joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e8c3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x44e960
push ebx
push esi
call fcn.0044e88c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0044e820
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x44e90d
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44e95f
push edi
push eax
call fcn.0044f4e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x44e92d
call fcn.0044d381
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x44e95e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0044e820
add esp, 0x20
test eax, eax
jne 0x44e94c
push edi
call fcn.0044d381
jmp 0x44e954
push ebx
call fcn.0044d381
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x44fc5d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xdca1d0
push 0xdca1c8
push str.FlsAlloc
push 0x1f
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fc91
push dword [ebp + 8]
mov ecx, esi
call dword [0x4572ec]
call esi
jmp 0x44fc97
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44fcdb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xdca1e0
push 0xdca1d8
push str.FlsGetValue
push 0x21
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd12
push dword [ebp + 8]
mov ecx, esi
call dword [0x4572ec]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x44fd1a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0xdca1e8
push 0xdca1e0
push str.FlsSetValue
push 0x22
call fcn.0044fb1c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x44fd54
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4572ec]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x456600
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x456671
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4566ac
cmp dword [esp + 4], 0
je 0x456693
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4566c1
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0xdd1a54]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0xdd1a54], esi
jne 0x456650
mov byte [0xdd1a50], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x4566a3
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x456704
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x456697
mov edi, dword [esp]
jmp 0x4566a3
mov edi, dword [esi]
jmp 0x4566a2
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00456740
ud2
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0xdc7b5c
mov dword [esp + 8], 0xdc7b24
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], str._rustc_e20cb7702117f1ad8127a16406ba9edd230c4f65librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
call fcn.00455610
ud2
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0xdc7b24
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], str._rustc_e20cb7702117f1ad8127a16406ba9edd230c4f65librarycore_src_sliceiter.rs
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00456780
ud2
Function at 0x8222e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.DATA
lea edi, [esi - 0x2b0000]
push edi
jmp 0x8222fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x822301
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8222f0
mov eax, 1
add ebx, ebx
jne 0x822313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x822324
jne 0x822343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x822343
dec eax
add ebx, ebx
jne 0x822330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x822308
add ebx, ebx
jne 0x82233f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x822395
xor ecx, ecx
sub eax, 3
jb 0x82235b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x8223ca
sar eax, 1
mov ebp, eax
jmp 0x822366
add ebx, ebx
jne 0x822366
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x822334
inc ecx
add ebx, ebx
jne 0x822374
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x822334
add ebx, ebx
jne 0x822381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x822376
jne 0x822392
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x822376
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x8223b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x8223a6
jmp 0x8222f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x8223b4
add edi, ecx
jmp 0x8222f6
pop esi
mov edi, esi
mov ecx, 0x127ad
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x8223d2
cmp byte [edi], 0x67
jne 0x8223d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x8223d7
lea edi, [esi + 0x411000]
mov eax, dword [edi]
or eax, eax
je 0x82244f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x422f70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x423078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x822404
mov ecx, edi
jns 0x822433
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x423080]
or eax, eax
je 0x822449
mov dword [ebx], eax
add ebx, 4
jmp 0x822421
call dword [esi + 0x42307c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x822480
cmp al, 0xef
ja 0x822473
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x822455
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x822462
mov ebp, dword [esi + 0x423084]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x8224b4
sub esp, 0xffffff80
jmp 0x662ca9
Function at 0x40e820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x43e080]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0x7c299702
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
sub eax, 0x81f2377a
je 0x40e9a6
jmp 0x40e85c
mov eax, dword [ebp - 0x28]
sub eax, 0xc4ebbeb1
je 0x40e920
jmp 0x40e86f
mov eax, dword [ebp - 0x28]
sub eax, 0x15478a41
je 0x40e9c4
jmp 0x40e882
mov eax, dword [ebp - 0x28]
sub eax, 0x40c3b90f
je 0x40e9b2
jmp 0x40e895
mov eax, dword [ebp - 0x28]
sub eax, 0x7c299702
je 0x40e8ad
jmp 0x40e8a8
jmp 0x40ea0b
mov ecx, dword [0x43f574]
mov eax, dword [0x43f570]
mov edx, ecx
add edx, 0xb60bddf3
sub edx, 1
sub edx, 0xb60bddf3
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x15478a41
mov ecx, 0xc4ebbeb1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40ea0b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40e93d
mov eax, dword [0x43f574]
mov ecx, dword [0x43f570]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x15478a41
mov ecx, 0x81f2377a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x1c], eax
jmp 0x40ea0b
mov dword [ebp - 0x1c], 0x40c3b90f
jmp 0x40ea0b
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004277e0
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
not byte [edi]
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
add byte [edi], 0x79
sub byte [edi], 0x35
nop
mov eax, ebx
mov ebx, 0x99
nop
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40e9e1
mov dword [ebp - 0x1c], 0xc4ebbeb1
jmp 0x40e846
Function at 0x40ee30
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xb913df86
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
sub eax, 0x839281a6
je 0x40efaf
jmp 0x40ee5a
mov eax, dword [ebp - 0x20]
sub eax, 0x90cfed49
je 0x40f0a1
jmp 0x40ee6d
mov eax, dword [ebp - 0x20]
sub eax, 0x92f2c89b
je 0x40f095
jmp 0x40ee80
mov eax, dword [ebp - 0x20]
sub eax, 0xb130c64d
je 0x40ef94
jmp 0x40ee93
mov eax, dword [ebp - 0x20]
sub eax, 0xb913df86
je 0x40ef1d
jmp 0x40eea6
mov eax, dword [ebp - 0x20]
sub eax, 0x1d1ba9a8
je 0x40f022
jmp 0x40eeb9
mov eax, dword [ebp - 0x20]
sub eax, 0x26586f95
je 0x40f0b3
jmp 0x40eecc
mov eax, dword [ebp - 0x20]
sub eax, 0x483f7739
je 0x40ef76
jmp 0x40eedf
mov eax, dword [ebp - 0x20]
sub eax, 0x624b2bcd
je 0x40ef49
jmp 0x40eef2
mov eax, dword [ebp - 0x20]
sub eax, 0x67190540
je 0x40f0ad
jmp 0x40ef05
mov eax, dword [ebp - 0x20]
sub eax, 0x77c161ac
je 0x40ef64
jmp 0x40ef18
jmp 0x40f0ba
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
setne al
and al, 1
mov byte [ebp - 0xd], al
mov dword [ebp - 0x18], 0x624b2bcd
jmp 0x40f0ba
mov dl, byte [ebp - 0xd]
mov eax, 0x67190540
mov ecx, 0x77c161ac
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40f0ba
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0x483f7739
jmp 0x40f0ba
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xb130c64d
jmp 0x40f0ba
mov edx, dword [ebp - 8]
mov eax, 0x839281a6
mov ecx, 0x90cfed49
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40f0ba
mov ecx, dword [0x43f564]
mov eax, dword [0x43f560]
mov edx, ecx
add edx, 0xb3a0c668
sub edx, 1
sub edx, 0xb3a0c668
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x26586f95
mov ecx, 0x1d1ba9a8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40f0ba
mov ecx, dword [0x43f564]
mov eax, dword [0x43f560]
mov edx, ecx
sub edx, 0x49accc56
sub edx, 1
add edx, 0x49accc56
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x26586f95
mov ecx, 0x92f2c89b
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x18], eax
jmp 0x40f0ba
mov dword [ebp - 0x18], 0x67190540
jmp 0x40f0ba
mov dword [ebp - 0x18], 0x67190540
jmp 0x40f0ba
add esp, 0x20
pop ebx
pop ebp
ret
mov dword [ebp - 0x18], 0x1d1ba9a8
jmp 0x40ee44
Function at 0x4280ab
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4280ea
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4280ea
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4280ea
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4280ea
cmp dword [ecx + 0x74], 0xe
jbe 0x4280ea
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42f84b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42f8e8
push ebx
push esi
call fcn.0042f814
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042f7a8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42f895
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42f8e7
push edi
push eax
call fcn.0042e2e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42f8b5
call fcn.0042e32e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42f8e6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042f7a8
add esp, 0x20
test eax, eax
jne 0x42f8d4
push edi
call fcn.0042e32e
jmp 0x42f8dc
push ebx
call fcn.0042e32e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x430af7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x439c20
push 0x439c18
push str.FlsAlloc
push 0x1f
call fcn.004309b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430b2b
push dword [ebp + 8]
mov ecx, esi
call dword [0x437144]
call esi
jmp 0x430b31
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x430b75
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x439c30
push 0x439c28
push str.FlsGetValue
push 0x21
call fcn.004309b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430bac
push dword [ebp + 8]
mov ecx, esi
call dword [0x437144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x430bb4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x439c38
push 0x439c30
push str.FlsSetValue
push 0x22
call fcn.004309b6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x430bee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x437144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x435ec0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x435eed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x435eed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1003141
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push esi
mov esi, ecx
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push dword [esi + 0x34]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x105020e
lea eax, [ebp - 0xc]
push eax
push fcn.01003190
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
pop esi
leave
ret
lea eax, [ebp - 0xc]
push eax
push dword [esi + 0x34]
call fcn.01003190
test eax, eax
jne 0x1003173
mov eax, dword [ebp - 8]
jmp 0x1003188
Function at 0x10039b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0x8004
cmp edi, eax
mov esi, ecx
jg 0x103dafd
je 0x1003bf6
cmp edi, 6
jg 0x104f216
je 0x100b286
dec edi
je 0x100a684
dec edi
jne 0x1003bee
push dword [ebp + 0xc]
call fcn.01008206
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8
dec edi
dec edi
jne 0x100e1a6
push 1
push dword [ebp + 0xc]
call fcn.010074ec
jmp 0x10039f5
push dword [ebp + 0xc]
call fcn.01003957
test eax, eax
jne 0x10039f5
push dword [ebp + 0xc]
mov ecx, esi
call fcn.0100a727
jmp 0x10039f5
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push eax
push 4
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 0xc]
call fcn.01003871
test eax, eax
jl 0x10039f5
cmp edi, 0x8006
je 0x103db0e
mov esi, dword [esi + 0x94]
mov eax, dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [eax + 0x18]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10039f5
dec edi
jne 0x10039f5
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 4]
push ecx
push dword [eax]
mov ecx, esi
call fcn.0100e1ca
xor eax, eax
inc eax
jmp 0x10039f7
cmp edi, 0x8006
jne 0x10039f5
jmp 0x100b286
push 3
pop ebx
jmp 0x100b2b0
sub edi, 7
je 0x1060cea
sub edi, 3
je 0x1060cdb
dec edi
dec edi
je 0x1060cc2
sub edi, 3
jne 0x10039f5
jmp 0x1060ca4
push 0x502
push 0x1060d78
call fcn.01012644
push dword [ebp + 0xc]
mov ecx, esi
call fcn.01097b47
jmp 0x10039f5
mov eax, dword [ebp + 0xc]
mov ecx, dword [esi + 0x48]
shr eax, 0x10
and eax, 0xfff
push eax
call fcn.0106e683
jmp 0x10039f7
push 0
push dword [ebp + 0xc]
call fcn.01095cf6
jmp 0x10039f5
mov eax, dword [esi + 0x48]
xor ebx, ebx
cmp dword [eax + 0x1c], ebx
jne 0x1060d31
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x1060d31
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x10b10f0]
xor edx, edx
cmp eax, dword [0x10b10ec]
sete dl
cmp ecx, ebx
je 0x1060d23
cmp eax, ecx
jne 0x1060d23
xor edx, edx
inc edx
mov edi, dword [esi + 0x38]
cmp edi, ebx
jne 0x1060d54
cmp edx, ebx
jne 0x1060d31
mov dword [esi + 0x38], eax
push ebx
push ebx
push 0x504
push dword [0x10b10ec]
call dword [sym.imp.USER32.dll_PostMessageW]
push 2
push ebx
push ebx
push ebx
call dword [sym.imp.dwmapi.dll_Ordinal_113]
jmp 0x100e1bd
cmp edx, ebx
je 0x1060d31
mov ecx, esi
call fcn.01095b71
push edi
call fcn.01079389
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [esi + 0x38], ebx
jmp 0x100e1bd
Function at 0x1007fa4
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
and dword [esi + 0x14], 0
push 0
mov dword [esi], 0x100359c
mov dword [esi + 4], 0x1007f64
mov dword [esi + 8], 0x1007f44
mov dword [esi + 0xc], 0x1007f54
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [esi + 0x20], 0
and dword [esi + 0x24], 0
mov dword [esi + 0x1c], eax
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100ab87
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
push dword [esi + 0xc]
xor edi, edi
mov dword [esi + 0x3c], edi
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x100abdc
lea eax, [ebp - 4]
push eax
push edi
push dword [esi + 0xc]
push 2
push 0x42
call dword [sym.imp.SHLWAPI.dll_AssocQueryKeyW]
test eax, eax
jl 0x100abdc
push edi
push edi
push edi
push 0x100abe0
push edi
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1050e7a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
mov dword [esi + 0x3c], 1
jmp 0x100abd3
Function at 0x101043d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0x40000069
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x105d9b8
lea eax, [ebp - 4]
push eax
add esi, 0x24
push esi
push 0
push 0x100f960
push 0x100f870
push 0x80000001
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1010489
mov dword [esi], 0xa
pop esi
leave
ret
and dword [esi + 0x24], 0
jmp 0x1010489

Function at 0x101080b
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
mov eax, dword [edi]
mov dword [ebp + 8], ebx
test eax, eax
jne 0x105dac1
xor eax, eax
test eax, eax
jne 0x105dac8
test ebx, ebx
je 0x1010863
mov eax, dword [ebx]
test eax, eax
jne 0x105dac8
push eax
push 0x109069d
lea ecx, [ebp + 8]
call fcn.01009838
lea ecx, [ebp + 8]
call fcn.010097f6
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x101083b
mov eax, dword [eax]
jmp 0x101082d
push 0
push 0x109069d
mov ecx, edi
call fcn.01009838
mov eax, dword [esi + 0xc]
and dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi + 0x18]
push 0xca
mov dword [edi], ebx
push dword [eax + 0x44]
call fcn.01037520
mov ebx, 0x105db80
push ebx
mov esi, 0x80000001
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor eax, eax
push eax
lea ecx, [ebp - 4]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor esi, esi
inc esi
test eax, eax
jne 0x105db6d
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x105db39
mov eax, dword [eax]
jmp 0x105db3b
xor eax, eax
cmp ebx, eax
jge 0x105db64
push ebx
push dword [edi]
mov dword [ebp - 8], esi
call dword [fcn.01002b70]
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0x18
push eax
push 0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_Ordinal_631]
inc ebx
jmp 0x105db2f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.010097f6
mov eax, esi
jmp 0x101085c