joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe7dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe7dd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xe7dd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xe7dd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xe7dd94
push eax
push esi
call fcn.00e8020b
add esp, 8
pop esi
ret 0x10

Function at 0xe7dda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe7de22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xe7de15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xe96320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e7fdff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xe7ddda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xe7de30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xe7dec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xe7deb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xe96320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00e7fdff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xe7deab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xe7de6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xe7e000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xe7e131
push esi
call fcn.00e81145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00e70080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xe7e131
push 0
push ebp
call fcn.00e703a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00e70260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xe7e08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00e702f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xe7e121
push 0xe96918
push edi
call fcn.00e7f3f0
push eax
push ebx
push esi
call fcn.00e7df60
push 0xe968f8
push edi
call fcn.00e7f3f0
push eax
push ebx
push esi
call fcn.00e7df60
push 0xe968d8
push edi
call fcn.00e7f3f0
push eax
push ebx
push esi
call fcn.00e7df60
push 0xe968c0
push edi
call fcn.00e7f3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00e7df60
push 0xe968a0
push edi
call fcn.00e7f3f0
push eax
push ebx
push esi
call fcn.00e7df60
push 0xe96888
push edi
call fcn.00e7f3f0
push eax
push ebx
push esi
call fcn.00e7df60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xe7f1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00e7f140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00e7f140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00e7f140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00e7f140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xe7fbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xe7fc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe9187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xe7fc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xe7fc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10001520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x100a6950], 0
je 0x10001539
mov eax, dword [0x100a6950]
jmp 0x100016d6
mov dword [0x100a6950], 0x100a6928
push 0x28
push 0
push 0x100a6928
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x100a6928], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x100a692c], eax
cmp dword [0x100a692c], 0
jne 0x1000157f
xor eax, eax
jmp 0x100016d6
push str.ImagehlpApiVersionEx
mov eax, dword [0x100a692c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6930], eax
push str.SymInitialize
mov ecx, dword [0x100a692c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6934], eax
push str.SymSetOptions
mov edx, dword [0x100a692c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6938], eax
push str.SymGetOptions
mov eax, dword [0x100a692c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a693c], eax
push str.SymLoadModule
mov ecx, dword [0x100a692c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6940], eax
push str.SymGetModuleInfo
mov edx, dword [0x100a692c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6944], eax
push str.SymGetSymFromName
mov eax, dword [0x100a692c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a6948], eax
push str.BindImage
mov ecx, dword [0x100a692c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100a694c], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x100a6930], 0
je 0x1000165d
lea eax, [ebp - 8]
push eax
call dword [0x100a6930]
cmp dword [0x100a6930], 0
je 0x1000166f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1000168a
mov edx, dword [0x100a692c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100a692c], 0
xor eax, eax
jmp 0x100016d6
cmp dword [0x100a6934], 0
je 0x100016a3
push 0
push 0
mov eax, dword [0x100a6928]
push eax
call dword [0x100a6934]
cmp dword [0x100a693c], 0
je 0x100016d1
cmp dword [0x100a6938], 0
je 0x100016d1
call dword [0x100a693c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x100a6938]
mov eax, dword [0x100a6950]
mov esp, ebp
pop ebp
ret
Function at 0x100205f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x10065010]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [esp + 0x4c]
xorps xmm1, xmm1
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
push edi
mov edi, edx
call fcn.100204b0
cmp dword [eax + 0x14], 0x10
jb 0x1002061d
mov eax, dword [eax]
push ebx
push 0x20
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x10020666
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002065c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002065c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100430bb
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [esp + 0x50]
add esp, 4
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10042c4e
add esp, 0x44
ret

Function at 0x10020720
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x10065010]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [esp + 0x58]
mov ebx, edx
mov edx, dword [esp + 0x54]
push edi
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.10025180
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x2c]
push esi
push 0x20
push ecx
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jb 0x1002079d
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10020793
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10020793
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100430bb
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x50]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10042c4e
add esp, 0x48
ret
Function at 0x10027ae0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x10065010]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x100a697c], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.1001cd90
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10027b44
test eax, 0x68000
jne 0x10027b44
mov eax, dword [esp + 0x22]
test eax, eax
je 0x10027bd0
cmp eax, 5
je 0x10027b94
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.1001cd90
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x10027b78
test eax, 0x68000
jne 0x10027b78
mov ecx, dword [esp + 0x22]
jmp 0x10027b7b
or ecx, 0xffffffff
mov eax, dword [0x100a697c]
add eax, ecx
add esi, eax
mov dword [0x100a697c], eax
cmp eax, 5
jl 0x10027b05
jmp 0x10027ba1
mov eax, dword [0x100a697c]
add eax, 4
mov dword [0x100a697c], eax
push eax
call fcn.100432f5
add esp, 4
mov dword [0x100a6984], eax
mov dword [0x100a6980], edi
push 0x40
push 0x3000
push dword [0x100a697c]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10027be5
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.10042c4e
mov esp, ebp
pop ebp
ret 8
push dword [0x100a697c]
push edi
push dword [0x100a6984]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x100a697c]
push dword [0x100a6984]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x100a697c]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x100a697c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x100a697c], 5
mov cl, 5
jle 0x10027c71
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x100a697c]
jl 0x10027c60
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x100a697c]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.10042c4e
mov esp, ebp
pop ebp
ret 8
Function at 0x1002d6e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [0x100a7550]
push ebp
mov ebp, dword [0x100a7558]
push esi
push edi
push dword [esp + 0x2c]
add ebp, 0x1b
mov dword [esp + 0x18], ebx
push ecx
mov eax, esp
mov dword [0x100a7558], ebp
mov dword [esp + 0x20], ebp
mov dword [eax], 0xffffffff
lea eax, [ebp + 0x17]
push eax
lea eax, [ebx + 0xf]
push eax
push 1
push 0
push 0x100a6979
call fcn.10028320
add esp, 0x1c
lea edi, [ebp + 0xc]
cmp byte [0x100a7b63], 0
lea eax, [ebx + 0x9f]
je 0x1002d780
mov ecx, dword [0x100a7a44]
cmp ecx, eax
jle 0x1002d780
add eax, 0x81
cmp eax, ecx
jle 0x1002d780
mov ecx, dword [0x100a7a48]
cmp ecx, edi
jle 0x1002d780
lea eax, [edi + 0x11]
cmp eax, ecx
jle 0x1002d780
cmp byte [0x10294ff0], 0
jne 0x1002d780
cmp byte [0x10294ff1], 0
jne 0x1002d780
mov eax, dword [esp + 0x28]
mov byte [0x10294ff0], 1
mov byte [eax], 1
mov ecx, dword [0x100a79a8]
lea esi, [ebx + 0xa4]
push ecx
mov eax, esp
mov dword [eax], 0xff000000
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov ecx, dword [0x100a79a8]
lea eax, [edi + 0x17]
push eax
lea eax, [esi + 0x69]
push eax
mov edx, dword [ecx]
push edi
push esi
mov eax, dword [edx + 0x30]
call eax
mov ecx, dword [0x100a79a8]
lea edi, [ebp + 0xd]
push ecx
mov eax, esp
lea esi, [ebx + 0xa5]
mov dword [eax], 0xff1b1b1b
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov ecx, dword [0x100a79a8]
lea eax, [edi + 0x15]
push eax
lea eax, [esi + 0x67]
push eax
mov edx, dword [ecx]
push edi
push esi
mov eax, dword [edx + 0x30]
call eax
mov eax, dword [esp + 0x28]
cmp byte [eax], 1
jne 0x1002d891
xor esi, esi
mov ebp, 0x10056358
mov ebx, 0x10099fc0
xor edi, edi
cmp esi, 0x7c
mov eax, 0x10099fc0
cmovbe eax, ebx
cmp dword [eax + 0x14], 0x10
jb 0x1002d817
mov eax, dword [eax]
cmp eax, 0x10053527
je 0x1002d829
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1002d87b
add edi, 0x18
inc esi
add ebx, 0x18
cmp edi, 0xba0
jb 0x1002d804
mov ebx, dword [esp + 0x14]
push ebp
push 0x10056360
push ecx
mov eax, esp
mov dword [eax], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0x11
push eax
lea eax, [ebx + 0xd8]
push eax
push 0
push 1
push 0x100a6979
call fcn.10028320
add esp, 0x20
inc dword [0x102946f4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov eax, dword [esp + 0x24]
mov dword [eax], esi
mov eax, dword [esp + 0x28]
mov byte [eax], 0
mov byte [0x10294ff0], 0
jmp 0x1002d838
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
cmp eax, 0x7c
jbe 0x1002d8a3
mov ebp, 0x10099fc0
jmp 0x1002d8ad
lea eax, [eax + eax*2]
lea ebp, [eax*8 + 0x10099fc0]
cmp dword [ebp + 0x14], 0x10
jb 0x1002d83c
mov ebp, dword [ebp]
jmp 0x1002d83c
Function at 0x10031550
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.100313b0
mov ecx, dword [0x100a7888]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x10031596
cmp byte [0x100a4644], 0
je 0x10031596
push dword [0x100a42d4]
push dword [0x100a42d0]
push dword [0x100a42cc]
push dword [0x100a42c8]
call fcn.10030b70
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x100315b5
cmp byte [0x100a697b], 0
sete al
mov byte [0x100a697b], al
jmp 0x100315ba
mov al, byte [0x100a697b]
test al, al
je 0x10031787
push 1
call esi
test al, 1
je 0x100315d3
mov byte [0x100a7b63], 1
jmp 0x100315e3
push 1
call esi
and al, 1
neg al
sbb al, al
and byte [0x100a7b63], al
push 2
call esi
test al, 1
je 0x100315f4
mov byte [0x100a7b61], 1
jmp 0x10031604
push 2
call esi
and al, 1
neg al
sbb al, al
and byte [0x100a7b61], al
push 1
call esi
test ax, ax
je 0x10031616
mov byte [0x100a7b75], 1
jmp 0x10031625
push 1
call esi
neg ax
sbb al, al
and byte [0x100a7b75], al
push 2
call esi
test ax, ax
je 0x10031637
mov byte [0x100a7b62], 1
jmp 0x10031646
push 2
call esi
neg ax
sbb al, al
and byte [0x100a7b62], al
cmp byte [0x100a4694], 0
je 0x1003166f
sub esp, 0x18
mov ecx, esp
push 0x100a46b4
call fcn.10031810
mov ecx, 0x100a6968
call fcn.10020ff0
mov byte [0x100a4694], 0
cmp byte [0x100a4693], 0
je 0x10031698
sub esp, 0x18
mov ecx, esp
push 0x100a46b4
call fcn.10031810
mov ecx, 0x100a6968
call fcn.10022f10
mov byte [0x100a4693], 0
push dword [0x100a42c4]
mov ecx, 0x100a7498
push dword [0x100a42c0]
push dword [0x100a42bc]
push dword [0x100a42b8]
call fcn.1002ec00
mov al, byte [0x100a4cd8]
push ecx
mov ecx, esp
push ecx
mov byte [ecx], al
mov al, byte [0x100a4cd9]
mov byte [ecx + 1], al
mov al, byte [0x100a4cda]
mov byte [ecx + 2], al
mov al, byte [0x100a4cdb]
mov byte [ecx + 3], al
mov ecx, esp
mov al, byte [0x100a4cd0]
mov byte [ecx], al
mov al, byte [0x100a4cd1]
mov byte [ecx + 1], al
mov al, byte [0x100a4cd2]
mov byte [ecx + 2], al
mov al, byte [0x100a4cd3]
mov byte [ecx + 3], al
call fcn.1003dc30
mov esi, dword [0x100a42c8]
xor eax, eax
mov edx, dword [0x100a42cc]
test esi, esi
mov edi, dword [0x100a7560]
mov ebx, dword [0x100a7494]
cmovs esi, eax
test edx, edx
mov ecx, ebx
cmovs edx, eax
sub ecx, dword [0x100a42d0]
mov eax, edi
sub eax, dword [0x100a42d4]
cmp esi, eax
cmovg esi, eax
cmp edx, ecx
mov dword [0x100a42c8], esi
cmovg edx, ecx
mov ecx, dword [0x100a42b8]
xor eax, eax
mov dword [0x100a42cc], edx
test ecx, ecx
cmovs ecx, eax
mov eax, dword [0x100a42bc]
xor edx, edx
test eax, eax
cmovs eax, edx
sub edi, dword [0x100a42c0]
sub ebx, dword [0x100a42c4]
cmp ecx, edi
cmovg ecx, edi
cmp eax, ebx
mov dword [0x100a42b8], ecx
cmovg eax, ebx
mov dword [0x100a42bc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b1f0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x100a4689], 0
je 0x1003b235
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1003b235
cmp byte [0x100a4689], 0
jne 0x1003b265
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
jne 0x1003b258
mov eax, dword [esi + 4]
inc eax
add ecx, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
mov dword [esi + 4], 0
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
Function at 0x1003d7e0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x10065010]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x1003d87c
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.1003d140
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x1003d88b
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.1003d140
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.10042c4e
add esp, 0x68
ret
Function at 0x40252d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
pushal
call 0x40252d
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x402572
push edi
imul ebp, dword [esi + 0x64], 0x5c73776f
inc ebx
jne 0x402593
jb 0x402588
outsb dx, byte [esi]
je 0x40257c
jb 0x40259c
imul ebp, dword [edi + 0x6e], 0x85c75e00
invalid
mov dword [ebp - 4], 0x186a0
add dword [eax], eax
push 0
push 0
push 0
push 0
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
mov ch, 0xf8
invalid
call dword [sym.imp.advapi32.dll_RegEnumKeyExA]
cmp eax, 0x103
add byte [eax], al
je 0x402604
lea edx, [ebp - 0x104]
push edx
call fcn.00402489
cmp eax, 1
je 0x4025b9
inc dword [ebp - 0x108]
jmp 0x40256d
cmp dword [ebp + 8], 0
je 0x4025fa
lea edx, [ebp - 0x104]
push edx
push esi
call fcn.004017de
push dword [ebp + 8]
push eax
call fcn.004015ee
cmp dword [ebp + 0xc], 0
je 0x4025fa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 8
push 0
push 0
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegGetValueA]
cmp eax, 0
jne 0x402604
mov dword [ebp - 0x110], 1
push dword [ebp - 0x10c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
popal
mov eax, dword [ebp - 0x110]
leave
ret 0xc

Function at 0x403079
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
pushal
lea edx, [ebp - 0x30c]
push edx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push 0x40601c
lea edx, [ebp - 0x30c]
push edx
call fcn.00401702
lea edx, [ebp - 0x208]
push edx
call fcn.00402190
push 0x406214
lea edx, [ebp - 0x208]
push edx
call fcn.00401702
push 0
push 0x1db
push 0x406039
lea edx, [ebp - 0x30c]
push edx
call fcn.0040226e
push 0
push 0x182
push 0x40622d
lea edx, [ebp - 0x208]
push edx
call fcn.0040226e
push 0x406219
lea edx, [ebp - 0x208]
push edx
call fcn.00401702
cmp eax, 0
je 0x40313f
lea edx, [ebp - 0x208]
push edx
push 0x406010
call fcn.004020f6
push 0x5dc
call dword [sym.imp.kernel32.dll_Sleep]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.kernel32.dll_DeleteFileA]
popal
leave
ret