joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a70d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10238d9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edx
push 0x94
call fcn.10005b84
mov esi, dword [ebp + 8]
add esp, 8
mov edi, eax
mov ecx, eax
mov dword [ebp - 0x10], edi
push esi
call fcn.10007fe7
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
push ecx
lea ecx, [edi + 0x18]
call fcn.10007fe7
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.10007fe7
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.10007fe7
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.10007fe7
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.10007fe7
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a90d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100a9135
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a9110
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a9135
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.101e48f0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.101e48f0
add esp, 8
ret 4
Function at 0x100a92d0
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023bb98
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x100a9319
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x100a946b
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x100a9436
test eax, eax
je 0x100a9436
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x100a9439
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x24], eax
cmp ecx, 0xffffffff
je 0x100a93bb
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100a93af
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a93bb
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x100a93c9
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x24]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.10007fe7
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x100a9436
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x100a9374
jmp 0x100a9439
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
add dword [ecx], edx
test eax, eax
jne 0x100a9462
test edx, edx
je 0x100a945e
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x100a9330
mov al, 1
jmp 0x100a946d
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x100a946b
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100ab8a0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023c108
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
mov ecx, edi
mov esi, dword [ebp + 0xc]
call fcn.10007f3e
test al, al
jne 0x100ab8fa
cmp byte [ebp + 8], al
jne 0x100ab901
mov eax, dword [ebx]
test eax, eax
je 0x100aba5f
cmp byte [eax + 0xa5], 0
je 0x100aba5f
xor al, al
jmp 0x100aba73
mov ecx, esi
call fcn.10007f3e
test al, al
jne 0x100aba5f
mov ecx, esi
call fcn.10077600
test al, al
je 0x100ab927
push esi
push edi
call fcn.100ab4d0
jmp 0x100aba5b
push 0xb
mov ecx, esi
call fcn.10007f54
push eax
mov ecx, edi
call fcn.10007f54
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push eax
call ebx
test eax, eax
je 0x100ab94c
mov al, 1
jmp 0x100aba5b
lea ecx, [ebp - 0x58]
mov byte [ebp - 0x59], 0
call fcn.10007fd4
mov dword [ebp - 4], 0
lea edx, [ebp - 0x58]
mov ecx, edi
call fcn.1009c150
movzx ecx, byte [ebp - 0x59]
test al, al
mov edx, 1
cmovne ecx, edx
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x40]
call fcn.10007fd4
mov byte [ebp - 4], 1
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.1009c150
test al, al
jne 0x100ab999
cmp byte [ebp - 0x60], al
je 0x100ab9d5
push 0xb
lea ecx, [ebp - 0x40]
call fcn.10007f54
push eax
lea ecx, [ebp - 0x58]
call fcn.10007f54
push eax
call ebx
test eax, eax
je 0x100ab9d5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10005e05
mov al, 1
jmp 0x100aba5b
mov ecx, esi
call fcn.1009a850
cmp eax, 0xffffffff
je 0x100aba3e
push esi
lea ecx, [ebp - 0x28]
call fcn.10007fe7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1009bbb0
test al, al
je 0x100aba32
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.1009a8f0
test al, al
je 0x100aba32
mov edx, esi
mov ecx, edi
call fcn.1009a8f0
lea ecx, [ebp - 0x28]
test al, al
je 0x100aba2b
call fcn.1009aa00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10005e05
jmp 0x100ab9b3
mov edx, esi
call fcn.1009a8f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.10005e05
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.10005e05
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10005e05
xor al, al
test al, al
jne 0x100aba71
mov ecx, edi
call fcn.10077600
test al, al
je 0x100aba71
mov ecx, edi
call fcn.1009aa00
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100b1a50
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.101fd690
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x100b1ae7
cmp dword [esp + 8], 6
jb 0x100b1ae7
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.101e48f0
add esp, 0x118
ret

Function at 0x100b1b00
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023c910
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.10005e0a
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1008c540
mov ecx, eax
call fcn.1008c600
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.10005e0a
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.1008c540
mov ecx, eax
call fcn.1008c600
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10005e05
test ebx, ebx
je 0x100b1c15
test esi, esi
je 0x100b1c15
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100b3b30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023cc69
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 8]
mov dword [edi + 4], 0
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], 0
mov dword [ebp - 4], 1
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 2
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 0x20], eax
mov dword [ebp - 4], 4
lea ecx, [edi + 0x24]
call fcn.100b4c50
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0x30]
mov eax, dword [ebp + 8]
mov dword [edi], vtable.RC::RCMiniUISimpleWindow.0
mov dword [edi + 0x24], vtable.RC::RCMiniUISimpleWindow.1.0
mov dword [ecx + 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100b48a0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x102c6474]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push edi
mov edi, dword [esp + 0x128]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.101fd690
push 0x110
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0x114
push 0
push eax
call fcn.101fd690
add esp, 0x18
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100b4900
cmp dword [esp + 0xc], 6
mov eax, 0x30
jae 0x100b4905
mov eax, 0x2c
push edi
mov dword [esi], eax
mov dword [esi + 4], 0
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi + 0xc], edi
mov ecx, dword [0x102ce24c]
mov dword [esi + 0x20], ecx
mov ecx, dword [esp + 0x134]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x11c]
pop edi
mov dword [esi + 0x28], 0
pop esi
xor ecx, esp
call fcn.101e48f0
add esp, 0x118
ret 0x18
Function at 0x100b4c50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023d112
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 0x14
mov dword [eax], vtable.RC::RCMiniUIWindow.0
call fcn.101e4da1
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
lea esi, [edi + 4]
mov dword [edi], 1
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10099320
mov dword [esi], eax
mov byte [ebp - 4], 3
lea esi, [edi + 0xc]
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100695c0
mov dword [esi], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [ebp - 4], 7
mov edi, eax
push 0x78
mov dword [edi], vtable.RC::RCMiniUIDialogView.0
lea esi, [edi + 0x4c]
mov dword [edi + 0x10], 0xae
mov dword [edi + 0x14], 0xaf
mov dword [edi + 0x1c], edi
mov dword [edi + 0x24], edi
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], vtable.RC::RCMiniUIBounceWndHandler.0
mov dword [edi + 0x48], edi
call fcn.101e4da1
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 8
movaps xmm0, xmmword [0x102927b0]
movsd xmm1, qword [0x10292430]
mov byte [eax], 0
movups xmmword [eax + 8], xmm0
movaps xmm0, xmmword [0x10292780]
movsd qword [eax + 0x18], xmm1
movups xmmword [eax + 0x20], xmm0
movsd qword [eax + 0x30], xmm1
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 1
mov dword [eax + 0x48], 0
mov byte [ebp - 4], 9
mov dword [eax + 0x4c], 0
mov byte [ebp - 4], 0xa
mov dword [eax + 0x50], 0
mov byte [ebp - 4], 0xb
mov dword [eax + 0x54], 0
mov byte [ebp - 4], 0xc
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 0
xorps xmm0, xmm0
mov dword [eax + 0x64], 0
movsd qword [eax + 0x68], xmm0
mov dword [eax + 0x70], 1
mov dword [eax + 0x38], accept
mov dword [eax + 0x3c], accept
mov byte [ebp - 4], 7
mov dword [edi + 0x44], eax
mov byte [ebp - 4], 0xd
push 0x60
mov byte [esi], 0
mov byte [edi + 0x4d], 0xff
call fcn.101e4da1
add esp, 8
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xe
mov ecx, eax
call fcn.100b4980
mov byte [ebp - 4], 0xd
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b7100
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10239b28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x102c6474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x100b7273
mov eax, dword [ecx + 0xb8]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x100b7273
cmp dword [eax + 4], 0
je 0x100b7273
call fcn.100cb7f0
mov edi, eax
test edi, edi
je 0x100b7273
mov eax, dword [ebp + 8]
sub eax, 0x10d
je 0x100b7264
sub eax, 1
je 0x100b724c
sub eax, 1
jne 0x100b7273
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp dword [edi + 4], 0
mov ebx, eax
mov dword [ebp - 0x30], ebx
je 0x100b7273
mov ecx, edi
call fcn.100cd680
push ebx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov ebx, eax
test ebx, ebx
je 0x100b7273
lea ecx, [ebp - 0x28]
call fcn.10007fd4
mov dword [ebp - 4], 0
test dword [ebp + 0x10], 0x800
je 0x100b7225
push 0
push 0
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov dword [ebp - 0x2c], eax
test eax, eax
jle 0x100b7225
mov esi, eax
shr esi, 1
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000af9e
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.100cd790
lea ecx, [ebp - 0x28]
call fcn.10005e30
cmp dword [eax + 0x14], 8
jb 0x100b7215
mov eax, dword [eax]
push dword [ebp - 0x2c]
push eax
push 0x800
push ebx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10005e05
jmp 0x100b7273
mov byte [edi + 8], 0
mov byte [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
jmp 0x100b7273
mov ecx, edi
mov byte [edi + 8], 0
call fcn.100cd680
mov byte [edi + 0x10], 1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101e48f0
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100b8dd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
push 0x12
mov ebp, ecx
mov dword [eax], 0
call ebx
movzx esi, ax
shr esi, 5
push 0x10
and esi, 4
call ebx
mov edi, esi
or edi, 1
and al, 0x80
push 0x11
cmove edi, esi
call ebx
mov ecx, dword [ebp + 4]
mov esi, edi
or esi, 2
and al, 0x80
cmove esi, edi
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, eax
test ecx, ecx
je 0x100b8e3e
mov eax, dword [ecx]
push esi
push dword [esp + 0x20]
push dword [esp + 0x20]
mov eax, dword [eax + 0x88]
call eax
test al, al
je 0x100b8e3e
mov eax, dword [esp + 0x20]
mov dword [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x100b8e50
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0x12
mov dword [esp + 0x14], ecx
mov dword [ebp], 0
call ebx
movzx esi, ax
shr esi, 5
push 0x10
and esi, 4
call ebx
mov edi, esi
or edi, 1
and al, 0x80
push 0x11
cmove edi, esi
call ebx
mov ecx, dword [esp + 0x10]
mov esi, edi
or esi, 2
and al, 0x80
cmove esi, edi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
call dword [eax + 8]
mov edi, dword [esp + 0x20]
mov ecx, eax
mov ebx, dword [esp + 0x1c]
test ecx, ecx
je 0x100b8ebe
mov eax, dword [ecx]
push esi
push edi
push ebx
mov eax, dword [eax + 0x84]
call eax
test al, al
jne 0x100b8ed9
cmp dword [ebp], 0
jne 0x100b8ee0
mov eax, dword [esp + 0x10]
push esi
push edi
push ebx
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x14]
call eax
test al, al
je 0x100b8ee0
mov dword [ebp], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0x10

Function at 0x100ba660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10238ec9
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x60
call fcn.101e4da1
mov esi, eax
add esp, 4
mov ecx, esi
mov dword [ebp - 0x10], esi
call fcn.10007fd4
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.10007fd4
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.10007fd4
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.10007fd4
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov dword [edi + 0x24], esi
mov eax, edi
movups xmmword [edi + 0xc], xmm0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100bdc60
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023e01b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x102c6474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.RC::RCMiniUIObject.0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x10]
mov dword [esi], vtable.RC::RCMiniUIView.1.0
mov dword [esi + 4], vtable.RC::RCMiniUIView.0
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0xc], 0
call fcn.100cce40
mov byte [ebp - 4], 1
xorps xmm0, xmm0
push 0x64
mov word [esi + 0x80], 0
mov dword [esi + 0x88], 0
mov byte [esi + 0x8c], 1
mov word [esi + 0xa0], 0x101
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov word [esi + 0xac], 0
mov byte [esi + 0xae], 0
mov dword [esi + 0xb0], 0x3e8
mov word [esi + 0xb4], 0
mov byte [esi + 0xb6], 1
movups xmmword [esi + 0x90], xmm0
call fcn.101e4da1
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 2
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov dword [edi + 0x34], 0
lea esi, [edi + 0x44]
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov byte [edi + 0x40], 0
mov dword [edi + 0xc], 0xf
movups xmmword [edi + 0x10], xmm0
mov dword [ebp - 0x1c], esi
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10099320
mov dword [esi], eax
mov byte [ebp - 4], 6
lea esi, [edi + 0x4c]
sub esp, 8
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100c06f0
mov dword [esi], eax
mov byte [ebp - 4], 9
lea esi, [edi + 0x54]
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.100695c0
mov dword [esi], eax
mov byte [ebp - 4], 0xc
mov dword [edi + 0x5c], 0
mov byte [edi + 0x60], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x84], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x100c21a0
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 8]
test edi, edi
je 0x100c2205
cmp dword [edi], 0
mov esi, dword [esi]
je 0x100c21e5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100c21fb
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100c21fb
push 0
push dword [edi]
push 0
push 0
push dword [esp + 0x1c]
push esi
call eax
pop edi
pop esi
ret 4
cmp dword [edi + 4], 0
je 0x100c21fb
push dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4
pop edi
mov eax, 1
pop esi
ret 4
cmp byte [0x102d07f4], 0
jne 0x100c2245
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100c2237
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x102d07f8], eax
mov byte [0x102d07f4], 1
jmp 0x100c224a
mov eax, dword [0x102d07f8]
mov byte [0x102d07f4], 1
jmp 0x100c224a
mov eax, dword [0x102d07f8]
test eax, eax
je 0x100c2260
push 0
push dword [esi + 4]
push dword [esp + 0x14]
push dword [esi]
call eax
pop edi
pop esi
ret 4
push dword [esp + 0xc]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
ret 4