joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bb3d
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x100b97b5
call fcn.100a0664
sub esp, 0x470
push ebx
push esi
push edi
xor edi, edi
push 0x5c
pop eax
mov dword [ebp - 4], edi
mov word [ebp - 0x24], ax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
push str..
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1000b4b3
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.10028ff5
mov eax, dword [eax]
cmp eax, edi
je 0x1002bb91
mov eax, dword [eax]
jmp 0x1002bb93
xor eax, eax
push eax
lea ecx, [ebp - 0x47c]
call fcn.100283e4
mov ecx, dword [ebp - 0x10]
mov esi, eax
cmp ecx, edi
je 0x1002bbb0
call fcn.10003043
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x1002bbc0
call fcn.10003043
cmp esi, edi
je 0x1002bc66
lea ecx, [ebp - 0x47c]
call fcn.10027f8e
lea ecx, [ebp - 0x47c]
mov ebx, eax
call fcn.100283a7
test eax, eax
jne 0x1002bc5e
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x47c]
call fcn.1002adfb
push dword [eax]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.1000274d
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.10001ccd
push 0x10
lea ecx, [ebp - 0x47c]
call fcn.10027f72
mov esi, dword [ebp - 0x10]
test eax, eax
je 0x1002bc3b
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.1000b8a2
call fcn.1002bb3d
pop ecx
jmp 0x1002bc4c
cmp esi, edi
je 0x1002bc43
mov eax, dword [esi]
jmp 0x1002bc45
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 1
cmp esi, edi
je 0x1002bc5e
mov ecx, esi
call fcn.10003043
mov dword [ebp - 0x10], edi
cmp ebx, edi
jne 0x1002bbc8
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x1002bc71
mov eax, dword [eax]
jmp 0x1002bc73
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x47c]
call fcn.10027fb5
mov ecx, dword [ebp + 8]
cmp ecx, edi
je 0x1002bc91
call fcn.10003043
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x1002ccb9
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
mov edx, dword [eax - 0xc]
add edx, edx
push edx
push eax
push 1
push 0
push eax
push dword [ecx + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
ret 4
Function at 0x10034fff
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100ba017
call fcn.100a0664
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov esi, ecx
mov ecx, dword [esi + 0x78]
push ebx
push esi
mov dword [ebp - 4], ebx
call fcn.1006b272
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0xc]
push ebx
push eax
push 0x419
push dword [ebp - 0x14]
call edi
dec eax
js 0x10035087
lea ecx, [ebp - 0x24]
push ecx
push eax
push 0x41d
push dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call edi
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0xb0]
call edi
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 0xb0]
call edi
lea eax, [ebp - 0x24]
push eax
push dword [esi + 0xb0]
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10
Function at 0x100386f3
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x100ba56c
call fcn.100a0664
sub esp, 0x20
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
push edi
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], ebx
call fcn.10020c7c
cmp dword [edi + 4], 0x100
mov dword [ebp - 0x14], eax
jne 0x1003879f
mov edi, dword [edi + 8]
cmp edi, 0xd
je 0x10038783
cmp edi, 0x20
jbe 0x100387dc
cmp edi, 0x22
jbe 0x10038779
cmp edi, 0x26
je 0x10038779
cmp edi, 0x28
je 0x10038779
cmp edi, 0x41
jne 0x100387dc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x100387dc
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0xb0]
call fcn.1002c8d7
xor eax, eax
jmp 0x100387df
push edi
mov ecx, esi
call fcn.10034fe7
jmp 0x10038775
cmp byte [esi + 0xa9], bl
je 0x10038767
cmp dword [esi + 0x154], ebx
je 0x10038767
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x68]
jmp 0x10038767
inc dword [0x1010c2b8]
cmp dword [0x1010c2b8], 2
jne 0x100387dc
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x84]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x7c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x84]
mov dword [0x1010c2b8], ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x10038a34
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov eax, 0x100ba5ba
call fcn.100a0664
sub esp, 0x228
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], esp
push edi
push dword [ebp + 8]
xor ebx, ebx
mov esi, ecx
mov dword [ebp - 4], ebx
call fcn.1001f892
cmp dword [edi + 4], 0x100
mov dword [ebp + 0xc], eax
jne 0x10038b27
cmp dword [edi + 8], 0xd
je 0x10038a9b
mov eax, dword [esi]
push ebx
mov ecx, esi
call dword [eax + 0x84]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x7c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x80]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x84]
mov edi, dword [edi + 8]
cmp edi, 0xd
je 0x10038ad0
cmp edi, 0x41
jne 0x10038b27
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10038b27
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0xb0]
call fcn.1002c88e
xor eax, eax
jmp 0x10038b70
push 0x104
lea eax, [ebp - 0x234]
push eax
lea edi, [esi + 0xb0]
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x8c]
cmp dword [eax - 0xc], ebx
je 0x10038b1c
lea eax, [ebp - 0x234]
push eax
call fcn.100a01ca
pop ecx
test eax, eax
jne 0x10038b1c
push 0x30
push str.Warning
push dword [esi + 0x8c]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10038b27
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, edi
call fcn.1002c88e
mov eax, dword [ebp + 0xc]
jmp 0x10038b70
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x10039346
Capabilities:
Capture webcam image

Disassembly:
mov eax, 0x100ba688
call fcn.100a0664
sub esp, 0x44
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xac]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x10039372
push 0xfffffffffffffffd
pop eax
jmp 0x100394b5
cmp dword [esi + 0xa0], ebx
je 0x100394b0
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100394b0
mov ecx, dword [esi + 0x78]
lea eax, [ebp - 0x11]
push eax
push esi
mov byte [ebp - 0x11], bl
call fcn.1006b272
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], bl
jne 0x100393d0
push ebx
push 1
push ecx
lea eax, [esi + 0x4c]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.100033f5
mov ecx, dword [esi + 0x78]
add ecx, 0xe4
call fcn.100587da
cmp eax, ebx
setne al
cmp al, bl
je 0x1003942a
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push eax
push 0x419
push dword [ebp - 0x18]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
call edi
lea ecx, [ebp - 0x50]
push ecx
push eax
push 0x41d
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x48]
jle 0x1003940b
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
call fcn.100374aa
mov ecx, dword [esi + 0xac]
push 1
lea eax, [ebp - 0x50]
push eax
add ecx, 0x30
call fcn.10001cfe
xor eax, eax
jmp 0x100394b5
mov eax, 0xfffffe6f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x1003b153
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], vtable.CMD5Hash.0
call fcn.1009f9b0
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x10042493
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x100424ac
push 0x80004005
call fcn.10001170
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, ebx
je 0x1004251b
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x10042516
cmp dword [ebp + 0x10], ebx
jbe 0x1004250c
cmp dword [ebp + 0x10], 2
jbe 0x100424fe
cmp dword [ebp + 0x10], 7
jne 0x1004250c
test cl, 1
jne 0x1004250c
shr ecx, 1
cmp ecx, 1
jb 0x1004250c
cmp word [esi + ecx*2 - 2], bx
jne 0x1004250c
cmp ecx, 1
jbe 0x1004251b
cmp word [esi + ecx*2 - 4], bx
jmp 0x1004250a
test cl, 1
jne 0x1004250c
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x1004251b
xor eax, eax
push 0xd
mov word [esi], ax
pop eax
jmp 0x1004251b
xor ecx, ecx
mov word [esi], cx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x10042522
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jne 0x10042538
push 0x80004005
call fcn.10001170
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 0x14]
je 0x1004254b
cmp eax, 0xffffffff
jne 0x1004255a
push 0x57
pop eax
jmp 0x1004257b
cmp eax, 0xffffffff
jne 0x1004255a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
push dword [ebp + 8]
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
dec eax
and eax, 6
inc eax
push eax
push 0
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
pop ebp
ret 0x10

Function at 0x100426f3
Capabilities:
Delete directory
Move file

Disassembly:
mov eax, 0x100bb873
call fcn.100a0664
push ecx
push ecx
push esi
push edi
and dword [ebp - 4], 0
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
mov ecx, esp
push eax
call fcn.100033f5
call fcn.10029e5b
pop ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
call esi
test eax, eax
jne 0x1004278e
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.100033f5
push str.FCTB
push str.FCTB0000
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10004473
mov edi, dword [ebp - 0x10]
push edi
call esi
test eax, eax
je 0x10042771
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10042786
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x14], esp
mov ecx, esp
push eax
call fcn.100033f5
call fcn.10029e5b
pop ecx
lea ecx, [edi - 0x10]
call fcn.10001ccd
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x10043af4
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x100bb334
call fcn.100a0664
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
mov esi, 0x1010c318
push esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 3
call fcn.100033f5
lea eax, [ebp - 0x14]
push eax
call fcn.10042cef
pop ecx
pop ecx
push 0x1010dc04
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.1005d077
push 0x2001f
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
push SysReAllocString
call fcn.100014df
test eax, eax
jne 0x10043b71
push dword [ebp + 8]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001ccd
lea ecx, [ebp - 0x24]
call fcn.1000146a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001ccd
jmp 0x10043c27
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x1004806f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp edi, esi
jne 0x1004808e
mov eax, 0x80004003
pop edi
pop esi
leave
ret 8
push str.Layouts
push 0x1010c424
lea eax, [ebp - 4]
push 0x100c6e54
push eax
mov dword [edi], esi
call fcn.10016371
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000c4dd
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10004f80
add esp, 0xc
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.1000c4dd
mov ecx, dword [ebp - 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.10001ccd
push esi
push esi
push 0x2001f
push esi
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.10001485
test eax, eax
je 0x10048131
xor esi, esi
inc esi
lea ecx, [ebp - 8]
call fcn.1000146a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, esi
jmp 0x10048088
xor eax, eax
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.1009f9b0
add esp, 0xc
mov eax, dword [edi]
lea ecx, [ebp - 0x18]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x220]
push ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x10048117
inc dword [edi]
jmp 0x1004814f
Function at 0x1004817f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x1004819a
mov eax, 0x80004003
pop esi
leave
ret 0xc
push edi
push str.Layouts
push 0x1010c424
lea eax, [ebp - 4]
push 0x100c6e54
push eax
call fcn.10016371
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1000c4dd
add esp, 0xc
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10004f80
add esp, 0xc
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000c4dd
mov ecx, dword [ebp - 0x14]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.10001ccd
push esi
push esi
mov edi, 0x2001f
push edi
push esi
push esi
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
push SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.10001485
test eax, eax
je 0x1004823e
xor esi, esi
inc esi
lea ecx, [ebp - 8]
call fcn.1000146a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, esi
pop edi
jmp 0x10048195
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
lea eax, [ebp - 0x222]
push esi
push eax
call fcn.1009f9b0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0xc], 0x104
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1004828c
mov esi, 0x80004005
jmp 0x10048223
push esi
push esi
push edi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 8]
lea ecx, [ebp - 8]
call fcn.10001485
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x224]
push eax
push esi
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0x104
call fcn.10027d59
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x10048223
Function at 0x100482d5
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
jne 0x100482f4
mov eax, 0x80004003
pop edi
pop esi
leave
ret 0xc
push str.Layouts
push 0x1010c424
lea eax, [ebp - 4]
push 0x100c6e54
push eax
call fcn.10016371
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000c4dd
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10004f80
add esp, 0xc
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.1000c4dd
mov ecx, dword [ebp - 0xc]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.10001ccd
push esi
push esi
push 0x2001f
push esi
push esi
push dword [ebp + 0x10]
lea ecx, [ebp - 8]
push SysReAllocString
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.10001485
test eax, eax
je 0x10048395
xor esi, esi
inc esi
lea ecx, [ebp - 8]
call fcn.1000146a
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, esi
jmp 0x100482ee
xor eax, eax
push 0x206
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push esi
push eax
call fcn.1009f9b0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100483e3
mov esi, 0x80004005
jmp 0x1004837b
lea eax, [ebp - 0x220]
push eax
call fcn.100a4d75
pop ecx
mov dword [edi], eax
jmp 0x1004837b
Function at 0x1004b06a
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x100bbca0
call fcn.100a0664
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], esp
push ecx
lea esi, [edi + 0x68]
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], esi
call fcn.100633e2
mov ecx, esi
call fcn.1006e82b
cmp al, bl
jne 0x1004b13a
cmp byte [edi + 0x1428], bl
jne 0x1004b13a
cmp byte [edi + 0x1429], bl
jne 0x1004b13a
cmp byte [edi + 0x12e8], bl
je 0x1004b13a
cmp byte [0x10110007], bl
jne 0x1004b13a
cmp byte [edi + 0x1427], bl
jne 0x1004b13a
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x100c503c
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
mov esi, 0x100c51a4
push esi
mov byte [ebp - 4], 1
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.TBShow
mov byte [ebp - 4], 2
call fcn.100057f4
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], bl
call fcn.10044254
add esp, 0x10
push esi
mov ecx, eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], 1
call fcn.1000272b
mov byte [ebp + 0xb], 1
cmp eax, ebx
je 0x1004b13d
mov byte [ebp + 0xb], bl
test byte [ebp - 0x14], 1
mov dword [ebp - 4], ebx
je 0x1004b151
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001ccd
cmp byte [ebp + 0xb], bl
je 0x1004b179
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1004b179
mov ecx, dword [ebp - 0x18]
call fcn.1006556c
mov ecx, dword [ebp + 0x10]
or eax, 0xffffffff
mov word [ecx], ax
mov ecx, dword [ebp - 0x18]
mov byte [edi + 0x1429], bl
mov byte [0x10110007], bl
call fcn.10061a58
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x10050b7a
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x100bc8d3
call fcn.100a0664
sub esp, 0x60
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
mov dword [ebp - 0x10], esp
add esi, 0x54
push eax
mov ecx, esi
call fcn.10068282
push dword [ebp + 8]
mov byte [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10050bca
mov esi, 0x80004005
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.10001ccd
mov eax, esi
jmp 0x10050ce2
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x10050bd8
mov esi, 0x80004003
jmp 0x10050bb8
push 1
push dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
call fcn.100027a1
mov eax, dword [eax]
mov byte [ebp - 4], 2
test eax, eax
je 0x10050bf3
mov eax, dword [eax]
jmp 0x10050bf5
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
call fcn.100057f4
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x10050c12
call fcn.10003043
and dword [ebp + 0x10], 0
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.TOOLBAR
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x100c503c
mov byte [ebp - 4], 5
call fcn.100057f4
push 1
push ecx
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 6
call fcn.100033f5
push esi
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 4
call fcn.1008a9c9
push 0xfffffffffffffffe
push ecx
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 7
call fcn.100033f5
lea ecx, [ebp - 0x6c]
call fcn.10089475
xor ecx, ecx
test eax, eax
setl cl
mov byte [ebp - 4], 4
dec ecx
mov word [edi], cx
lea ecx, [ebp - 0x6c]
call fcn.10089b1a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.10001ccd
xor esi, esi
jmp 0x10050bb8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x1005a27a
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100bd4d9
call fcn.100a0664
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
mov ebx, ecx
push 0xd
mov dword [ebp - 0x10], ebx
mov dword [ebp + 0xc], eax
call edi
push 0
push 0
push 0x447
mov dword [esi + 0x50], eax
add ebx, 0x30
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + 0xc]
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.10001fb7
cmp dword [ebp - 0x14], eax
jne 0x1005a2d6
mov dword [esi + 0x28], 0x40
push 0xe
jmp 0x1005a2d8
push 7
call edi
push 7
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x44], eax
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x34], 0x20
push 0x43f
push dword [ebx]
mov dword [ebp - 0x30], 4
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [ebp - 0x24], 0x80
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x28]
je 0x1005a320
push dword [eax + 0x1304]
jmp 0x1005a326
push dword [eax + 0x1300]
push dword [esi + 0x10]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 0xf0012
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x1005c7cc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push 0x110
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.1009f9b0
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1005c825
cmp dword [ebp - 0x110], 5
jae 0x1005c821
cmp dword [ebp - 0x110], 4
jne 0x1005c825
cmp dword [ebp - 0x10c], 0x5a
jb 0x1005c825
xor eax, eax
leave
ret
xor eax, eax
inc eax
leave
ret

Function at 0x1005dc63
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor esi, esi
push esi
push esi
push 0x2001f
push esi
push esi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push dword [edi]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.10001485
mov eax, dword [ebp + 8]
push esi
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
lea ecx, [ebp - 8]
call fcn.1000146a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001ccd
pop edi
pop esi
leave
ret