joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2000e6f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x20022528]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
lea edx, [esp + 0x10]
push 0x200217fc
push edx
call fcn.20007050
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x2001a200]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x2000e7ad
push edi
push esi
push ebx
call dword [0x2001a210]
mov edi, eax
push edi
call dword [0x2001a338]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x2001a20c]
xor eax, eax
test edi, edi
jbe 0x2000e784
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x2000e776
push edi
push esi
mov ecx, ebp
call fcn.2000bb20
push esi
mov edi, eax
call dword [0x2001a33c]
add esp, 4
push ebx
call dword [0x2001a30c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x2000ed00
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x11c]
push 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push ecx
call dword [0x2001a258]
lea edx, [esp + 0x14]
push 0x200215cc
push edx
call dword [0x2001a320]
mov ebx, dword [esp + 0x128]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x2000ed9e
lea ecx, [esp + 0x14]
sub eax, ecx
test eax, eax
jle 0x2000ed77
mov ecx, eax
lea esi, [esp + 0x14]
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, ebx
push eax
push 0x104
call fcn.20011220
add esp, 8
lea eax, [ebp + 6]
push eax
push ebx
call dword [0x2001a138]
lea ecx, [esp + 0x14]
push ebx
push ecx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
lea edx, [esp + 0x14]
push 0x200215bc
push edx
call dword [0x2001a320]
add esp, 8
mov dword [esp + 0x10], eax
test eax, eax
je 0x2000ee08
lea ecx, [esp + 0x14]
sub eax, ecx
test eax, eax
jle 0x2000edd9
mov ecx, eax
lea esi, [esp + 0x14]
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, ebx
push 0x104
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov eax, dword [esp + 0x10]
add eax, 0xd
push eax
push ebx
call dword [0x2001a138]
push ebx
call dword [sym.imp.IMM32.dll_ImmGetContext]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
test ebp, ebp
jne 0x2000ee18
lea ecx, [esp + 0x14]
push ecx
push ebx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
push ebx
call dword [sym.imp.IMM32.dll_ImmGetContext]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x2000fb60
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0x34c
push ebp
push esi
mov esi, ecx
push 0x401
mov dword [esp + 0x18], esi
call fcn.200196d0
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x2000fd4d
push ebx
push edi
mov ecx, 0x100
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp], 0x77
mov eax, dword [esi + 0x18]
lea edi, [ebp + 1]
mov ecx, 0xb
mov esi, dword [eax + 8]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x2d]
lea ecx, [esp + 0x18]
push ecx
mov dword [esi], 0x1a21
add esi, 4
mov edi, esi
add esi, 2
push esi
mov byte [edi], 0
call fcn.20009e70
mov byte [edi], al
mov ebx, dword [esp + 0x20]
mov dl, byte [0x20024164]
add esp, 8
add esi, ebx
mov byte [edi + 1], dl
push 4
push 0x78766964
lea eax, [esi + 1]
push 0x63646976
mov byte [esi], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
call fcn.20019890
mov ebx, eax
test ebx, ebx
je 0x2000fc5f
lea ecx, [esp + 0x124]
push 0x238
push ecx
push ebx
mov dword [esp + 0x130], 0x238
call fcn.2001988a
lea edx, [esp + 0x25c]
push 0x5c
push edx
call dword [0x2001a368]
add esp, 8
test eax, eax
jne 0x2000fc41
lea eax, [esp + 0x25c]
jmp 0x2000fc44
add eax, 2
push 0x2002361c
push eax
call dword [0x2001a38c]
add esp, 8
test eax, eax
je 0x2000fc5f
push ebx
call fcn.20019884
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x104
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
lea ecx, [esp + 0x20]
push 0x20023610
push ecx
call dword [0x2001a138]
test ebx, ebx
jne 0x2000fce7
lea edx, [esp + 0x20]
push edx
call fcn.2000d940
add esp, 4
test al, al
je 0x2000fd05
push ebx
push 0x78766964
push 0x63646976
call fcn.2001987e
push 2
lea eax, [esp + 0x24]
push ebx
push eax
push 0x78766964
push 0x63646976
call fcn.20019878
push 4
push 0x78766964
push 0x63646976
call fcn.20019890
mov ebx, eax
test ebx, ebx
je 0x2000fd05
push ebx
call fcn.20019884
mov eax, dword [esp + 0x10]
mov ebx, 1
mov dword [eax], 0x78766964
add eax, 4
mov dword [esp + 0x10], eax
jmp 0x2000fd09
mov ebx, dword [esp + 0x14]
push 4
push 0x64697678
push 0x63646976
call fcn.20019890
test eax, eax
je 0x2000fd2f
push eax
call fcn.20019884
mov ecx, dword [esp + 0x10]
inc ebx
mov dword [ecx], 0x64697678
mov ecx, dword [esp + 0x1c]
dec bl
push 0x401
push ebp
mov byte [esi], bl
call fcn.200101c0
push ebp
call fcn.20019690
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x34c
ret
Function at 0x2000ff50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.20001df0
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x2000ffa4
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x2000ff73
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x200104e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push eax
push 0x28
xor esi, esi
call dword [0x2001a24c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
jne 0x20010505
pop esi
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg ecx
lea edx, [esp + 0xc]
mov dword [esp + 8], 1
sbb ecx, ecx
push edx
and ecx, 2
push eax
push 0
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x2001054c
mov edx, dword [esp + 4]
push 0
push 0
lea ecx, [esp + 0x10]
push 0
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [0x2001a30c]
mov eax, esi
pop esi
add esp, 0x14
ret 8
Function at 0x20010780
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x20]
push esi
xor esi, esi
push esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
test eax, eax
je 0x200107b0
xor eax, eax
pop esi
add esp, 0x14
ret
push ebp
mov ebp, dword [esp + 0x30]
cmp ebp, esi
push edi
jne 0x20010872
xor eax, eax
lea ecx, [esp + 0xc]
mov dword [esp + 0xd], eax
push 0xa
mov dword [esp + 0x15], eax
push ecx
mov dword [esp + 0x1d], eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
call fcn.20003070
add esp, 8
push 1
push 0x20021194
call fcn.200104e0
push 1
push 0x20021180
call fcn.200104e0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push edx
push 0xf003f
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
mov eax, dword [esp + 0x30]
lea edx, [esp + 0xc]
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push ecx
call edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xc]
push 8
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
lea ecx, [esp + 0xc]
neg esi
sbb esi, esi
push ecx
inc esi
call dword [0x2001a1d0]
mov eax, dword [esp + 0x2c]
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x24]
push ebx
push edx
push 0x20019
push esi
push eax
push ecx
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
mov eax, dword [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea edx, [esp + 0x34]
push edx
push esi
push esi
push esi
push ebp
push eax
call ebx
test eax, eax
jne 0x20010900
mov ecx, dword [esp + 0x34]
add ecx, 2
push ecx
call fcn.200196d0
mov ecx, dword [esp + 0x2c]
add esp, 4
lea edx, [esp + 0x34]
mov edi, eax
push edx
lea eax, [esp + 0x30]
push edi
push eax
push 0
push ebp
push ecx
call ebx
test eax, eax
jne 0x200108f7
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push edx
push edi
push eax
push 0
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push edi
call fcn.20019690
add esp, 4
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push edx
call edi
mov eax, dword [esp + 0x30]
pop ebx
push eax
call edi
pop edi
mov eax, esi
pop ebp
pop esi
add esp, 0x14
ret
Function at 0x20010b30
Capabilities:
Move file

Disassembly:
sub esp, 0x490
or ecx, 0xffffffff
xor eax, eax
push esi
mov esi, dword [esp + 0x498]
push edi
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x20010cae
mov ecx, 0xff
lea edi, [esp + 0x99]
mov byte [esp + 0x98], al
mov dword [esp + 0xc], 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push 0x20021824
push 0x80000000
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x20010cae
lea ecx, [esp + 0xc]
lea edx, [esp + 0x98]
push ecx
push edx
push eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_BlockInput]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea edx, [esp + 0x98]
push edx
call dword [sym.imp.IMM32.dll_ImmGetContext]
test eax, eax
je 0x20010cae
lea eax, [esp + 0x98]
push 0x200215fc
push eax
call dword [0x2001a320]
add esp, 8
test eax, eax
je 0x20010cae
push esi
push eax
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x4a0]
mov dword [esp + 0x54], 0x44
test eax, eax
mov dword [esp + 0x80], 1
mov word [esp + 0x84], ax
je 0x20010c70
mov ecx, dword [0x2002181c]
mov dl, byte [0x20021820]
mov dword [esp + 0x20], ecx
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x25]
mov byte [esp + 0x24], dl
mov esi, dword [0x2001a138]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x20]
push 0x20021814
push eax
call esi
lea ecx, [esp + 0x20]
push 0x2002180c
push ecx
call esi
lea edx, [esp + 0x20]
mov dword [esp + 0x5c], edx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x54]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0xb4]
push 0
push edx
push 0
call dword [sym.imp.WINMM.dll_mixerOpen]
test eax, eax
je 0x20010cae
mov eax, dword [esp + 0x14]
mov esi, dword [0x2001a30c]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
xor al, al
pop esi
add esp, 0x490
ret

Function at 0x20010d60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
pushal
mov eax, dword fs:[0x30]
mov edx, dword [eax + 0xc]
add edx, 0x14
mov edx, dword [edx]
mov eax, dword [edx + 0x10]
test eax, eax
je 0x20010da1
mov esi, dword [edx + 0x28]
mov edi, dword [ebp + 8]
mov bx, word [esi]
mov bh, byte [edi]
cmp bl, 0x5a
jg 0x20010d95
cmp bl, 0x41
jl 0x20010d95
add bl, 0x20
cmp bl, bh
jne 0x20010d74
inc esi
inc esi
inc edi
test bx, bx
jne 0x20010d83
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x200112d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [0x2001a1dc]
test eax, eax
je 0x20011346
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [0x2001a254]
test eax, eax
je 0x20011346
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x20011346
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x20011334
mov edx, esi
cmp edi, ebx
jb 0x2001133e
add edx, ebx
cmp edi, edx
jbe 0x20011350
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x20011326
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
Function at 0x200119f0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov dword [esp + 0x18], 0
push 0
mov ebx, dword [edi + 8]
mov edx, dword [edi]
mov eax, dword [esi + 0x11c]
mov ebp, dword [edi + 0xc]
mov ecx, dword [edi + 4]
sub ebx, edx
sub ebp, ecx
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0x11c]
push 0
mov dword [ecx + 8], ebp
mov edx, dword [esi + 0x120]
imul edx, ebx
add edx, 0x1f
mov eax, dword [esi + 0x11c]
sar edx, 3
and edx, 0xfffffffc
lea ecx, [esp + 0x20]
imul edx, ebp
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x11c]
mov eax, dword [esi + 0xf4]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esi + 0x100]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [0x2001a0f4]
mov edx, dword [esi + 0xc0]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [esi + 0xf4]
push eax
push ecx
push edx
push ebp
push ebx
push eax
mov eax, dword [esi + 0xfc]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov eax, dword [esi + 0xfc]
push 0xcc0020
push ecx
mov ecx, dword [esi + 0x100]
push edx
push eax
push ebp
push ebx
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidA]
push 0x10
push edi
mov ecx, esi
call fcn.2000a6a0
mov edx, dword [esi + 0x11c]
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.2000a6a0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x20012c70
Capabilities:
Set registry value

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], ecx
cmp edi, 8
jg 0x20012c8f
mov ebp, 1
mov ecx, edi
shl ebp, cl
xor ebx, ebx
jmp 0x20012c93
xor ebx, ebx
xor ebp, ebp
lea eax, [ebp*4 + 0x28]
push eax
call fcn.200196d0
mov edx, edi
mov esi, eax
mov eax, dword [esp + 0x20]
and edx, 0xffff
imul edx, eax
mov ecx, dword [esp + 0x24]
add edx, 0x1f
sar edx, 3
and edx, 0xfffffffc
add esp, 4
imul edx, ecx
cmp edi, 0x10
mov dword [esi], 0x28
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov word [esi + 0xc], 1
mov word [esi + 0xe], di
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x14], edx
jge 0x20012d87
push ebx
call dword [0x2001a4d4]
mov edi, eax
push 1
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0
push esi
push 0
mov ebx, eax
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push edi
push 0
call dword [0x2001a4fc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
mov cl, byte [eax + 0xbc]
test cl, cl
je 0x20012d87
test ebp, ebp
jle 0x20012d87
lea eax, [esi + 0x29]
mov edi, ebp
xor ecx, ecx
mov cl, byte [eax]
add eax, 4
lea edx, [ecx + ecx*2]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea ebx, [ecx + edx*8]
xor edx, edx
mov dl, byte [eax - 3]
mov ecx, edx
shl ecx, 4
add ecx, edx
xor edx, edx
mov dl, byte [eax - 5]
lea ecx, [ecx + ecx*8]
lea ecx, [ebx + ecx*2]
lea ebx, [edx + edx*2]
lea edx, [edx + ebx*4]
lea edx, [edx + edx*8]
add ecx, edx
sar ecx, 0xa
mov byte [eax - 5], cl
mov byte [eax - 4], cl
mov byte [eax - 3], cl
dec edi
jne 0x20012d43
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x20012da0
Capabilities:
Get file size
Query or enumerate registry key

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, esi
je 0x20012f06
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x2001a338]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.200196d0
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x20012ed6
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x20012ec2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x2001a348]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.200024c0
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x20012e76
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.200101c0
mov eax, dword [esp + 0x28]
push eax
call dword [0x2001a33c]
push ebp
call fcn.20019690
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4
Function at 0x20012f40
Capabilities:
Get file size
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001a7d8
push 0x200196dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x20012fc5
test esi, esi
je 0x20013030
lea eax, [ebp - 0x138]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x20013030
cmp dword [ebp - 0x134], 1
je 0x20012fff
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x20013030
push 0x320
call dword [0x2001a304]
push ebx
mov edx, dword [0x200210a0]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x2001a478]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OpenEventA]
lea ecx, [ebp - 0x53c]
push ecx
push 0x80000002
call dword [0x2001a408]
mov dword [ebp - 4], 0xffffffff
call fcn.20013059
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x20013700
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x20019c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push eax
mov dword [esp + 8], esi
call sym.drprov.dll_NPEnumResource
push 0xf003f
push 0
push 0
mov dword [esp + 0x1c], 0
mov dword [esi], 0x2001a7f8
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x30
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.20012da0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x20013d10
Capabilities:
Log keystrokes via input method manager

Disassembly:
sub esp, 0xcf8
mov eax, dword [0x20022528]
push ebx
push ebp
push esi
push edi
push eax
mov dword [esp + 0x14], 0
call fcn.2000c970
mov ebx, dword [0x2001a200]
mov ebp, dword [0x2001a20c]
add esp, 4
test al, al
jne 0x20013dca
mov esi, dword [0x20021a0c]
cmp esi, 0xffffffff
je 0x20013d53
test esi, esi
jne 0x20013d6b
push 0
push 0x80
push 3
push 0
push 1
push 1
push 0x20024210
call ebx
mov esi, eax
push 2
push 0
push 0xfffffa08
push esi
call dword [0x2001a218]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x718]
push 0x5f8
push edx
push esi
call ebp
cmp dword [0x20021a0c], 0xffffffff
jne 0x20013da2
push esi
call dword [0x2001a30c]
lea eax, [esp + 0x710]
push eax
call fcn.2000c970
add esp, 4
test al, al
je 0x20013dd9
mov edi, dword [0x20022528]
mov ecx, 0x17e
lea esi, [esp + 0x710]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x20022528]
cmp byte [ecx + 0x52e], 0x46
jae 0x20013de6
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xcf8
ret
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov edi, dword [0x2001a138]
lea eax, [esp + 0x14]
push 0x20021514
push eax
call edi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov edx, dword [0x20022528]
lea esi, [esp + eax + 0x14]
push edx
call fcn.2000d8c0
mov eax, dword [0x20022528]
add esp, 4
add eax, 0x10
push eax
push esi
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
push esi
push esi
call fcn.20010400
add esp, 8
push 0x20021ad8
push esi
call edi
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [esp + 0x28]
push 1
push ecx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x20013f4e
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x120]
push 0x5f8
push eax
push esi
call ebp
push esi
call dword [0x2001a30c]
lea ecx, [esp + 0x118]
push ecx
call fcn.2000c970
add esp, 4
test al, al
je 0x20013f4e
mov eax, dword [0x20021ac4]
mov cx, word [0x20021ac8]
mov edx, dword [0x20021ac0]
mov dword [esp + 0x410], eax
mov eax, dword [0x20022528]
mov word [esp + 0x414], cx
mov ecx, 0x19
lea edi, [esp + 0x4de]
lea esi, [eax + 0x3c6]
mov dword [esp + 0x40c], edx
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x42a]
mov ecx, 0x32
lea edi, [esp + 0x542]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 0x544]
mov ecx, 0x19
lea edi, [esp + 0x65c]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x1e0]
mov ecx, 5
lea edi, [esp + 0x2f8]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x128]
mov ecx, 0xc
lea edi, [esp + 0x240]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
movsw word es:[edi], word [esi]
mov edx, ecx
lea esi, [esp + 0x118]
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x20022528]
push eax
call fcn.2000d8c0
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcf8
ret