joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c2c06
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c2c3e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c0c80
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c0c58
jmp 0x4c2c4a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c42fb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c433d
call fcn.004ca78b
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c433d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c4334
xor eax, eax
jmp 0x4c4345
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c434b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4cacbb
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cace9
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cad07
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cac21
jmp 0x4cad07
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cad07
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cac21
test edi, edi
mov eax, edi
jne 0x4cacf1
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10002b25
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call sub.mfc100.dll_Ordinal_9475
movzx eax, byte [0x10342ad0]
mov dl, byte [0x34ccfc6]
xor edi, edi
xor ecx, ecx
test eax, eax
jle 0x10002b8a
mov al, byte [ecx + 0x10342ad1]
mov bl, byte [ecx + 0x10342ad2]
sub bl, dl
sub al, dl
sub bl, 2
sub al, 2
shl al, 4
and bl, 0xf
add bl, al
movzx eax, byte [0x10342ad0]
mov byte [ebp + edi - 0x168], bl
add ecx, 2
inc edi
cmp ecx, eax
jl 0x10002b57
push 0x1f4
mov byte [ebp + edi - 0x168], 0
call sub.mfc100.dll_Ordinal_265
mov dword [esp], 0x10111b20
push 0x1008b758
push eax
mov dword [ebp - 0x16c], eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push dword [ebp - 0x16c]
lea eax, [ebp - 0x68]
push 0x64
push eax
mov ebx, 0x1008aec4
push ebx
push 0x1008b754
lea eax, [ebp - 0x168]
push eax
call edi
xor edx, edx
lea ecx, [ebp + edx - 0x68]
mov al, byte [ecx]
test al, al
je 0x10002bf7
inc edx
not al
mov byte [ecx], al
cmp edx, 0xc8
jl 0x10002be0
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0xb8]
call sub.mfc100.dll_Ordinal_12868
push dword [ebp - 0x16c]
lea eax, [ebp - 0x68]
push 0x64
push eax
push ebx
push 0x1008b750
lea eax, [ebp - 0x168]
push eax
call edi
xor edx, edx
lea ecx, [ebp + edx - 0x68]
mov al, byte [ecx]
test al, al
je 0x10002c3a
inc edx
not al
mov byte [ecx], al
cmp edx, 0xc8
jl 0x10002c23
lea eax, [ebp - 0x68]
push eax
lea ecx, [esi + 0x12c]
call sub.mfc100.dll_Ordinal_12868
push dword [ebp - 0x16c]
lea eax, [ebp - 0x68]
push 0x64
push eax
push 0x1008b74c
push str.CHECK2
lea eax, [ebp - 0x168]
push eax
call edi
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.MSVCR100.dll_atoi]
pop ecx
push 0
push eax
push 0xf1
push dword [esi + 0x24c]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x16c]
call sub.mfc100.dll_Ordinal_1296
pop ecx
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
mov ecx, esi
call sub.mfc100.dll_Ordinal_12962
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.10083e24
leave
ret
Function at 0x100036b1
Capabilities:
Encode data using base64

Disassembly:
inc eax
rol eax, 2
mov dword [esp + ecx*4 - 0x10], 0x1d261735
add word [esp + ecx - 4], dx
bswap eax
xor ebx, eax
sar edx, cl
dec byte [esp + ecx + 0xa]
inc dl
adc edi, eax
shl dword [esp + ecx*2 + 4], 0x24
jb 0x1046472c
mov eax, 0xb3b08a24
sub esi, 4
movzx edx, al
neg dx
jne 0x104903db
mov dword [esp + ecx - 4], edi
ret 0xc
mov eax, dword [esi + edx - 0xffdc]
xor eax, ebx
bswap eax
mov ecx, edx
call fcn.104327d8
mov edx, 0x2b178d88
lea esi, [esi + edx*2 - 0x562f1b14]
mov eax, dword [esi + edx - 0x2b178d88]
dec edx
movsx ecx, dx
xchg dh, cl
xor eax, ebx
ror ecx, cl
bswap eax
and ecx, 0x800c62be
rol ecx, 0xf
ror eax, 3
sub eax, 0xb4a70a16
shr edx, 0x88
xor eax, 0xc700f6bf
shl cx, 0x41
not ecx
xor ebx, eax
xchg ecx, edx
add edi, eax
sar ecx, cl
mov eax, dword [ebp + ecx - 0x562f]
not edx
ror ecx, 0xb0
shr edx, 0x21
or cl, byte [edx + ebp - 0x18af0002]
lea ebp, [ebp + edx - 0x18af0004]
lea edx, [edx + edx*2 - 0x28e1a665]
add edx, 0x8317edbd
shl eax, cl
and dl, dh
mov dword [ebp], eax
jmp edi
Function at 0x10007392
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x1008540c
call fcn.10083e33
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.page1.0
lea ecx, [esi + 0x1380]
mov dword [ebp - 4], 0x24
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x130c]
mov byte [ebp - 4], 0x23
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1298]
mov byte [ebp - 4], 0x22
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1224]
mov byte [ebp - 4], 0x21
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x11b0]
mov byte [ebp - 4], 0x20
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x113c]
mov byte [ebp - 4], 0x1f
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x10c8]
mov byte [ebp - 4], 0x1e
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0x1054]
mov byte [ebp - 4], 0x1d
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xfe0]
mov byte [ebp - 4], 0x1c
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xf6c]
mov byte [ebp - 4], 0x1b
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xef8]
mov byte [ebp - 4], 0x1a
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe84]
mov byte [ebp - 4], 0x19
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xe10]
mov byte [ebp - 4], 0x18
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xd9c]
mov byte [ebp - 4], 0x17
call sub.mfc100.dll_Ordinal_915
mov byte [ebp - 4], 0x16
lea ecx, [esi + 0xd28]
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xcb4]
mov byte [ebp - 4], 0x15
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xc40]
mov byte [ebp - 4], 0x14
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xbcc]
mov byte [ebp - 4], 0x13
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xb58]
mov byte [ebp - 4], 0x12
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xae4]
mov byte [ebp - 4], 0x11
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xa58]
mov byte [ebp - 4], 0x10
call fcn.10001272
lea ecx, [esi + 0x9ac]
mov byte [ebp - 4], 0xf
call fcn.100019be
lea ecx, [esi + 0x8f0]
mov byte [ebp - 4], 0xe
call fcn.100019be
lea ecx, [esi + 0x844]
mov byte [ebp - 4], 0xd
call fcn.100019be
lea ecx, [esi + 0x798]
mov byte [ebp - 4], 0xc
call fcn.100019be
lea ecx, [esi + 0x6ec]
mov byte [ebp - 4], 0xb
call fcn.100019be
lea ecx, [esi + 0x640]
mov byte [ebp - 4], 0xa
call fcn.100019be
lea ecx, [esi + 0x594]
mov byte [ebp - 4], 9
call fcn.100019be
lea ecx, [esi + 0x4e8]
mov byte [ebp - 4], 8
call fcn.100019be
lea ecx, [esi + 0x43c]
mov byte [ebp - 4], 7
call fcn.100019be
lea ecx, [esi + 0x390]
mov byte [ebp - 4], 6
call fcn.100019be
lea ecx, [esi + 0x2e4]
mov byte [ebp - 4], 5
call fcn.100019be
lea ecx, [esi + 0x238]
mov byte [ebp - 4], 4
call fcn.100019be
lea ecx, [esi + 0x1ac]
mov byte [ebp - 4], 3
call fcn.10001272
lea ecx, [esi + 0x130]
mov byte [ebp - 4], 2
call sub.mfc100.dll_Ordinal_915
lea ecx, [esi + 0xa0]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [esi + 0x9c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call sub.mfc100.dll_Ordinal_946
call fcn.10083f0b
ret
Function at 0x10016248
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x103b26b8], 1
jne 0x1001626e
call fcn.100158f0
cmp eax, dword [0x103b26b4]
jle 0x10016293
cmp dword [0x103b26c0], 1
jne 0x100162c5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x103b26bc]
sub eax, dword [0x103bcb74]
imul ecx, ecx, 0xea60
cmp eax, ecx
jbe 0x100162c5
cmp dword [0xe7b5c0], 1
jne 0x100162a6
call fcn.10039c4c
jmp 0x100163b8
mov eax, dword [0x103be1c0]
add eax, 0x52
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.100141eb
jmp 0x100163b8
push ebx
push esi
mov esi, dword [0x2f98458]
push edi
xor ebx, ebx
xor edi, edi
call fcn.10005f8c
test eax, eax
je 0x100162fe
add esi, 0x53c
mov eax, dword [esi]
test eax, eax
je 0x100162f1
cmp dword [eax + 0x334], 1
jne 0x100162f1
inc ebx
inc edi
add esi, 4
call fcn.10005f8c
cmp edi, eax
jb 0x100162e1
cmp ebx, dword [0x103b2618]
pop edi
pop esi
pop ebx
jge 0x10016312
cmp dword [0x103b261c], 1
je 0x10016337
cmp dword [0x103b2620], 1
jne 0x10016360
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x103b2624]
sub eax, dword [0x103bcb6c]
imul ecx, ecx, 0xea60
cmp eax, ecx
jb 0x10016360
cmp dword [0xe7b5c0], 1
je 0x1001629c
mov eax, dword [0x103be1c0]
add eax, 0x52
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x1008f9e4
jmp 0x100163a6
push 0x32
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x103b2628
call sub.mfc100.dll_Ordinal_6969
lea eax, [ebp - 0x38]
push 0x1008f9dc
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x100163b8
cmp dword [0xe7b5c0], eax
jne 0x100163b8
mov eax, dword [0x103be1c0]
add eax, 0x52
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x1008f9d0
call fcn.10006e54
mov dword [esp], 0x1008f9c8
call fcn.1001619a
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10083e24
leave
ret 0x10
Function at 0x100163c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10342a50]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 1
je 0x10016577
cmp eax, 3
je 0x10016577
push 1
call sub.mfc100.dll_Ordinal_13219
push 0xa
lea eax, [ebp - 0x2c]
push eax
lea ecx, [edi + 0x300]
call sub.mfc100.dll_Ordinal_6969
mov esi, 0x1008fa3c
lea eax, [ebp - 0x2c]
push esi
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x10016521
mov ecx, 0x103a8160
mov dword [0x10342a50], 2
call fcn.10009f14
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 0x1008f9dc
lea ecx, [edi + 0x300]
mov dword [0x103bcb6c], eax
call sub.mfc100.dll_Ordinal_12868
xor ebx, ebx
push ebx
lea ecx, [edi + 0x264]
call sub.mfc100.dll_Ordinal_3970
call fcn.10039c4c
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [0x103bcb74], eax
call fcn.10016248
mov eax, dword [0x103be1c0]
push fcn.10016248
push 0x1388
add eax, 0x52
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x103ad870], 1
je 0x100164ac
cmp dword [0x103ad874], 1
jne 0x10016585
lea eax, [ebp - 0x2c]
push eax
movzx eax, byte [0x34ccfc6]
push eax
push 0x10342ad0
call fcn.1003b7c7
lea eax, [ebp - 0x2c]
push 0x2f98cb0
push eax
call sub.MSVCR100.dll_strcat
add esp, 0x14
lea eax, [ebp - 0x2c]
push eax
push dword [0x100e04bc]
push 0x292
push dword [0x1010eafc]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x10016509
push ebx
push ebx
mov esi, 0x1008fa1c
push esi
mov ecx, edi
call sub.mfc100.dll_Ordinal_7871
push esi
call fcn.10006e54
jmp 0x10016584
call esi
mov dword [0x10112864], eax
mov dword [0x101127cc], 0x2710
push 0x1008fa08
jmp 0x10016502
xor ebx, ebx
push esi
lea ecx, [edi + 0x300]
mov dword [0x10342a50], ebx
call sub.mfc100.dll_Ordinal_12868
mov eax, dword [0x103be1c0]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 0x52
push eax
push dword [0x100e04bc]
call esi
mov eax, dword [0x103be1c0]
add eax, 0x44
push eax
push dword [0x100e04bc]
call esi
push 1
lea ecx, [edi + 0x264]
call sub.mfc100.dll_Ordinal_3970
call fcn.10039c4c
mov dword [0x101127cc], ebx
jmp 0x10016585
push 8
push 0x1008f9f0
call fcn.1003a41e
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083e24
leave
ret
Function at 0x10017f06
Capabilities:
Enumerate files on windows

Disassembly:
push 0x154
mov eax, 0x10086f7c
call fcn.10083e9c
push 0x1f4
mov edi, ecx
call sub.mfc100.dll_Ordinal_265
mov dword [esp], 0x10111b20
push str._sCollect__
push eax
mov dword [ebp - 0x15c], eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push 0x14b
push dword [edi + 0x3e8]
call esi
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x158]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x1008ff9c
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x160]
push eax
mov dword [ebp - 4], ebx
call fcn.10016e71
add esp, 0xc
lea ecx, [ebp - 0x150]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x154], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea eax, [ebp - 0x124]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x128], bl
lea eax, [ebp - 0x124]
push eax
push ebx
push 0x143
push dword [edi + 0x3e8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x10018008
lea eax, [ebp - 0x124]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x128], 0
lea eax, [ebp - 0x124]
push eax
push 0
push 0x143
push dword [edi + 0x3e8]
call esi
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x154]
call ebx
test eax, eax
jne 0x10017fdd
push dword [ebp - 0x154]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x15c]
call sub.mfc100.dll_Ordinal_1296
pop ecx
lea ecx, [ebp - 0x158]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.10083f1f
ret
Function at 0x10018732
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10342a50]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x74], edi
cmp eax, 1
je 0x100188f4
cmp eax, 2
je 0x100188f4
push 1
call sub.mfc100.dll_Ordinal_13219
add edi, 0x268
push 0x32
lea eax, [ebp - 0x6c]
push eax
mov ecx, edi
mov dword [ebp - 0x70], edi
call sub.mfc100.dll_Ordinal_6969
mov ebx, 0x10090080
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x1001889b
mov ecx, 0x103bcb88
mov dword [0x10342a50], 3
mov dword [0x103bcb7c], 0xff922300
call section..text
mov ecx, 0x103bcb94
call section..text
xor esi, esi
push esi
call fcn.1003af2e
pop ecx
mov ecx, 0x103a8160
call fcn.10009f14
push 0x1008f9dc
mov ecx, edi
call sub.mfc100.dll_Ordinal_12868
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [0x103428c0], eax
mov eax, dword [0x103be1c0]
push 0x100182ee
push 0x3e8
add eax, 0x53
push eax
push dword [0x100e04bc]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x103ad870], 1
mov dword [0x101123b0], esi
je 0x10018825
cmp dword [0x103ad874], esi
je 0x10018902
lea eax, [ebp - 0x38]
push eax
movzx eax, byte [0x34ccfc6]
push eax
push 0x10342ad0
call fcn.1003b7c7
lea eax, [ebp - 0x38]
push 0x2f98cb0
push eax
call sub.MSVCR100.dll_strcat
add esp, 0x14
lea eax, [ebp - 0x38]
push eax
push dword [0x100e04bc]
push 0x292
push dword [0x1010eafc]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x10018883
mov ecx, dword [ebp - 0x74]
push esi
push esi
mov esi, 0x1008fa1c
push esi
call sub.mfc100.dll_Ordinal_7871
push esi
call fcn.10006e54
jmp 0x10018901
call ebx
mov dword [0x10112864], eax
mov dword [0x101127cc], 0x2710
push 0x1009006c
jmp 0x1001887c
xor esi, esi
push esi
push esi
push esi
push 0x100180c9
push esi
push esi
mov dword [0x10342a50], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x103be1c0]
lea eax, [eax + esi + 0x44]
push eax
push dword [0x100e04bc]
call edi
inc esi
cmp esi, 0xa
jl 0x100188c0
mov eax, dword [0x103be1c0]
add eax, 0x53
push eax
push dword [0x100e04bc]
call edi
mov ecx, dword [ebp - 0x70]
push ebx
call sub.mfc100.dll_Ordinal_12868
jmp 0x10018902
push 8
push 0x10090054
call fcn.1003a41e
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10083e24
leave
ret
Function at 0x1001fc58
Capabilities:
Enumerate files on windows

Disassembly:
push 0x344
mov eax, 0x10086852
call fcn.10083e9c
push 0x34d18e8
push 0x10111b20
lea eax, [ebp - 0x204]
push str._s_s_
push eax
mov edi, ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x10
xor ebx, ebx
push ebx
push ebx
push 0x14b
push dword [edi + 0x410]
call esi
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x34c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x100903e4
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x350]
push eax
mov dword [ebp - 4], ebx
call fcn.10016e71
add esp, 0xc
lea ecx, [ebp - 0x344]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x348], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [ebp - 0x348], 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
je 0x1001fd51
lea eax, [ebp - 0x318]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x31c], 0
lea eax, [ebp - 0x318]
push eax
push 0
push 0x143
push dword [edi + 0x410]
call esi
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x348]
call ebx
test eax, eax
jne 0x1001fd07
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10111b20
lea eax, [ebp - 0x204]
push str._sScript_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x34c]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
push 0x100903e4
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10016e71
add esp, 0xc
lea ecx, [ebp - 0x344]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x348], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [ebp - 0x348], 0xffffffff
je 0x1001fe14
lea eax, [ebp - 0x318]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x31c], 0
lea eax, [ebp - 0x318]
push eax
push 0
push 0x143
push dword [edi + 0x410]
call esi
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x348]
call ebx
test eax, eax
jne 0x1001fdca
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x34c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.10083f1f
ret
Function at 0x100202ef
Capabilities:
Enumerate files on windows

Disassembly:
push 0x344
mov eax, 0x10086852
call fcn.10083e9c
push 0x10111b20
lea eax, [ebp - 0x204]
push str._sPK_config_
push eax
mov edi, ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
xor ebx, ebx
push ebx
push ebx
push 0x14b
push dword [edi + 0xaac]
call esi
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x34c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push 0x100903e4
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x350]
push eax
mov dword [ebp - 4], ebx
call fcn.10016e71
add esp, 0xc
lea ecx, [ebp - 0x344]
push ecx
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x348], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [ebp - 0x348], 0xffffffff
je 0x1002040e
lea eax, [ebp - 0x318]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x31c], bl
lea eax, [ebp - 0x318]
push eax
push ebx
push 0x143
push dword [edi + 0xaac]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x100203ef
lea eax, [ebp - 0x318]
push eax
call sub.MSVCR100.dll_strlen
pop ecx
mov byte [ebp + eax - 0x31c], 0
lea eax, [ebp - 0x318]
push eax
push 0
push 0x143
push dword [edi + 0xaac]
call esi
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x348]
call ebx
test eax, eax
jne 0x100203c4
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x34c]
call dword [sym.imp.mfc100.dll_Ordinal_901]
call fcn.10083f1f
ret
Function at 0x10027ab6
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x100a69a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [0x103b5c88]
mov dword [ebp - 0xa4], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10027bd7
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
xor edi, edi
push edi
push edi
mov ebx, 0x1042
push ebx
push dword [0x103b5d1c]
call esi
cmp eax, 6
jle 0x10027b1a
push edi
push edi
push ebx
push dword [0x103b5d1c]
call esi
cmp eax, 0x16
jl 0x10027bd4
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0x32
lea ecx, [ebp - 0x6c]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0x38]
push 0x10094674
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
push edi
push edi
mov ebx, 0x1004
push ebx
push dword [0x103b5d1c]
mov dword [ebp - 0xa4], edi
call esi
test eax, eax
jle 0x10027bb4
push 0x32
lea eax, [ebp - 0xa0]
push eax
push 1
push dword [ebp - 0xa4]
mov ecx, 0x103b5cfc
call sub.mfc100.dll_Ordinal_5176
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa0]
push eax
call sub.MSVCR100.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x10027be3
inc dword [ebp - 0xa4]
push edi
push edi
push ebx
push dword [0x103b5d1c]
call esi
cmp dword [ebp - 0xa4], eax
jl 0x10027b6a
lea eax, [ebp - 0x38]
push eax
push 1
push edi
push edi
push 0x1042
push dword [0x103b5d1c]
call esi
push eax
mov ecx, 0x103b5cfc
call sub.mfc100.dll_Ordinal_12440
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10083e24
leave
ret
push 8
push 0x10094668
call fcn.1003a41e
pop ecx
pop ecx
jmp 0x10027bd4