joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019e13a
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
lea ebp, [esp - 0xa4]
sub esp, 0x124
mov eax, dword [0x1023904c]
xor eax, ebp
mov dword [ebp + 0xa0], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x58]
push edi
test eax, eax
je 0x1019e21b
cmp dword [eax + 0x20], 0xffffffff
jne 0x1019e1ea
xor ebx, ebx
push ebx
push ebx
push 0x474
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
test edi, edi
je 0x1019e21b
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x1019e21b
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], 0x100
mov dword [ebp - 0x78], 9
mov dword [ebp - 0x74], 1
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
and byte [ebp - 0x50], 0x7f
and byte [ebp - 0x4f], 0x7f
and byte [ebp - 0x4e], 0x7f
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.1019db40
jmp 0x1019e21b
mov eax, dword [esi + 0x30]
and dword [ebp - 0x64], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x64]
push edx
push 0x1019e234
push eax
call dword [ecx]
test eax, eax
js 0x1019e21b
mov eax, dword [esi + 0x58]
mov ecx, dword [ebp - 0x64]
push dword [eax + 0x20]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x38]
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0xa0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001e57
add ebp, 0xa4
leave
ret

Function at 0x1019f5b9
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push esi
mov esi, dword [esp + 8]
mov al, byte [esi]
push edi
xor edi, edi
mov ecx, esi
mov edx, edi
cmp al, 0x5c
je 0x1019f639
push ebx
or ebx, 0xffffffff
sub ebx, esi
test al, al
je 0x1019f638
cmp al, 0x2e
jne 0x1019f5fa
test edx, edx
jne 0x1019f5f3
lea eax, [ebx + 1]
add eax, ecx
cmp eax, 8
ja 0x1019f5f3
cmp ecx, esi
jne 0x1019f5f6
cmp byte [ecx + 1], 0x5c
je 0x1019f5f6
xor edi, edi
inc edi
mov edx, ecx
jmp 0x1019f631
cmp al, 0x20
jle 0x1019f62e
cmp al, 0x2a
je 0x1019f62e
cmp al, 0x2b
je 0x1019f62e
cmp al, 0x2c
je 0x1019f62e
cmp al, 0x3a
je 0x1019f62e
cmp al, 0x3b
je 0x1019f62e
cmp al, 0x3c
je 0x1019f62e
cmp al, 0x3d
je 0x1019f62e
cmp al, 0x3e
je 0x1019f62e
cmp al, 0x3f
je 0x1019f62e
cmp al, 0x5b
je 0x1019f62e
cmp al, 0x5d
je 0x1019f62e
cmp al, 0x7c
jne 0x1019f631
xor edi, edi
inc edi
inc ecx
mov al, byte [ecx]
cmp al, 0x5c
jne 0x1019f5d3
pop ebx
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
mov eax, ecx
sub eax, esi
test eax, eax
jle 0x1019f654
test edi, edi
jne 0x1019f654
test edx, edx
jne 0x1019f65c
cmp eax, 8
jbe 0x1019f668
xor eax, eax
inc eax
pop edi
pop esi
ret 8
sub ecx, edx
cmp ecx, 4
ja 0x1019f654
cmp eax, 0xc
ja 0x1019f654
xor eax, eax
jmp 0x1019f657
Function at 0x101a0c2a
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push edi
push dword [0x1024352c]
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x101a0cfd
mov edi, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push 0x10
call edi
mov esi, eax
test esi, esi
jne 0x101a0c62
push 0
call fcn.101a0afd
xor eax, eax
jmp 0x101a0cff
push 0x20
call edi
mov edx, eax
test edx, edx
jne 0x101a0c75
push esi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x101a0c54
push ebx
push 8
pop ecx
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esi], edx
mov dword [esi + 4], edx
xor ebx, ebx
mov dword [esi + 0xc], ebx
and dword [edx + 0x14], 0xfffffffc
or dword [edx + 0xc], 0xffffffff
mov edi, 0x102448a8
push edi
mov dword [edx + 8], ebx
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10244898]
push edi
mov dword [esi + 8], eax
mov dword [0x10244898], esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
push esi
push dword [0x1024352c]
call dword [sym.imp.kernel32.dll_TlsSetValue]
cmp byte [0x10239d50], bl
je 0x101a0ceb
push ebx
jmp 0x101a0ce0
test byte [edi + 4], 8
je 0x101a0cdf
mov ecx, dword [edi + 8]
mov eax, dword [ecx]
push ebx
push 1
push ecx
call dword [eax + 0x10]
push edi
call fcn.101a0aa9
mov edi, eax
test edi, edi
jne 0x101a0ccd
push 1
push 1
push ebx
push ebx
push 0xfffffffffffffffe
push 0xfffffffffffffffa
push 1
call fcn.101a0b38
pop ebx
mov eax, esi
pop edi
pop esi
ret
Function at 0x101a0d66
Capabilities:
Get common file path

Disassembly:
sub esp, 0x818
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x814], eax
push ebp
xor ebp, ebp
cmp dword [ebx + 4], ebp
jne 0x101a0f0b
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
push esi
mov esi, dword [eax + 8]
movzx eax, word [ecx + 2]
mov dword [esp + 8], ebp
test esi, esi
je 0x101a0f0a
push edi
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
cmp edi, eax
jae 0x101a0f09
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
call dword [eax + 0x10]
test eax, eax
js 0x101a0f09
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
call fcn.100d14e1
test eax, eax
js 0x101a0eff
mov eax, dword [esi]
push ebp
push ebp
push ebp
lea ecx, [esp + 0x24]
push ecx
push 0xffffffffffffffff
push esi
mov dword [esp + 0x28], ebp
call dword [eax + 0x24]
test eax, eax
js 0x101a0eff
mov esi, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push ebp
push ebp
push 0x200
lea eax, [esp + 0x42c]
push eax
push 0xffffffffffffffff
push dword [esp + 0x2c]
push ebp
push ebp
call esi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
je 0x101a0ef9
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ebp
push ebp
push ebp
lea edx, [esp + 0x20]
push edx
push 0xffffffffffffffff
push eax
call dword [ecx + 0x30]
test eax, eax
js 0x101a0ef9
push ebp
push ebp
push 0x200
lea eax, [esp + 0x22c]
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
push ebp
push ebp
call esi
test eax, eax
je 0x101a0ef3
lea eax, [esp + 0x620]
push eax
mov ebp, 0x200
push ebp
call dword [sym.imp.kernel32.dll_GetTempPathA]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x62c]
push eax
push 0x101a0f24
lea eax, [esp + 0x34]
push ebp
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x1c
lea eax, [esp + 0x20]
push eax
call fcn.1001b517
mov esi, eax
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.101b7181
push esi
call sub.OLEAUT32.dll_SysStringLen
cmp dword [esp + 0x10], 0
je 0x101a0ef3
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
call fcn.1015692e
test eax, eax
js 0x101a0eed
lea eax, [esp + 0x20]
push eax
call fcn.101a0aca
mov dword [ebx + 4], eax
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push dword [esp + 0x18]
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
mov ecx, dword [esp + 0x818]
pop ebp
xor ecx, esp
call fcn.10001e57
add esp, 0x818
ret
Function at 0x101a1886
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebp
push esi
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
push esi
xor ebp, ebp
push ebx
mov dword [0x10241004], esi
mov dword [esp + 0x30], 0x200
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x101a1a21
push edi
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101a1a20
lea eax, [esp + 0x28]
push eax
push 0x101a1a50
lea eax, [esp + 0x230]
push 0x200
push eax
call dword [sym.imp.msvcr100.dll_sprintf_s]
add esp, 0x10
push esi
push esi
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x101a1963
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push esi
push 0x101a1a5c
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a19e9
cmp dword [esp + 0x20], 4
jne 0x101a19e9
cmp dword [esp + 0x1c], eax
je 0x101a19e9
push 0x10
call fcn.1000ac41
mov esi, eax
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
push ecx
mov dword [esi + 8], ecx
mov edi, dword [esp + 0x1c]
push 0x100bd64c
push edi
mov dword [esp + 0x28], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a19e1
cmp dword [esp + 0x18], 1
jne 0x101a19cc
push dword [esp + 0x10]
call fcn.1000ac41
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esi], eax
lea eax, [esp + 0x20]
push eax
push 0
push 0x100bd64c
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a19e1
cmp dword [esi], 0
je 0x101a19e1
mov eax, dword [0x10241004]
mov dword [esi + 0xc], eax
mov dword [0x10241004], esi
jmp 0x101a19e7
push esi
call fcn.1000ac28
xor esi, esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x3c]
mov eax, ebp
push ecx
push eax
push ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], 0x200
inc ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x101a18ce
pop edi
mov esi, dword [0x10241004]
jmp 0x101a1a32
push esi
call fcn.1015692e
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x101a1a29
mov ecx, dword [esp + 0x424]
pop esi
pop ebp
xor ecx, esp
call fcn.10001e57
add esp, 0x420
ret
Function at 0x101a4c13
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xac
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0xb4]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
mov ebp, dword [esp + 0xc0]
mov dword [esp + 0x18], eax
xor eax, eax
push esi
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 1
mov dword [esp + 0x2c], 0xeffc001
call dword [sym.imp.ole32.dll_CoGetMalloc]
mov esi, eax
test esi, esi
js 0x101a4db1
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push edi
call dword [eax + 0x2c]
mov esi, eax
test esi, esi
js 0x101a4db1
jne 0x101a4db1
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x2c]
push edx
push 1
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x101a4db1
cmp dword [esp + 0x2c], 2
jne 0x101a4d30
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
push esi
push 0x10
push esi
push dword [esp + 0x38]
push edi
call dword [eax + 0x10]
mov esi, eax
test esi, esi
js 0x101a4db1
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push 0
lea edx, [esp + 0x74]
push edx
push eax
call dword [ecx + 0x30]
mov esi, eax
test esi, esi
js 0x101a4db1
push ebx
push ebp
lea eax, [esp + 0x78]
push eax
call fcn.101a4b83
mov esi, eax
test esi, esi
js 0x101a4db1
push ebx
push dword [esp + 0x20]
call dword [esp + 0x28]
mov eax, dword [esp + 0x10]
push dword [esp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
and dword [esp + 0x70], 0
mov eax, dword [esp + 0x1c]
jmp 0x101a4d8e
cmp dword [esp + 0x2c], 1
jne 0x101a4d94
mov eax, dword [edi]
xor edx, edx
lea ecx, [esp + 0x18]
push ecx
push edx
push edx
push 0x10
push edx
push dword [esp + 0x3c]
mov dword [esp + 0x30], edx
push edi
call dword [eax + 0x18]
mov esi, eax
test esi, esi
js 0x101a4db1
push ebx
push ebp
lea eax, [esp + 0x30]
push eax
call fcn.101a4b83
mov esi, eax
test esi, esi
js 0x101a4db1
push ebx
push ebp
push dword [esp + 0x28]
push dword [esp + 0x24]
call fcn.101a4c13
mov esi, eax
test esi, esi
js 0x101a4db1
push ebx
push 4
lea eax, [esp + 0x2c]
push eax
call ebp
mov eax, dword [esp + 0x18]
xor esi, esi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
push dword [esp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
xor edx, edx
mov dword [esp + 0x28], edx
test esi, esi
jne 0x101a4db5
jmp 0x101a4c9c
mov edx, dword [esp + 0x28]
test edx, edx
je 0x101a4dc4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
cmp dword [esp + 0x70], 0
je 0x101a4dd9
mov eax, dword [esp + 0x10]
push dword [esp + 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x101a4dec
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
and dword [esp + 0x10], 0
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x101a4dfa
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esp + 0xb8]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0xac
ret 0x10
Function at 0x101a6343
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1000c1a4
mov ecx, dword [eax + 0xd0]
jmp fcn.101a66aa
Function at 0x101a9240
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x278
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
push 1
call dword [0x10244b68]
mov edi, dword [0x10239f7c]
mov ebp, dword [sym.imp.USER32.dll_GetKeyboardState]
sub edi, dword [0x10239f78]
mov esi, eax
lea eax, [esp + 0x84]
push eax
mov dword [esp + 0x14], esi
call ebp
xor eax, eax
inc eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x68], eax
xor eax, eax
xor edx, edx
mov word [esp + 0x6c], ax
mov eax, dword [0x10239f78]
mov ebx, edx
mov dword [esp + 0x70], 6
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x78], edx
mov dword [esp + 0x74], edx
cmp eax, dword [0x10239f7c]
jge 0x101a935b
mov ecx, eax
shl ecx, 4
add ecx, dword [0x10239f70]
inc eax
mov dword [esp + 0x54], edx
cmp dword [ecx], 0x102
mov dword [0x10239f78], eax
jne 0x101a9304
xor esi, esi
inc esi
xor eax, eax
mov word [esp + 0x50], ax
mov ax, word [ecx + 4]
mov word [esp + 0x52], ax
mov dword [esp + 0x54], 4
mov ax, word [ecx + 4]
mov word [esp + 0x6e], ax
jmp 0x101a932e
xor eax, eax
mov word [esp + 0x52], ax
cmp dword [ecx], 0x101
mov esi, edx
je 0x101a931d
cmp dword [ecx], 0x105
jne 0x101a9325
mov dword [esp + 0x54], 2
mov ax, word [ecx + 4]
mov word [esp + 0x50], ax
push 0x1c
lea eax, [esp + 0x50]
push eax
lea eax, [esi + 1]
push eax
call dword [0x10244b64]
sub eax, esi
add ebx, eax
mov eax, dword [0x10239f78]
push 0
pop edx
cmp eax, dword [0x10239f7c]
jl 0x101a92c1
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x184]
push eax
call ebp
push 0x34
xor ebp, ebp
lea eax, [esp + 0x1c]
push ebp
push eax
call sub.msvcr100.dll_memset
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], eax
mov al, byte [esp + 0xa4]
add esp, 0xc
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x38], 2
cmp al, byte [esp + 0x198]
je 0x101a93ba
push 0x14
pop eax
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10244b64]
mov al, byte [esp + 0x114]
cmp al, byte [esp + 0x214]
je 0x101a93e8
mov eax, 0x90
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10244b64]
mov al, byte [esp + 0x115]
cmp al, byte [esp + 0x215]
je 0x101a9416
mov eax, 0x91
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10244b64]
mov ax, word [0x1023a238]
mov ecx, 0x3ff
and ax, cx
push 0x11
pop ecx
cmp ax, cx
jne 0x101a9458
mov al, byte [esp + 0x99]
cmp al, byte [esp + 0x199]
je 0x101a9458
push 0x15
pop eax
mov word [esp + 0x18], ax
mov word [esp + 0x34], ax
push 0x1c
lea eax, [esp + 0x18]
push eax
push 2
call dword [0x10244b64]
mov dword [0x10239f68], 1
mov dword [0x10239f78], ebp
mov dword [0x10239f7c], ebp
mov dword [0x10239f64], ebp
test esi, esi
je 0x101a947f
push ebp
call dword [0x10244b68]
cmp ebx, edi
pop edi
pop esi
pop ebp
pop ebx
je 0x101a9494
call dword [sym.imp.kernel32.dll_GetLastError]
push 0x11
call fcn.10089e37
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.10001e57
add esp, 0x278
ret
Function at 0x101aa583
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [0x1023d02c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x101aa5a1
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101aa5a8
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [esp + 0xc]
push 1
push 0
push dword [esp + 0x14]
push dword [0x1023d02c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x101ce11f
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 4
call ebx
push 2
movsx esi, ax
call ebx
movsx edi, ax
push 1
or edi, esi
call ebx
cwde
or eax, edi
pop edi
pop esi
and eax, 0x8000000
pop ebx
ret
Function at 0x101cf260
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, dword [sym.imp.kernel32.dll_HeapCreate]
push edi
mov edi, ecx
push ebp
push 0x1000
lea ebx, [edi + 0x40]
push 1
mov dword [edi + 0xc], ebp
mov dword [edi + 0x14], eax
mov dword [edi + 0x2c], ebp
mov dword [edi + 0x28], ebp
mov dword [edi + 0x30], ebp
mov dword [edi + 0x34], ebp
mov dword [edi + 0x38], ebp
mov dword [edi + 0x3c], ebp
mov dword [ebx], ebp
mov dword [edi + 0x44], ebp
mov dword [edi + 0x48], ebp
mov dword [edi + 0x50], ebp
mov dword [edi + 0x54], ebp
mov dword [edi + 0x5c], ebp
mov dword [edi + 0x60], ebp
mov dword [edi + 0xc08], ebp
mov dword [edi + 0xc0c], ebp
mov dword [edi + 0xc10], ebp
mov dword [edi + 0xc14], ebp
mov dword [edi + 0xc18], ebp
mov dword [edi + 0xc1c], ebp
mov dword [edi + 0xc20], ebp
mov dword [edi + 0xc24], ebp
mov dword [edi + 0xc28], ebp
mov dword [edi + 0xc2c], ebp
mov dword [edi + 0xc30], ebp
mov dword [edi + 0xc34], ebp
call esi
push ebp
push 0x2000
push 1
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x18], eax
cmp dword [edi + 0x10], ebp
je 0x101cf42f
test eax, eax
je 0x101cf42f
mov esi, dword [sym.imp.kernel32.dll_HeapAlloc]
push 1
push 8
push dword [edi + 0x10]
call esi
mov dword [edi + 0x58], eax
test eax, eax
je 0x101cf42f
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
push ebp
push 2
push ebp
push dword [esp + 0x2c]
call fcn.100fcbe0
push ebp
push 0x400
push ebp
push dword [esp + 0x2c]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], edx
call fcn.100fcbe0
cmp edx, ebp
jl 0x101cf37f
mov ecx, 0xfff0
jg 0x101cf379
cmp eax, ecx
jb 0x101cf37f
mov dword [esp + 0x14], ebp
jmp 0x101cf385
mov ecx, eax
mov dword [esp + 0x14], edx
push ebx
push ebp
push 0x4001012
push ebp
mov dword [edi + 0x1c], ecx
call dword [sym.imp.ole32.dll_StgCreateDocfile]
test eax, eax
jns 0x101cf3a5
push eax
call fcn.1000b028
jmp 0x101cf432
push 0x64
push 8
push dword [edi + 0x10]
call esi
mov dword [edi + 0x30], eax
test eax, eax
je 0x101cf42f
push ebp
push ebp
push 2
push ebp
push dword [edi + 0x10]
lea ecx, [edi + 0x64]
mov dword [edi + 0x2c], 0x19
call fcn.1015692e
push ebp
push ebp
push 2
push 2
push dword [edi + 0x10]
lea ecx, [edi + 0x254]
call fcn.1015692e
xor ebx, ebx
inc ebx
push ebx
push ebx
push ebx
push ebp
push dword [edi + 0x10]
lea ecx, [edi + 0x444]
call fcn.1015692e
push ebx
push ebx
push ebx
push ebp
push dword [edi + 0x10]
lea ecx, [edi + 0x634]
call fcn.1015692e
push ebx
push ebx
push ebx
push ebp
push dword [edi + 0x10]
lea ecx, [edi + 0x824]
call fcn.1015692e
push ebp
push ebp
push ebx
push ebp
push dword [edi + 0x10]
lea ecx, [edi + 0xa14]
call fcn.1015692e
xor eax, eax
jmp 0x101cf432
push 7
pop eax
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x2c
ret 4
Function at 0x101cf610
Capabilities:
Delete file

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x38]
mov dword [edi], 0x100f0aac
test esi, esi
je 0x101cf661
push ebx
mov ebx, SysReAllocString
test dword [esi], 0x50000000
je 0x101cf64c
test dword [esi], 0x40000000
je 0x101cf64c
test dword [esi], 0x20000000
je 0x101cf659
push dword [esi + 8]
call dword [sym.imp.kernel32.dll_DeleteFileA]
jmp 0x101cf659
test dword [esi], ebx
je 0x101cf659
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [esi + 0x10]
test esi, esi
jne 0x101cf629
pop ebx
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x101cf676
mov esi, dword [eax]
push eax
call fcn.1000ac28
mov eax, esi
test esi, esi
jne 0x101cf668
mov ecx, dword [edi + 0x40]
test ecx, ecx
je 0x101cf683
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [edi + 0x10], 0
mov esi, dword [sym.imp.kernel32.dll_HeapDestroy]
je 0x101cf694
push dword [edi + 0x10]
call esi
cmp dword [edi + 0x18], 0
je 0x101cf69f
push dword [edi + 0x18]
call esi
xor esi, esi
cmp dword [edi + 8], esi
je 0x101cf6c4
cmp dword [edi + 4], esi
jbe 0x101cf6bc
mov eax, dword [edi + 8]
push dword [eax + esi*4]
call fcn.1000ac28
inc esi
cmp esi, dword [edi + 4]
jb 0x101cf6ab
push dword [edi + 8]
call fcn.1000ac28
pop edi
pop esi
ret
Function at 0x101d1514
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0xe4
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xec]
and dword [esp + 0x10], 0
push ebp
mov ebp, dword [esp + 0xec]
push esi
push edi
push 0x44
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x100]
pop esi
push esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x2c], 1
call sub.msvcr100.dll_memset
add esp, 0xc
push 0xffffffffffffffff
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 3
push SysReAllocString
push 0x101d16b8
mov dword [esp + 0x4c], esi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x101d15b7
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jle 0x101d169d
and eax, 0xffff
or eax, 0x80070000
jmp 0x101d169d
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push 2
push 1
push 2
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push eax
call dword [sym.imp.kernel32.dll_DuplicateHandle]
test eax, eax
jne 0x101d15de
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x101d159a
push dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
xor eax, eax
mov word [esp + 0x64], ax
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x1c]
xor ecx, ecx
push ecx
push 0x8000000
push 1
push ecx
push ecx
push ebp
push ebx
mov dword [esp + 0x84], 0x101
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
push esi
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, eax
call esi
push dword [esp + 0xc]
call esi
test edi, edi
je 0x101d1644
xor eax, eax
jmp 0x101d169d
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101d1649
push 1
sub ecx, edx
xor ebp, ebp
push ebp
lea edi, [ecx + 1]
lea eax, [esp + 0x7c]
push eax
lea eax, [edi + edi]
push eax
push ebp
push 0x78
lea ecx, [esp + 0x3c]
call fcn.1015692e
mov esi, dword [esp + 0x28]
test esi, esi
je 0x101d1683
push edi
push esi
push edi
push ebx
push ebp
push ebp
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push ebp
push esi
push 0xe357
call fcn.101a7e33
lea ecx, [esp + 0x24]
call fcn.1000cead
mov eax, 0x800ae357
mov ecx, dword [esp + 0xec]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10001e57
add esp, 0xe4
ret 0xc