joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a699e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x100db690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea esi, [edi + 0x4d8]
xor ebx, ebx
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
mov dword [ebp - 4], ebx
mov dword [edi + 0x510], 1
mov dword [edi + 0x514], ebx
mov dword [edi + 0x518], ebx
mov dword [edi + 0x51c], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov eax, 0xffffff
mov dword [edi + 0xac], eax
mov dword [edi + 0xb0], eax
push ebx
mov eax, 0x100d1844
mov dword [edi + 0x18], ebx
mov dword [edi + 0x90], ebx
mov dword [edi + 0x94], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0x98], ebx
mov dword [edi + 0xa0], 1
mov dword [edi + 0xa4], 0xd9d9d9
mov dword [edi + 0xa8], 0xfe904d
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
mov dword [edi + 0xbc], ebx
mov dword [edi + 0x4d0], ebx
mov dword [edi + 0x4d4], ebx
call fcn.10004870
mov ecx, dword [ebp + 8]
mov dword [edi + 0x528], ecx
mov dword [edi + 0x4f4], ebx
mov dword [edi + 0x4f8], 8
mov dword [edi + 0x4fc], ebx
mov dword [edi + 0x500], ebx
mov dword [edi + 0x504], ebx
mov dword [edi + 0x508], ebx
mov dword [edi + 0x50c], ebx
mov dword [edi + 0x53c], ebx
mov dword [edi + 0x540], ebx
mov dword [edi + 0x544], ebx
mov dword [edi + 0x558], ebx
mov dword [edi + 0x55c], ebx
mov dword [edi + 0x560], ebx
mov dword [edi + 0x564], ebx
mov dword [edi + 0x52c], ebx
mov dword [edi + 0x530], ebx
mov dword [edi + 0x534], ebx
mov dword [edi + 0x54c], ebx
mov dword [edi + 0x550], ebx
mov dword [edi + 0x554], ebx
cmp dword [edi + 0x528], ebx
jne 0x10001424
push ebx
lea eax, [edi + 0x510]
push eax
lea edx, [edi + 0x520]
push edx
call sub.gdiplus.dll_GdiplusStartup
push 0x30
lea esi, [edi + 0x5c]
push ebx
push esi
mov dword [edi + 0x524], ebx
call fcn.1002e520
mov eax, dword [edi + 4]
mov dword [edi + 0x64], eax
mov dword [edi + 0x68], eax
lea eax, [edi + 0x2c8]
add esp, 0xc
mov dword [esi], 0x30
mov dword [edi + 0x60], 0xb1
mov dword [edi + 0x80], eax
mov dword [edi + 0x8c], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002430
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0x50c]
test edx, edx
jne 0x10002446
mov eax, 0x80004005
pop ebp
ret 0x10
pop ebp
jmp fcn.10012af0

Function at 0x10002e00
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100db690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x508]
push esi
lea esi, [ebp - 8]
mov dword [ebp - 8], 0
call fcn.10011d80
mov eax, dword [ebp - 8]
cmp eax, 8
jne 0x10002e63
mov eax, dword [ebx + 0x50c]
mov esi, dword [eax + 0x18]
call fcn.100130d0
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x10002ef5
test esi, esi
jbe 0x10002ef5
test eax, eax
jl 0x10002ef5
push 0
push 3
jmp 0x10002ee9
cmp eax, 0xd
jne 0x10002e8e
mov eax, dword [ebx + 4]
push 0
push 2
push 0x469
push eax
call dword [0x100a83e8]
mov ecx, dword [ebx + 0x508]
mov edx, dword [ecx]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10002ef5
mov eax, dword [ebx + 0x50c]
mov ecx, dword [eax + 0x18]
inc ecx
cmp ecx, dword [ebx + 0x4f8]
jbe 0x10002ea7
mov eax, 0xe0010008
jmp 0x10002ec9
lea eax, [ebp - 8]
call fcn.10003700
test eax, eax
jl 0x10002ec9
mov eax, dword [ebx + 0x50c]
lea edx, [ebp - 8]
push edx
push eax
call fcn.10012fa0
test eax, eax
jl 0x10002ec9
xor eax, eax
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x10002ef5
test eax, eax
jl 0x10002eda
push 0
push 3
jmp 0x10002ee9
test ecx, ecx
je 0x10002ef5
cmp eax, 0xe0010008
je 0x10002ef5
push 0
push 4
push 0x469
push ecx
call dword [0x100a83e8]
cmp dword [ebx + 0x528], 0
jne 0x10002f16
mov ecx, dword [ebx + 4]
push 0
push 0
push ecx
call dword [0x100a83b0]
mov edx, dword [ebx + 4]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.1002e502
mov esp, ebp
pop ebp
ret
Function at 0x10003f20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, eax
cmp dword [esi + 0x9c], 0
jne 0x10003fe4
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x10003fb1
cmp dword [esi + 0x10], 1
jne 0x10003fb1
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
cmp eax, 1
jne 0x10003fb1
mov eax, dword [esi + 0x8c]
test eax, eax
jne 0x10003f6b
call fcn.10001500
pop esi
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, 1
jne 0x10003fe4
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp dword [esi + 0x2c], eax
jne 0x10003f95
cmp dword [esi + 0x30], ecx
je 0x10003fe4
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], ecx
call fcn.10001620
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x10003fe4
lea edx, [esi + 0x5c]
push edx
push 0
push 0x433
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x8c]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 0x8c], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006070
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x4c]
xor al, al
cmp ecx, 0xffffffff
je 0x100061e5
cmp ecx, 0x7c
je 0x100061e5
xor esi, esi
cmp ecx, 0x29
jne 0x100060b5
cmp dword [edi + 0x1c], esi
jne 0x100061e5
mov eax, sym.SecEditCtlAdv.CMBCEnterprise.x86.dll_X4__A_I.2_c3.av75o__e_iHv9M0sVz
test dword [edi + 0x50], eax
jne 0x100060ba
push 5
call fcn.1009e985
add esp, 4
jmp 0x100061d0
mov eax, sym.SecEditCtlAdv.CMBCEnterprise.x86.dll_X4__A_I.2_c3.av75o__e_iHv9M0sVz
cmp ecx, 0x2e
jne 0x10006118
push 0x14
call fcn.1002ea4a
add esp, 4
cmp eax, esi
je 0x100060e5
mov dword [eax], vtable.std::tr1::_Node_base.0
mov dword [eax + 4], 5
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
jmp 0x100060e7
xor eax, eax
mov ecx, dword [edi + 0x28]
mov dword [eax + 0x10], ecx
mov edx, dword [edi + 0x28]
mov ecx, dword [edx + 0xc]
cmp ecx, esi
je 0x10006103
mov dword [eax + 0xc], ecx
mov ecx, dword [edi + 0x28]
mov edx, dword [ecx + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [edi + 0x28]
mov dword [ecx + 0xc], eax
mov dword [edi + 0x28], eax
mov eax, edi
call fcn.10005fc0
jmp 0x100061d0
cmp ecx, 0x5c
jne 0x10006176
mov eax, edi
call fcn.10005fc0
mov eax, dword [edi + 0x50]
and eax, 0x80
je 0x10006148
cmp byte [edi + 0x4a], 0x62
jne 0x10006148
lea esi, [edi + 0x24]
call fcn.10007470
mov eax, edi
call fcn.10005fc0
jmp 0x100061d7
cmp eax, esi
je 0x1000616d
cmp byte [edi + 0x4a], 0x42
jne 0x1000616d
lea esi, [edi + 0x24]
call fcn.10007470
mov eax, dword [edi + 0x28]
or dword [eax + 8], 1
add eax, 8
mov eax, edi
call fcn.10005fc0
jmp 0x100061d7
mov eax, edi
call fcn.10007180
jmp 0x100061d0
cmp ecx, 0x5b
jne 0x100061a0
mov eax, edi
call fcn.10005fc0
call fcn.10007110
cmp dword [edi + 0x4c], 0x5d
je 0x10006197
push 4
call fcn.1009e985
add esp, 4
mov eax, edi
call fcn.10005fc0
jmp 0x100061d0
cmp ecx, 0x28
jne 0x100061e9
mov eax, edi
call fcn.10005fc0
mov eax, edi
call fcn.10007230
cmp dword [edi + 0x4c], 0x29
mov bl, al
je 0x100061c5
push 5
call fcn.1009e985
add esp, 4
mov eax, edi
call fcn.10005fc0
test bl, bl
je 0x100061d7
mov eax, edi
call fcn.100072e0
mov ecx, dword [edi + 0x4c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x10006083
pop edi
pop esi
pop ebx
ret
cmp ecx, 0x5e
jne 0x100061ff
lea esi, [edi + 0x24]
call fcn.100073d0
mov eax, edi
call fcn.10005fc0
jmp 0x100061d7
cmp ecx, 0x24
jne 0x10006215
lea esi, [edi + 0x24]
call fcn.10007420
mov eax, edi
call fcn.10005fc0
jmp 0x100061d7
cmp ecx, 0x2a
je 0x10006271
cmp ecx, 0x2b
je 0x10006271
cmp ecx, 0x3f
je 0x10006271
cmp ecx, 0x7b
je 0x10006271
cmp ecx, 0x7d
jne 0x1000623f
test dword [edi + 0x50], eax
jne 0x1000623f
push 6
call fcn.1009e985
add esp, 4
jmp 0x100061d0
cmp ecx, 0x5d
jne 0x10006258
test dword [edi + 0x50], eax
jne 0x10006258
push 4
call fcn.1009e985
add esp, 4
jmp 0x100061d0
movzx edx, byte [edi + 0x4a]
push edx
lea eax, [edi + 0x24]
call fcn.100074c0
mov eax, edi
call fcn.10005fc0
jmp 0x100061d0
push 0xa
call fcn.1009e985
add esp, 4
jmp 0x100061d0
Function at 0x1000c180
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push edi
cmp dword [0x100e1628], esi
jne 0x1000c1be
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1000c1b4
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
adc byte [eax - 0x44], ch
pop ss
or eax, 0x6415ff10
pop edx
movsb byte es:[edi], byte [esi]
adc byte [ebx + 0x100e1624], ah
mov dword [0x100e1628], 1
mov eax, dword [0x100e1624]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000c1da
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1000c216
mov edx, dword [ebp + 8]
mov eax, dword [edx]
test eax, eax
jne 0x1000c209
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x1000c1f8
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
push eax
call ecx
jmp 0x1000c200
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
push edx
call eax
test eax, eax
je 0x1000c216
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
push edx
push eax
call edi
pop edi
pop esi
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x1000c4d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a66e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x100db690]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
cmp edi, esi
je 0x1000c526
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1000c510
sub eax, edx
sar eax, 1
je 0x1000c526
cmp dword [ebp + 8], esi
jne 0x1000c53c
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp ebx, esi
je 0x1000c526
lea eax, [ebp - 0x10]
push eax
push 0x100d0bf4
push 1
push esi
push 0x100d0cc4
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x1000c622
cmp dword [ebp - 0x10], esi
je 0x1000c618
lea ecx, [ebp - 0x18]
push ecx
call fcn.1000c3e0
mov dword [ebp - 4], esi
mov eax, dword [eax]
cmp eax, esi
je 0x1000c57e
mov ecx, dword [eax]
jmp 0x1000c580
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
lea edi, [ebp - 0x14]
push edi
push esi
push esi
push esi
push esi
push esi
push esi
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [ebp - 0x18]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.1000c480
mov eax, dword [ebp - 0x14]
test esi, esi
jl 0x1000c5f1
test eax, eax
je 0x1000c5ed
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jl 0x1000c63f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
mov dword [edx], ecx
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1000c5f5
mov eax, esi
jmp 0x1000c5fb
call dword [0x100a8200]
test eax, 0x20000000
je 0x1000c612
test eax, eax
jle 0x1000c63d
and eax, 0xffff
or eax, 0xa0070000
jmp 0x1000c63d
test eax, eax
jg 0x1000c633
jmp 0x1000c63d
cmp eax, esi
jne 0x1000c622
call dword [0x100a8200]
test eax, 0x20000000
je 0x1000c62f
cmp eax, esi
jg 0x1000c606
jmp 0x1000c63d
cmp eax, esi
jle 0x1000c63d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1000c655
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x1000c664
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000cd40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
mov eax, dword [0x100db690]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x206
lea ecx, [ebp - 0x616]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x620], ebx
mov dword [ebp - 0x61c], ebx
mov word [ebp - 0x618], ax
call fcn.1002e520
push 0x206
lea eax, [ebp - 0x40e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x410], dx
call fcn.1002e520
push 0xfe
lea edx, [ebp - 0x102]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x104], cx
call fcn.1002e520
push 0x103
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call fcn.1002e520
add esp, 0x30
lea ecx, [ebp - 0x620]
push ecx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x62c], 0x104
mov dword [ebp - 0x624], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1000ce16
call dword [0x100a8200]
jmp 0x1000cfe1
mov ecx, dword [ebp - 0x620]
push edi
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x410]
push eax
push ebx
push ecx
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000cfe0
Function at 0x1000d940
Capabilities:
Get local ipv4 addresses
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x100db690]
xor eax, esp
mov dword [esp + 0x1a8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x3c00
xor esi, esi
test ebx, ebx
je 0x1000d981
push ebx
call fcn.1002e59a
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call fcn.1002e03d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000da43
mov edx, dword [esp + 0x14]
push edx
push 0
push ebx
call fcn.1002e520
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push ebx
push 0
push 0xc
push 0
inc esi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
cmp eax, 0x6f
jne 0x1000d9c4
cmp esi, 3
jb 0x1000d974
lea ecx, [esp + 0x20]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1000da1d
call dword [0x100a8200]
test eax, 0x20000000
je 0x1000da01
test eax, eax
jg 0x1000d9f0
mov esi, eax
jmp 0x1000daf0
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
jmp 0x1000daf0
test eax, eax
jg 0x1000da0c
mov esi, eax
jmp 0x1000daf0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1000daf0
xor ecx, ecx
mov eax, 0x400
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002e03d
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x1000da4d
mov esi, 0x8007000e
jmp 0x1000daf0
push 0x800
push 0
push eax
call fcn.1002e520
add esp, 0xc
mov edi, ebx
nop
cmp dword [edi + 0x34], 0
jbe 0x1000da71
cmp dword [esp + 0x10], 0
jne 0x1000da71
mov dword [esp + 0x10], edi
mov esi, dword [edi + 0xc]
call fcn.1000cd40
test eax, eax
je 0x1000dab0
cmp dword [edi + 0x34], 0
je 0x1000dab0
mov esi, dword [esp + 0xc]
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000da90
sub eax, edx
sar eax, 1
add eax, 0x41
cmp eax, 0x400
ja 0x1000dabb
mov ecx, edi
call fcn.1000d6a0
mov edi, dword [edi + 8]
test edi, edi
jne 0x1000da60
mov esi, dword [esp + 0xc]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000dac0
sub eax, edx
sar eax, 1
jne 0x1000dae2
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1000dae2
call fcn.1000d6a0
mov esi, dword [esp + 0xc]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [esp + 0x18]
mov dword [eax], esi
xor esi, esi
test ebx, ebx
je 0x1000dafd
push ebx
call fcn.1002e59a
add esp, 4
mov ecx, dword [esp + 0x1b4]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1002e502
mov esp, ebp
pop ebp
ret
Function at 0x1000f120
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x100db690]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x8c]
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSet_serviceskbdssvc
mov ebx, 4
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x118], esi
invalid
invalid
invalid
pop esp
movsb byte es:[edi], byte [esi]
Function at 0x1000f420
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100db690]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0xfe
push eax
lea ecx, [ebp - 0x102]
push ecx
mov word [ebp - 0x104], ax
call fcn.1002e520
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
push 0
push 0
push 1
push 0
call esi
mov dword [edi + 4], eax
test eax, eax
jne 0x1000f4a1
call dword [0x100a8200]
test eax, 0x20000000
je 0x1000f492
test eax, eax
jg 0x1000f481
mov esi, eax
jmp 0x1000f5cf
and eax, 0xffff
or eax, 0xa0070000
mov esi, eax
jmp 0x1000f5cf
test eax, eax
jg 0x1000f5fd
mov esi, eax
jmp 0x1000f5cf
push 0
push 0
push 1
push 0
call esi
mov dword [edi + 8], eax
test eax, eax
je 0x1000f469
mov edx, dword [edi + 0x34]
push edx
push str.EC7958E2DA87
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call fcn.1002e475
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 1
push 0
call esi
mov dword [edi + 0xc], eax
test eax, eax
je 0x1000f469
mov edx, dword [edi + 0x34]
push edx
push str.79D469D3016B
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call fcn.1002e475
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 1
push 0
call esi
mov dword [edi + 0x10], eax
test eax, eax
je 0x1000f469
mov edx, dword [edi + 0x34]
push edx
push str.0F83D85D15FE
push str.Global_ws__08X
lea eax, [ebp - 0x104]
push pe_nt_image_headers32
push eax
call fcn.1002e475
add esp, 0x14
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
push 0
call esi
mov dword [edi + 0x14], eax
test eax, eax
je 0x1000f469
push str.C465B7B6_1460_42d1_BACD_3B221F33F532
push 0
push 1
push 0
call esi
mov dword [edi + 0x18], eax
test eax, eax
je 0x1000f469
push str.5DF82EFD_5306_4b45_BAF2_4EFB1505F321
push 0
push 1
push 0
call esi
mov dword [edi + 0x1c], eax
test eax, eax
je 0x1000f469
push 0
push 0
push edi
push 0x1000f700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi], eax
test eax, eax
je 0x1000f469
mov edx, dword [edi + 8]
push 0x7530
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x80070102
cmp dword [edi + 0x2c], 0
jne 0x1000f5ec
test esi, esi
jge 0x1000f5ec
mov eax, dword [edi + 0x28]
push 0
push 0
push 0x466
push eax
call dword [0x100a83e8]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002e502
mov esp, ebp
pop ebp
ret
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1000f5cf
Function at 0x1000f610
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esi + 0x2c], 1
jne 0x1000f6a5
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1000f62f
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x20], 0
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExW]
push eax
push 0x1000fa80
push 0xd
call ebx
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1000f665
push eax
push eax
mov eax, dword [esi + 0x28]
push 0x466
push eax
call dword [0x100a83e8]
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1000f67a
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x24], 0
push 0
push 0
call edi
push eax
push 0x1000fc20
push 0xd
call ebx
pop edi
mov dword [esi + 0x24], eax
pop ebx
test eax, eax
jne 0x1000f6af
mov ecx, dword [esi + 0x28]
push eax
push eax
push 0x466
push ecx
call dword [0x100a83e8]
ret
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
ret

Function at 0x1000f6b0
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esi + 0x2c], 1
jne 0x1000f6fb
mov eax, dword [esi + 0x24]
test eax, eax
je 0x1000f6cb
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 0x24], 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0x1000fc20
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x24], eax
test eax, eax
jne 0x1000f6fb
push eax
push eax
mov eax, dword [esi + 0x28]
push 0x466
push eax
call dword [0x100a83e8]
ret

Function at 0x1000ff20
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
call fcn.1002ed75
cdq
mov ecx, 0x3a
idiv ecx
push 2
mov al, byte [edx + 0x100de104]
movzx edx, al
push edx
mov byte [esi + 0x3c], al
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
push 0
mov byte [ebp - 4], al
movzx eax, byte [esi + 0x3c]
mov edi, dword [ebp - 4]
push 0
push edi
push eax
call ebx
movzx ecx, byte [esi + 0x3c]
push 0
push 2
push edi
push ecx
call ebx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret