joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f30c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 4
mov eax, 0x1008558f
call fcn.100839c0
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.page11.0
lea ecx, [esi + 0x1488]
mov dword [ebp - 4], 0x27
call fcn.100012f7
mov byte [ebp - 4], 0x26
mov edi, dword [sym.imp.mfc100.dll_Ordinal_915]
lea ecx, [esi + 0x1414]
call edi
lea ecx, [esi + 0x138c]
mov byte [ebp - 4], 0x25
call fcn.10004f8a
lea ecx, [esi + 0x1308]
mov byte [ebp - 4], 0x24
call fcn.10004f8a
lea ecx, [esi + 0x125c]
mov byte [ebp - 4], 0x23
call fcn.10001ae5
lea ecx, [esi + 0x11b0]
mov byte [ebp - 4], 0x22
call fcn.10001ae5
lea ecx, [esi + 0x1124]
mov byte [ebp - 4], 0x21
call fcn.100012f7
lea ecx, [esi + 0x1098]
mov byte [ebp - 4], 0x20
call fcn.100012f7
lea ecx, [esi + 0x100c]
mov byte [ebp - 4], 0x1f
call fcn.100012f7
lea ecx, [esi + 0xf80]
mov byte [ebp - 4], 0x1e
call fcn.100012f7
lea ecx, [esi + 0xef4]
mov byte [ebp - 4], 0x1d
call fcn.100012f7
lea ecx, [esi + 0xe68]
mov byte [ebp - 4], 0x1c
call fcn.100012f7
lea ecx, [esi + 0xddc]
mov byte [ebp - 4], 0x1b
call fcn.100012f7
lea ecx, [esi + 0xd50]
mov byte [ebp - 4], 0x1a
call fcn.100012f7
lea ecx, [esi + 0xcd8]
mov byte [ebp - 4], 0x19
call edi
lea ecx, [esi + 0xc64]
mov byte [ebp - 4], 0x18
call edi
lea ecx, [esi + 0xbf0]
mov byte [ebp - 4], 0x17
call edi
lea ecx, [esi + 0xb7c]
mov byte [ebp - 4], 0x16
call edi
lea ecx, [esi + 0xb08]
mov byte [ebp - 4], 0x15
call edi
lea ecx, [esi + 0xa94]
mov byte [ebp - 4], 0x14
call edi
lea ecx, [esi + 0xa20]
mov byte [ebp - 4], 0x13
call edi
lea ecx, [esi + 0x9ac]
mov byte [ebp - 4], 0x12
call edi
lea ecx, [esi + 0x938]
mov byte [ebp - 4], 0x11
call edi
lea ecx, [esi + 0x8c4]
mov byte [ebp - 4], 0x10
call edi
lea ecx, [esi + 0x850]
mov byte [ebp - 4], 0xf
call edi
lea ecx, [esi + 0x7dc]
mov byte [ebp - 4], 0xe
call edi
lea ecx, [esi + 0x768]
mov byte [ebp - 4], 0xd
call edi
lea ecx, [esi + 0x6f4]
mov byte [ebp - 4], 0xc
call edi
lea ecx, [esi + 0x680]
mov byte [ebp - 4], 0xb
call edi
lea ecx, [esi + 0x60c]
mov byte [ebp - 4], 0xa
call edi
lea ecx, [esi + 0x598]
mov byte [ebp - 4], 9
call edi
lea ecx, [esi + 0x524]
mov byte [ebp - 4], 8
call edi
lea ecx, [esi + 0x4b0]
mov byte [ebp - 4], 7
call edi
lea ecx, [esi + 0x43c]
mov byte [ebp - 4], 6
call edi
lea ecx, [esi + 0x3c8]
mov byte [ebp - 4], 5
call edi
lea ecx, [esi + 0x354]
mov byte [ebp - 4], 4
call edi
lea ecx, [esi + 0x23c]
mov byte [ebp - 4], 3
call fcn.10001ae5
lea ecx, [esi + 0x190]
mov byte [ebp - 4], 2
call fcn.10001ae5
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.mfc100.dll_Ordinal_1011]
lea ecx, [esi + 0x11c]
call edi
mov byte [ebp - 4], 0
lea ecx, [esi + 0xa8]
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_946]
call fcn.10083a98
ret
Function at 0x100154f3
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x103ce2c0], ebx
jne 0x1001551c
call fcn.1001538f
cmp eax, dword [0x103ce2bc]
jle 0x10015540
cmp dword [0x103ce2c8], ebx
jne 0x10015571
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x103ce2c4]
sub eax, dword [0x10375714]
imul ecx, ecx, 0xea60
cmp eax, ecx
jbe 0x10015571
cmp dword [0xf39100], ebx
jne 0x10015552
call fcn.1003c656
jmp 0x10015659
mov eax, dword [0x10114474]
add eax, 0x52
push eax
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_KillTimer]
call fcn.100140d3
jmp 0x10015659
mov edx, dword [0x3059750]
push esi
push edi
xor edi, edi
xor esi, esi
call fcn.100061b1
test eax, eax
je 0x100155a8
add edx, 0x53c
mov eax, dword [edx]
test eax, eax
je 0x1001559b
cmp dword [eax + 0x334], ebx
jne 0x1001559b
inc edi
inc esi
add edx, 4
call fcn.100061b1
cmp esi, eax
jb 0x1001558c
cmp edi, dword [0x103ce220]
pop edi
pop esi
jge 0x100155ba
cmp dword [0x103ce224], ebx
je 0x100155de
cmp dword [0x103ce228], ebx
jne 0x10015606
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x103ce22c]
sub eax, dword [0x103742bc]
imul ecx, ecx, 0xea60
cmp eax, ecx
jb 0x10015606
cmp dword [0xf39100], ebx
je 0x10015548
mov eax, dword [0x10114474]
add eax, 0x52
push eax
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x1008f9ac
jmp 0x1001564e
push 0x32
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x103ce230
call dword [sym.imp.mfc100.dll_Ordinal_6969]
lea eax, [ebp - 0x38]
push 0x1008f9b8
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
jne 0x10015659
cmp dword [0xf39100], eax
jne 0x10015659
mov eax, dword [0x10114474]
add eax, 0x52
push eax
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x1008f9c0
call fcn.100060db
pop ecx
call fcn.10014936
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1008344f
leave
ret 0x10
Function at 0x10015668
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1035fef4]
push ebx
push esi
push edi
mov ebx, ecx
cmp eax, 1
je 0x10015822
cmp eax, 3
je 0x10015822
push 1
call dword [sym.imp.mfc100.dll_Ordinal_13219]
push 0xa
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebx + 0x300]
call dword [sym.imp.mfc100.dll_Ordinal_6969]
mov esi, 0x1008f9e4
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
jne 0x100157ca
mov ecx, 0x103c3c78
mov dword [0x1035fef4], 2
call fcn.10009739
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
push 0x1008f9b8
lea ecx, [ebx + 0x300]
mov dword [0x103742bc], eax
call dword [sym.imp.mfc100.dll_Ordinal_12868]
xor edi, edi
push edi
lea ecx, [ebx + 0x264]
call dword [sym.imp.mfc100.dll_Ordinal_3970]
call fcn.1003c656
call esi
push edi
push edi
push edi
push edi
mov dword [0x10375714], eax
call fcn.100154f3
mov eax, dword [0x10114474]
push fcn.100154f3
push 0x1388
add eax, 0x52
push eax
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x103c9388], 1
je 0x10015753
cmp dword [0x103c938c], 1
jne 0x10015830
lea eax, [ebp - 0x2c]
push eax
movzx eax, byte [0x358e586]
push eax
mov edi, 0x1035fff4
call fcn.1003e384
lea eax, [ebp - 0x2c]
push 0x3059968
push eax
call dword [sym.imp.MSVCR100.dll_strcat]
add esp, 0x10
lea eax, [ebp - 0x2c]
push eax
push dword [0x100dfd8c]
push 0x292
push dword [0x100f415c]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x100157b2
push eax
push eax
mov esi, 0x1008f9ec
push esi
mov ecx, ebx
call dword [sym.imp.mfc100.dll_Ordinal_7871]
push esi
call fcn.100060db
jmp 0x1001582f
call esi
mov dword [0x1017fcfc], eax
mov dword [0x10112bcc], 0x2710
push 0x1008fa0c
jmp 0x100157ab
and dword [0x1035fef4], 0
push esi
lea ecx, [ebx + 0x300]
call dword [sym.imp.mfc100.dll_Ordinal_12868]
mov eax, dword [0x10114474]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
add eax, 0x52
push eax
push dword [0x100dfd8c]
call esi
mov eax, dword [0x10114474]
add eax, 0x44
push eax
push dword [0x100dfd8c]
call esi
push 1
lea ecx, [ebx + 0x264]
call dword [sym.imp.mfc100.dll_Ordinal_3970]
call fcn.1003c656
and dword [0x10112bcc], 0
jmp 0x10015830
push 8
push 0x1008f9cc
call fcn.1003ce54
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008344f
leave
ret
Function at 0x10017d0d
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1035fef4]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x74], esi
cmp eax, 1
je 0x10017ee4
cmp eax, 2
je 0x10017ee4
push 1
call dword [sym.imp.mfc100.dll_Ordinal_13219]
push 0x32
lea eax, [ebp - 0x6c]
lea ecx, [esi + 0x268]
push eax
mov dword [ebp - 0x70], ecx
call dword [sym.imp.mfc100.dll_Ordinal_6969]
mov edi, 0x1009001c
lea eax, [ebp - 0x6c]
push edi
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
jne 0x10017e88
mov esi, 0x103d7d00
mov dword [0x1035fef4], 3
mov dword [0x10112b6c], 0xff922300
call fcn.1000102f
mov esi, 0x103d7d0c
call fcn.1000102f
mov byte [0x37b32ba], 1
pushal
mov eax, 0x9abac0
call eax
popal
mov ecx, 0x103c3c78
call fcn.10009739
mov ecx, dword [ebp - 0x70]
push 0x1008f9b8
call dword [sym.imp.mfc100.dll_Ordinal_12868]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [0x1035fd68], eax
mov eax, dword [0x10114474]
push 0x100178f0
push 0x3e8
add eax, 0x53
push eax
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_SetTimer]
xor esi, esi
cmp dword [0x103c9388], 1
mov dword [0x101127c4], esi
je 0x10017e0d
cmp dword [0x103c938c], 1
jne 0x10017ef2
lea eax, [ebp - 0x38]
push eax
movzx eax, byte [0x358e586]
push eax
mov edi, 0x1035fff4
call fcn.1003e384
lea eax, [ebp - 0x38]
push 0x3059968
push eax
call dword [sym.imp.MSVCR100.dll_strcat]
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
push dword [0x100dfd8c]
push 0x292
push dword [0x100f415c]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x10017e70
mov ecx, dword [ebp - 0x74]
push esi
push esi
mov esi, 0x1008f9ec
push esi
call dword [sym.imp.mfc100.dll_Ordinal_7871]
push esi
call fcn.100060db
jmp 0x10017ef1
call ebx
mov dword [0x1017fcfc], eax
mov dword [0x10112bcc], 0x2710
push 0x10090024
jmp 0x10017e66
xor esi, esi
push esi
push esi
push esi
push 0x1001812e
push esi
push esi
mov dword [0x1035fef4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
mov eax, dword [0x10114474]
lea eax, [eax + ebx + 0x44]
push eax
push dword [0x100dfd8c]
call esi
inc ebx
cmp ebx, 0xa
jl 0x10017eaf
mov eax, dword [0x10114474]
add eax, 0x53
push eax
push dword [0x100dfd8c]
call esi
mov ecx, dword [ebp - 0x70]
push edi
call dword [sym.imp.mfc100.dll_Ordinal_12868]
jmp 0x10017ef2
push 8
push 0x10090004
call fcn.1003ce54
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008344f
leave
ret
Function at 0x10017f68
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084633
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x100a609c]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
push 0x1f4
mov ebx, ecx
call dword [sym.imp.mfc100.dll_Ordinal_265]
mov dword [esp], 0x10111f10
push str._sCollect__
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 0x14b
push dword [ebx + 0x3e8]
call edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [esp + 0x20]
mov dword [esp + 0x178], esi
push 0x10090044
push eax
lea esi, [esp + 0x20]
call fcn.100183c1
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov esi, dword [sym.imp.MSVCR100.dll_strlen]
lea eax, [esp + 0x50]
push eax
call esi
pop ecx
mov byte [esp + eax + 0x4c], 0
lea eax, [esp + 0x50]
push eax
push 0
push 0x143
push dword [ebx + 0x3e8]
call edi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10018032
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.1008344f
mov esp, ebp
pop ebp
ret
Function at 0x1001f2f9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084d61
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x100a609c]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x360]
mov dword fs:[0], eax
push 0x3592e68
push 0x10111f10
lea eax, [esp + 0x164]
push str._s_s_
push eax
mov ebx, ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x10
xor esi, esi
push esi
push esi
push 0x14b
push dword [ebx + 0x410]
call edi
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [esp + 0x18]
mov dword [esp + 0x368], esi
push 0x10090304
push eax
lea esi, [esp + 0x1c]
call fcn.100183c1
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [esp + 0x10], 0xffffffff
je 0x1001f407
mov esi, dword [sym.imp.MSVCR100.dll_strlen]
lea eax, [esp + 0x48]
push eax
call esi
pop ecx
mov byte [esp + eax + 0x44], 0
lea eax, [esp + 0x48]
push eax
push 0
push 0x143
push dword [ebx + 0x410]
call edi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001f3c9
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10111f10
lea eax, [esp + 0x160]
push str._sScript_
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1316]
lea eax, [esp + 0x18]
push 0x10090304
push eax
lea esi, [esp + 0x1c]
call fcn.100183c1
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [esp + 0x10], 0xffffffff
je 0x1001f4b0
mov esi, dword [sym.imp.MSVCR100.dll_strlen]
lea eax, [esp + 0x48]
push eax
call esi
pop ecx
mov byte [esp + eax + 0x44], 0
lea eax, [esp + 0x48]
push eax
push 0
push 0x143
push dword [ebx + 0x410]
call edi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1001f472
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [esp + 0x360]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.1008344f
mov esp, ebp
pop ebp
ret
Function at 0x1001ff5e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084d61
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x100a609c]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x360]
mov dword fs:[0], eax
push 0x10111f10
lea eax, [esp + 0x160]
push str._sPK_config_
push eax
mov ebx, ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 0x14b
push dword [ebx + 0xaac]
call edi
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [esp + 0x18]
mov dword [esp + 0x368], esi
push 0x10090304
push eax
lea esi, [esp + 0x1c]
call fcn.100183c1
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
cmp dword [esp + 0x10], 0xffffffff
je 0x10020067
mov esi, dword [sym.imp.MSVCR100.dll_strlen]
lea eax, [esp + 0x48]
push eax
call esi
pop ecx
mov byte [esp + eax + 0x44], 0
lea eax, [esp + 0x48]
push eax
push 0
push 0x143
push dword [ebx + 0xaac]
call edi
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10020029
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [esp + 0x360]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.1008344f
mov esp, ebp
pop ebp
ret
Function at 0x1002749b
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push dword [0x103d1890]
mov dword [ebp - 0xa4], eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100275bf
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
xor edi, edi
push edi
push edi
mov ebx, 0x1042
push ebx
push dword [0x103d1924]
call esi
cmp eax, 6
jle 0x100274ff
push edi
push edi
push ebx
push dword [0x103d1924]
call esi
cmp eax, 0x16
jl 0x100275bc
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0x32
lea ecx, [ebp - 0x6c]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0x38]
push 0x100945b8
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
push edi
push edi
mov ebx, 0x1004
push ebx
push dword [0x103d1924]
mov dword [ebp - 0xa4], edi
call esi
test eax, eax
jle 0x1002759b
push 0x32
lea eax, [ebp - 0xa0]
push eax
push 1
push dword [ebp - 0xa4]
mov ecx, 0x103d1904
call dword [sym.imp.mfc100.dll_Ordinal_5176]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x100275cb
inc dword [ebp - 0xa4]
push edi
push edi
push ebx
push dword [0x103d1924]
call esi
cmp dword [ebp - 0xa4], eax
jl 0x1002754f
lea eax, [ebp - 0x38]
push eax
push 1
push edi
push edi
push 0x1042
push dword [0x103d1924]
call esi
push eax
mov ecx, 0x103d1904
call dword [sym.imp.mfc100.dll_Ordinal_12440]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008344f
leave
ret
push 8
push 0x100945c0
call fcn.1003ce54
pop ecx
pop ecx
jmp 0x100275bc
Function at 0x100275db
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x100a609c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 8]
mov esi, ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0x32
lea ecx, [ebp - 0x38]
shl eax, 0x10
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x6c]
push 0x100945b8
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0x10
push edi
push edi
mov ebx, 0x1004
push ebx
push dword [0x103d1924]
mov dword [ebp - 0xa4], edi
call esi
test eax, eax
jle 0x100276f1
mov edi, 0x103d1904
push 0x32
lea eax, [ebp - 0xa0]
push eax
push 1
push dword [ebp - 0xa4]
mov ecx, edi
call dword [sym.imp.mfc100.dll_Ordinal_5176]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.MSVCR100.dll_strcmp]
pop ecx
pop ecx
test eax, eax
je 0x1002769c
inc dword [ebp - 0xa4]
push 0
push 0
push ebx
push dword [0x103d1924]
call esi
cmp dword [ebp - 0xa4], eax
jl 0x1002764f
jmp 0x100276f1
push 3
xor eax, eax
push eax
push eax
push eax
push 0x1042
push dword [0x103d1924]
call esi
mov ebx, dword [sym.imp.mfc100.dll_Ordinal_12438]
push eax
mov ecx, edi
call ebx
push dword [ebp - 0xa4]
push 0
push 0x1043
push dword [0x103d1924]
call esi
push 3
push 3
push dword [ebp - 0xa4]
mov ecx, edi
call ebx
mov esi, 0x103d1870
mov ecx, esi
call fcn.10026e55
mov ecx, esi
call fcn.100266e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008344f
leave
ret
Function at 0x1002cfbb
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084633
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x100a609c]
xor eax, esp
mov dword [esp + 0x158], eax
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x170]
mov dword fs:[0], eax
push 0x1f4
mov ebx, ecx
call dword [sym.imp.mfc100.dll_Ordinal_265]
mov dword [esp], 0x10111f10
push str._sScript__
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
add esp, 0xc
xor esi, esi
push esi
push esi
push 0x14b
push dword [ebx + 0xb4]
call edi
push dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [esp + 0x20]
mov dword [esp + 0x178], esi
push 0x10090044
push eax
lea esi, [esp + 0x20]
call fcn.100183c1
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], eax
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
mov esi, 0x143
jmp 0x1002d09c
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.MSVCR100.dll_strlen]
pop ecx
mov byte [esp + eax + 0x4c], 0
lea eax, [esp + 0x50]
push eax
push 0
push esi
push dword [ebx + 0xb4]
call edi
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002d091
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x10093650
push 0
push esi
push dword [ebx + 0xb4]
call edi
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov ecx, dword [esp + 0x170]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x158]
xor ecx, esp
call fcn.1008344f
mov esp, ebp
pop ebp
ret