mov dl, 1
mov eax, dword [0x1001a150]
call fcn.1001e9f4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x10047cc5
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.1003c530
call fcn.100147c0
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x80]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10047ccf
mov eax, dword [ebp - 0xc]
call fcn.10003d38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10047cf9
lea eax, [ebp - 8]
mov edx, 2
call fcn.10005938
ret
Function at 0x1004b878
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x1004b89e
shr edx, 1
xor edx, eax
jmp 0x1004b8a0
shr edx, 1
inc ecx
jne 0x1004b890
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x1004b889
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x1004b8b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x1004b8c1
mov eax, dword [ebp - 4]
add esp, 0xfffff7f0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.1001ea54
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
or esi, 0xffffffff
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
sub eax, dword [ebp + 8]
sub eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x1004b96e
cmp dword [ebp - 0xc], 0x2800
jl 0x1004b91c
mov dword [ebp - 8], 0x2800
jmp 0x1004b922
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x2814]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp ebx, dword [ebp - 0x10]
jge 0x1004b966
mov eax, esi
shr eax, 8
and eax, 0xffffff
movzx edx, byte [ebp + ebx - 0x2814]
xor esi, edx
and esi, 0xff
xor eax, dword [esi*4 + 0x100b0ca4]
mov esi, eax
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x1004b93d
mov eax, dword [ebp - 8]
sub dword [ebp - 0xc], eax
jmp 0x1004b904
mov ebx, esi
xor ebx, 0xffffffff
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004da24
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x1004dabe
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x100a5cec]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x100a5cec]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x100a5cec]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x100a5cec]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x1004da43
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x1004dad4
dec edx
je 0x1004db09
jmp 0x1004db5a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x100a5cec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x100a5cec]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x1004db5a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x100a5cec]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x100a5cec]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x100a5cec]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1004dc3c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x1004dc5b
add edx, 3
sar edx, 2
test edx, edx
jle 0x1004dd69
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x1004dc90
je 0x1004dcd3
sub ecx, 0x2b
je 0x1004dcc9
sub ecx, 4
je 0x1004dcce
dec ecx
sub ecx, 0xa
jb 0x1004dcbb
jmp 0x1004dcd6
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x1004dca2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x1004dcad
jmp 0x1004dcd6
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x1004dcd6
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x1004dcd6
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x1004dcd6
mov byte [eax], 0x3e
jmp 0x1004dcd6
mov byte [eax], 0x3f
jmp 0x1004dcd6
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x1004dc73
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x1004dd27
cmp byte [esp + 7], 0xff
jne 0x1004dd27
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x1004dd5e
cmp dl, 0xff
je 0x1004dd5e
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x1004dc6a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x1004ec84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x1004eca5
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x1004ec92
pop edi
pop esi
pop ebx
ret

Function at 0x10053688
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x100536dc
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x100a7f6c]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x100a836c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x100a876c]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x100a8b6c]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x10053696
pop edi
pop esi
pop ebx
ret
Function at 0x10055520
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.10003630
ret

Function at 0x100556f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10005928
xor eax, eax
push ebp
push 0x1005583e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.10055520
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.100059cc
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1005581d
xor eax, eax
push ebp
push 0x10055816
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100557ff
xor eax, eax
push ebp
push 0x100557f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100557e1
xor eax, eax
push ebp
push 0x100557da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.10055558
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100557e1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x100557ff
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1005581d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.100555e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10055845
lea eax, [ebp - 4]
call fcn.10005930
ret
Function at 0x1005e338
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.10005940
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov eax, edi
call fcn.100059cc
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x1005e3f7
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.100059cc
mov edi, eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
cmp dword [ebp - 0xc], 0
je 0x1005e3ee
mov eax, dword [ebp - 0xc]
call fcn.10002f9c
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x1005e3e7
mov eax, dword [ebp - 0x10]
dec eax
sub eax, 2
jb 0x1005e3d0
sub eax, 4
jne 0x1005e3db
mov eax, ebx
mov edx, esi
call fcn.10005aec
jmp 0x1005e3e7
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov edx, esi
call fcn.10005a7c
mov eax, esi
call fcn.10002fd0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10066e20
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.10005940
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x10066e67
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.10005b28
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x1006c280
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1006c3b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x1003d384]
call fcn.1003d4c0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x1006c38f
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.1003d560
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.10005b28
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x1006c3d4
call fcn.10005dfc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.1003d5c4
test al, al
je 0x1006c379
lea ecx, [ebp - 4]
mov edx, 0x1006c448
mov eax, dword [ebp - 0xc]
call fcn.1003d940
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.10013e20
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x1006c372
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x1006c460
mov eax, dword [ebp - 8]
push eax
call fcn.100085d0
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x100a9d34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006c379
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1006c396
mov eax, dword [ebp - 0xc]
call fcn.10003d38
ret

Function at 0x1006c4c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x1006c50b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x1006c4ee
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x1006c4ff
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x1006c50b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x10071be0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x100b18f0], 0
je 0x10071d21
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x100aa4e4]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x10071d21
mov eax, dword [0x100b18f4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x100b18f0]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x10071cf0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x100b18f0]
call fcn.1001c31c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x10071ce8
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x10071ce8
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x10071ce8
mov eax, dword [ebp - 0x14]
call fcn.1007ccbc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x10071ce8
push ebp
call fcn.10071b9c
pop ecx
test al, al
jne 0x10071ce8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.10003f48
test al, al
je 0x10071ce8
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.10003f48
cmp byte [ebp - 1], 0
je 0x10071ce8
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.10008250
test al, al
je 0x10071ce8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x100b18f4]
call fcn.10071314
inc edi
dec ebx
jne 0x10071c45
mov eax, dword [0x100b18f4]
cmp dword [eax + 8], 0
jle 0x10071d08
mov eax, dword [0x100b18f4]
call fcn.100713cc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10071d21
push ebp
mov eax, dword [ebp - 0x18]
call fcn.10071a00
pop ecx
test al, al
jne 0x10071d21
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret