joyce8/EMBER2024-capa huggingface dataset:
Function at 0x107b23a
Capabilities:
Get file system object information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6d8
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], ecx
cmp eax, ebx
je 0x107b26c
mov dword [eax], ebx
or dword [ecx], 0xffffffff
lea eax, [ebp - 0x6cc]
push eax
push 0x101c810
sub esp, 0x10
mov edi, esp
mov esi, 0x101c800
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6cc], ebx
movsd dword es:[edi], dword [esi]
call sub.SHLWAPI.dll_AssocCreate
mov esi, eax
cmp esi, ebx
jl 0x107b384
mov eax, dword [ebp - 0x6cc]
mov ecx, dword [eax]
push ebx
push ebx
push 0x107b3a8
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, ebx
jl 0x107b384
mov eax, dword [ebp - 0x6cc]
lea edx, [ebp - 0x6d8]
push edx
lea edx, [ebp - 0x20c]
push edx
push ebx
push 2
mov edi, 0x104
push 0x40
mov dword [ebp - 0x6d8], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x107b384
push 0x111
push 0x2b4
lea eax, [ebp - 0x6c8]
push eax
push 0x80
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x80004005
call sub.SHELL32.dll_SHGetFileInfoW
test eax, eax
je 0x107b384
mov eax, dword [ebp - 0x6c4]
mov ecx, dword [ebp - 0x6d0]
mov dword [ecx], eax
cmp dword [ebp - 0x6d4], ebx
je 0x107b370
mov eax, dword [ebp - 0x6cc]
lea edx, [ebp - 0x6d0]
push edx
lea edx, [ebp - 0x414]
push edx
push ebx
push 4
push 0x40
mov dword [ebp - 0x6d0], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x107b370
push dword [ebp - 0x6d4]
lea eax, [ebp - 0x414]
push eax
call fcn.0100af3e
mov esi, eax
cmp dword [ebp - 0x6c8], ebx
je 0x107b384
push dword [ebp - 0x6c8]
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x6cc]
cmp eax, ebx
je 0x107b394
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 8
Function at 0x107b979
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
xor edi, edi
cmp dword [0x10b3a68], edi
jne 0x107ba1d
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push 0x107ba78
push 0x80000002
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x107ba15
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x107ba4c
push dword [ebp - 0xc]
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x107ba0a
cmp dword [ebp - 4], edi
je 0x107ba0a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x107ba2c
push dword [ebp - 0xc]
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x107ba03
cmp dword [ebp - 4], edi
jne 0x107ba0a
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov eax, dword [ebp - 0x10]
mov dword [0x10b3a68], eax
xor eax, eax
cmp dword [0x10b3a68], 1
pop edi
sete al
leave
ret

Function at 0x107ba97
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x107bae0
cmp dword [ebp - 0x110], 2
jne 0x107bade
cmp dword [ebp - 0x11c], 6
jb 0x107bade
xor eax, eax
inc eax
jmp 0x107bae0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100204d
leave
ret

Function at 0x107bc03
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, eax
push edi
mov dword [esi], ebx
cmp dword [ebp + 8], ebx
jne 0x107bc7d
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
cmp dword [eax + 0x1d4], ebx
je 0x107bc7d
lea eax, [ebp - 4]
push eax
push 0x107bc98
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x107bc41
cmp dword [ebp - 4], ebx
je 0x107bc56
mov edi, 0x80004005
call fcn.0107b979
test eax, eax
je 0x107bc8c
mov ecx, 0x107bcac
jmp 0x107bc82
lea eax, [ebp + 8]
push eax
call fcn.0107f3c8
mov edi, eax
cmp edi, ebx
jl 0x107bc46
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0107baf1
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x107bc8c
mov ecx, 0x107bca4
push dword [ebp + 0xc]
call fcn.0107baf1
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x107d4b7
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
and dword [ebp - 0xc], esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jae 0x107d52e
lea eax, [ebp - 8]
push eax
push 0
push 0x5000
push dword [ebp - 4]
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jl 0x107d523
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call sub.SHLWAPI.dll_PathCommonPrefixW
mov ebx, eax
test ebx, ebx
je 0x107d51b
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp ebx, eax
jne 0x107d51b
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov dword [eax], ebx
inc esi
push dword [ebp - 8]
call sub.ole32.dll_CoTaskMemFree
inc dword [ebp - 0xc]
add dword [ebp - 4], 0x10
test esi, esi
je 0x107d4ca
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10

Function at 0x107d606
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov eax, esi
push edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x107d626
sub eax, edx
sar eax, 1
cmp eax, 0x27
jbe 0x107d681
lea eax, [ebp - 0x14]
push eax
push esi
call sub.SHLWAPI.dll_GUIDFromStringW
test eax, eax
je 0x107d681
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0x5000
lea eax, [ebp - 0x14]
push eax
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jl 0x107d681
lea eax, [esi + 0x4e]
push eax
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push ebx
call fcn.01077616
push dword [ebp - 0x18]
mov edi, eax
call sub.ole32.dll_CoTaskMemFree
test edi, edi
jge 0x107d68d
push esi
push dword [ebp + 0xc]
push ebx
call fcn.010065a0
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 0xc

Function at 0x107d6a5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
or ecx, 0xffffffff
sub ecx, dword [ebp + 0x10]
cmp dword [ebp + 0xc], 0
je 0x107d6d7
mov eax, dword [ebp + 8]
push esi
movzx edx, byte [eax]
dec dword [ebp + 0xc]
movzx esi, cl
xor edx, esi
shr ecx, 8
xor ecx, dword [edx*4 + 0x107d6e0]
inc eax
cmp dword [ebp + 0xc], 0
jne 0x107d6ba
pop esi
or eax, 0xffffffff
sub eax, ecx
pop ebp
ret 0xc
Function at 0x107e302
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push 0x107e358
push esi
call dword [eax + 0x2c]
xor edi, edi
lea eax, [ebp + 8]
push eax
push dword [edi + 0x107e35c]
push 0
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jl 0x107e345
cmp dword [ebp + 8], 0
je 0x107e345
push dword [ebp + 8]
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
push dword [ebp + 8]
call sub.SHELL32.dll_ILFree
add edi, 4
cmp edi, 0xc
jb 0x107e319
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x107f715
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x10b1090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, 0x488
push ebx
mov dword [ebp - 0x494], eax
xor edi, edi
lea eax, [ebp - 0x48c]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 8]
mov dword [ebp - 0x45c], eax
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x460], 0x20000
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x420], 0x78
mov dword [ebp - 0x41c], 0x280
mov dword [ebp - 0x490], 0x80004005
cmp dword [ebp - 0x494], edi
jne 0x107f7a1
mov eax, dword [esi]
mov dword [ebp - 0x494], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x107f91b
lea eax, [ebp - 0x414]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push edi
push dword [ebp - 0x494]
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0107f4c0
cmp eax, edi
mov dword [ebp - 0x490], eax
jl 0x107f91b
push 0x107f934
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0107f5fb
cmp eax, edi
mov dword [ebp - 0x490], eax
jl 0x107f91b
mov ebx, dword [sym.imp.ADVAPI32.dll_StartTraceW]
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x494]
lea eax, [ebp - 0x49c]
push eax
mov dword [ebp - 0x49c], edi
mov dword [ebp - 0x498], edi
call ebx
push eax
call fcn.0103d160
mov dword [ebp - 0x490], eax
cmp eax, 0x80070057
jne 0x107f884
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x107f879
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x494]
lea eax, [ebp - 0x49c]
push eax
call ebx
push eax
call fcn.0103d160
jmp 0x107f87e
call fcn.0101d802
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], edi
jl 0x107f91b
mov dword [ebp - 0x494], edi
cmp dword [esi + 0x14], edi
jbe 0x107f8ec
xor ebx, ebx
cmp dword [ebp - 0x490], edi
jl 0x107f8f4
mov eax, dword [esi + 0x10]
push edi
push edi
push edi
push edi
add eax, ebx
push dword [eax + 0x14]
push dword [eax + 0x10]
push 4
push 1
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_EnableTraceEx]
push eax
call fcn.0103d160
inc dword [ebp - 0x494]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x494]
add ebx, 0x18
cmp eax, dword [esi + 0x14]
jb 0x107f89d
cmp dword [ebp - 0x490], edi
jge 0x107f91b
lea eax, [ebp - 0x48c]
push eax
push edi
push dword [ebp - 0x498]
push dword [ebp - 0x49c]
call dword [sym.imp.ADVAPI32.dll_StopTraceW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x490]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret 8
Function at 0x1088cc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push 0x10
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
test eax, eax
setne cl
or ecx, 2
push ecx
push dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
xor ecx, ecx
test eax, eax
setne cl
lea eax, [ebp - 0x28]
add ecx, 3
or ecx, 0x500
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.01088c47
xor eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x1089155
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, ecx
cmp dword [edi + 0xb4], 0
jne 0x10892c1
push 0
push 0x10892c8
push 0x1017868
push 0x2000000
push 0x80000001
call fcn.010178cc
test eax, eax
jne 0x10892c1
push 0xd3
push dword [0x10b10b4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_177]
mov dword [ebp - 4], eax
test eax, eax
je 0x10892c1
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
mov ebx, dword [sym.imp.USER32.dll_DeleteMenu]
test ax, ax
jge 0x1089208
push 0x11
call esi
test ax, ax
jge 0x1089208
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
push 0x10481c4
push 0x10484f8
push 0x80000001
mov dword [ebp - 8], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x1089208
cmp dword [ebp - 0xc], eax
je 0x1089208
push eax
push 0x7ff4
push dword [ebp - 4]
call ebx
push 0x10
call esi
test ax, ax
jge 0x108921a
push 0x11
call esi
test ax, ax
jl 0x1089229
xor esi, esi
push esi
push 0x7ff4
push dword [ebp - 4]
call ebx
jmp 0x108922b
xor esi, esi
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x108924b
push 1
lea eax, [ebp - 0x14]
push eax
push esi
push dword [edi + 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1089258
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [edi]
push edi
call dword [eax + 4]
push esi
push dword [edi + 0x38]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x102
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
cmp eax, 0x7ff3
jne 0x108928e
push esi
mov ecx, edi
call fcn.01031eb9
push 2
call fcn.01048909
jmp 0x10892b0
cmp eax, 0x7ff4
jne 0x10892b0
push esi
mov ecx, edi
call fcn.01031eb9
push esi
push esi
push 0x5b4
push dword [0x10b10ec]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [edi]
push edi
call dword [eax + 8]
pop esi
pop ebx
pop edi
leave
ret 4
Function at 0x108a07e
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov esi, eax
cmp esi, edi
je 0x108a115
lea eax, [ebp - 4]
push eax
push edi
push edi
push 0x8003
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov esi, eax
cmp esi, edi
je 0x108a10b
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x108a0c2
sub eax, edx
sar eax, 1
push edi
add eax, eax
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov esi, eax
cmp esi, edi
je 0x108a102
push edi
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x10
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, esi
pop esi
leave
ret 8

Function at 0x108e372
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp word [eax + 0xc], 0x71
push edi
mov edi, ecx
jne 0x108e3c3
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
jl 0x108e3c2
push 0x11
call esi
test ax, ax
jl 0x108e3c2
push 0x12
call esi
test ax, ax
jl 0x108e3c2
test byte [edi + 0xc8], 8
je 0x108e3c2
mov ecx, edi
call fcn.0103c71b
test eax, eax
jl 0x108e3c2
push eax
mov ecx, edi
call fcn.0108e027
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x109518a
Capabilities:
Query service status
Start service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
push 1
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
cmp eax, esi
jne 0x10951b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x109524b
push edi
push 0x14
push 0x1095254
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
cmp edi, esi
jne 0x10951d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x109522d
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10951f3
call esi
mov ebx, eax
cmp ebx, 0x420
jne 0x1095238
mov ebx, 0x5b4
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x109522b
cmp dword [ebp - 0x20], 4
je 0x1095231
cmp dword [ebp - 0x20], 1
je 0x1095235
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
ja 0x1095238
jmp 0x10951f8
call esi
mov ebx, eax
jmp 0x1095238
xor ebx, ebx
jmp 0x1095238
mov ebx, dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test edi, edi
je 0x1095245
push edi
call esi
push dword [ebp - 8]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x109f02d
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
call fcn.0109edae
mov ecx, esi
call fcn.0109da6a
push 0xffffffffffffffec
push dword [esi + 4]
lea edi, [esi + 0x18]
call dword [sym.imp.USER32.dll_GetWindowLongW]
shr eax, 0x16
xor ebx, ebx
inc ebx
and eax, ebx
push eax
mov eax, dword [edi]
push edi
call dword [eax + 0x10]
push eax
push dword [ebp + 8]
call fcn.01099c4a
cmp eax, 0x24
jg 0x109f1a6
je 0x109f16a
cmp eax, 0xd
je 0x109f122
cmp eax, 0x1b
je 0x109f0e9
cmp eax, 0x20
je 0x109f122
cmp eax, 0x23
jne 0x109f230
lea eax, [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
mov eax, dword [esi + 0x90]
xor edi, edi
cmp eax, edi
je 0x109f0b1
mov eax, dword [eax]
jmp 0x109f0b3
xor eax, eax
cmp eax, edi
jle 0x109f230
mov eax, dword [esi + 0x90]
cmp eax, edi
je 0x109f0c9
mov eax, dword [eax]
jmp 0x109f0cb
xor eax, eax
mov ecx, dword [esi + 0x90]
mov ecx, dword [ecx + 4]
mov edi, dword [ecx + eax*4 - 4]
mov eax, dword [edi]
push edi
call dword [eax + 0x98]
push ebx
push eax
push edi
jmp 0x109f19a
xor edi, edi
cmp dword [esi + 0x150], edi
jne 0x109f0fb
cmp dword [esi + 0x9c], edi
jne 0x109f107
push edi
push edi
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0103dd6b
lea eax, [esi + 0x14]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x6c]
add esi, 0xbc
push esi
call fcn.01002bf6
jmp 0x109f230
xor edi, edi
cmp dword [esi + 0xa8], edi
je 0x109f230
cmp eax, 0xd
jne 0x109f146
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x109f146
mov eax, ebx
jmp 0x109f148
xor eax, eax
neg eax
push edi
sbb eax, eax
push ebx
and eax, 3
push eax
push dword [esi + 0xb0]
mov ecx, esi
push dword [esi + 0xa8]
call fcn.0103f98a
jmp 0x109f230
lea eax, [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x70]
mov eax, dword [esi + 0x90]
xor edi, edi
cmp eax, edi
je 0x109f183
mov eax, dword [eax]
jmp 0x109f185
xor eax, eax
cmp eax, edi
jle 0x109f230
mov eax, dword [esi + 0x90]
mov eax, dword [eax + 4]
push ebx
push edi
push dword [eax]
mov ecx, esi
call fcn.0109d629
jmp 0x109f230
mov ecx, eax
sub ecx, 0x25
push 0
pop edi
je 0x109f214
dec ecx
je 0x109f1b9
dec ecx
je 0x109f214
dec ecx
jne 0x109f230
cmp dword [esi + 0xa8], edi
je 0x109f214
mov eax, dword [esi + 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, 3
jne 0x109f1da
push edi
push ebx
push edi
jmp 0x109f152
mov eax, dword [esi + 0xa8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x109f230
push ebx
push 2
push dword [esi + 0xb0]
mov ecx, esi
push dword [esi + 0xa8]
call fcn.0109c869
test eax, eax
jl 0x109f230
push ebx
push dword [esi + 0xe4]
mov ecx, esi
call fcn.0109a989
jmp 0x109f230
mov ecx, ebx
cmp eax, 0x25
je 0x109f220
cmp eax, 0x26
jne 0x109f222
xor ecx, ecx
push edi
lea eax, [esi + 0x14]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x84]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x10a389d
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [0x10b36d4], 0
jne 0x10a38c0
push 0
push dword [0x10b10b4]
push 0x10a220c
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x10b36d4], eax
ret

Function at 0x10a38c6
Capabilities:
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
cmp dword [0x10b36d8], 0
push edi
mov edi, ecx
jne 0x10a3914
push esi
push 0
push dword [0x10b10b4]
push 0x10a228f
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
mov dword [0x10b36d8], eax
call esi
test ax, ax
jl 0x10a3913
push 0x5c
call esi
test ax, ax
jl 0x10a3913
call fcn.010a1840
pop esi
mov ecx, edi
pop edi
jmp fcn.010148bf
pop esi
pop edi
ret

Function at 0x10a65a5
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
push 0xffffffffffffffec
push dword [esi + 0x30]
xor edi, edi
inc edi
mov ebx, edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0x1a0]
shr eax, 0x16
and eax, edi
neg ecx
sbb ecx, ecx
and ecx, 2
or eax, ecx
push eax
push dword [esi + 0x164]
push dword [ebp + 8]
call fcn.01099c4a
cmp eax, 0x24
jg 0x10a667c
je 0x10a6678
cmp eax, 9
je 0x10a6658
cmp eax, 0xd
je 0x10a662b
cmp eax, 0xf
jle 0x10a66d0
cmp eax, 0x12
jle 0x10a66cc
cmp eax, 0x1b
je 0x10a66a4
cmp eax, 0x20
je 0x10a662b
cmp eax, 0x23
jne 0x10a66d0
push 3
jmp 0x10a66b3
mov eax, dword [esi + 0x118]
push 3
cdq
pop ecx
idiv ecx
cmp edx, edi
lea edi, [esi + 0x10]
mov esi, dword [edi]
push edi
jne 0x10a664e
call dword [esi + 0x2c]
push eax
push edi
call dword [esi + 0x48]
jmp 0x10a66d7
call dword [esi + 0x2c]
push eax
push edi
call dword [esi + 0x40]
jmp 0x10a66d7
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov ecx, esi
je 0x10a666f
push edi
jmp 0x10a6671
push 0
call fcn.010a57b6
jmp 0x10a66d7
push 2
jmp 0x10a66b3
cmp eax, 0x5d
jg 0x10a66b7
je 0x10a66cc
cmp eax, 0x25
jl 0x10a66d0
cmp eax, 0x26
jle 0x10a66b2
cmp eax, 0x27
je 0x10a66ae
cmp eax, 0x28
jne 0x10a66d0
push 4
mov ecx, esi
call fcn.010a57b6
test eax, eax
jge 0x10a66d7
push edi
mov ecx, esi
call fcn.01014829
jmp 0x10a66d7
push 0
jmp 0x10a66b3
push edi
mov ecx, esi
jmp 0x10a6671
cmp eax, 0xa0
jl 0x10a66d0
cmp eax, 0xa5
jle 0x10a66cc
cmp eax, 0xff
jne 0x10a66d0
xor ebx, ebx
jmp 0x10a66d7
mov ecx, esi
call fcn.010509c8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4