joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b0920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov edi, 4
mov dword [ebp - 4], edi
movzx ebx, byte [edx + edi + 0x306a0]
mov ecx, ebx
mov esi, ebx
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
sub edi, esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x100b09a8
jmp 0x100b096a
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, ebx
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov eax, edi
and eax, 1
mov ebx, eax
neg ebx
shr ecx, 4
sar ebx, 4
and ebx, 0x7f
xor ecx, ebx
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
add ecx, ecx
or ecx, eax
shr edi, 1
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
jne 0x100b0967
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ebp + edi*4 - 0x214], eax
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x80
jb 0x100b0934
lea esi, [ebp - 0x214]
sub esi, edx
lea ecx, [edx + 0x32910]
lea ebx, [edx + 0x31d58]
sub esi, 0x31d50
lea edi, [edx + 0x31950]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], 4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
cmp dword [edx + 0x32594], ecx
jbe 0x100b0a51
mov eax, ecx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x100b0a3f
mov edi, edi
mov ebx, dword [ebp - 4]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebx, 4
xor ebx, eax
add esi, dword [edx + ebx*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x100b0a10
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [edi + ecx*4], esi
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, dword [edx + 0x32594]
jb 0x100b0a02
mov esi, dword [ebp - 0xc]
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x100b0a76
mov edi, edi
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x100b0a60
mov eax, dword [edi]
mov dword [ebx - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebx - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebx], eax
mov ecx, dword [edi + 0xc]
mov dword [ebx + 4], ecx
mov eax, 4
lea ecx, [ebx + 8]
jmp 0x100b0aa0
movzx ebx, byte [edx + eax + 0x306a0]
mov ebx, dword [edi + ebx*4]
add ebx, dword [esi + ecx]
inc eax
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x80
jb 0x100b0aa0
mov ebx, dword [ebp - 8]
sub dword [ebp - 4], 0xffffff80
add ebx, 0x200
sub esi, 0x200
add edi, 0x100
dec dword [ebp - 0x14]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], esi
jne 0x100b09f5
pop edi
pop esi
mov dword [edx + 0x3bcf8], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100b2db0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.102349f4
mov ecx, dword [ebp + 8]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x100b2ddd
xor eax, eax
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100b2dec
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100ce0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
movzx esi, word [eax]
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov dword [ebp - 4], ebx
cmp ebx, ecx
jb 0x100ce112
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub ecx, ebx
cmp eax, ecx
jbe 0x100ce120
mov dword [ebp + 0xc], ecx
mov eax, ecx
xor ecx, ecx
test eax, eax
je 0x100ce160
sub ebx, edx
mov dword [ebp - 8], eax
push edi
lea esp, [esp]
movzx edi, byte [ebx + edx]
mov ecx, esi
shr ecx, 8
xor ecx, edi
add edi, esi
imul edi, edi, 0x3193
mov esi, 0x58bf
sub esi, edi
mov byte [edx], cl
and esi, 0xffff
inc edx
dec eax
jne 0x100ce130
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
pop edi
mov edx, dword [ebp + 8]
add ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [edx], ebx
mov word [eax], si
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f8f20
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x100f8f52
push esi
call fcn.100fd670
add esp, 4
cmp byte [esi + 0x40], 0
je 0x100f8f4b
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100f8fce
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x100f8fbd
mov eax, dword [esi + 8]
test eax, eax
je 0x100f8f77
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
mov edx, dword [esi + 0x190]
mov eax, dword [edx]
push esi
call eax
add esp, 4
test eax, eax
je 0x100f8fb8
cmp eax, 2
je 0x100f8fbd
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100f8f68
cmp eax, 3
je 0x100f8f9f
cmp eax, 1
jne 0x100f8f68
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x100f8f68
mov ecx, dword [esi + 0x11c]
add dword [eax + 8], ecx
jmp 0x100f8f68
xor al, al
pop esi
pop ebp
ret
mov edx, dword [esi + 0x7c]
mov dword [esi + 0x84], edx
call fcn.100f8db0
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x100f8ff0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov edx, dword [esi + 0x14]
mov dword [ecx + 0x18], edx
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
add esp, 4
call fcn.100f8db0
pop esi
pop ebp
ret
Function at 0x101044f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x4c], 1
push esi
mov esi, dword [ebx + 0x1a8]
push edi
mov dword [ebp - 0x14], esi
jne 0x10104518
mov dword [ebp - 4], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x10104523
mov dword [ebp - 4], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [ebx + 0x64]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push ebx
call eax
xor edi, edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 8], edi
cmp dword [ebx + 0x64], edi
jle 0x1010462f
jmp 0x1010455e
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + edi*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
je 0x1010457e
mov edx, dword [esi + 0x18]
add dword [edx + edi*4], 0xff
lea eax, [edx + edi*4]
mov eax, dword [esi + 0x18]
mov edi, dword [eax + edi*4]
lea eax, [ecx + 0xfe]
lea esi, [ecx + ecx - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov esi, eax
lea ebx, [ebx]
cmp ecx, esi
jle 0x101045dc
mov eax, dword [ebp - 0xc]
mov edx, ebx
imul edx, edx, 0x1fe
lea edi, [edx + eax + 0xfe]
jmp 0x101045c0
mov esi, dword [ebp - 0xc]
add edi, 0x1fe
mov eax, edi
cdq
lea esi, [esi + esi - 2]
idiv esi
inc ebx
mov esi, eax
cmp ecx, esi
jg 0x101045c0
mov edi, dword [ebp - 0x18]
mov al, byte [ebp - 0x10]
imul bl
mov byte [ecx + edi], al
inc ecx
cmp ecx, 0xff
jle 0x101045a0
cmp dword [ebp - 4], 0
je 0x1010461c
mov eax, 1
lea ecx, [edi - 1]
jmp 0x10104600
movzx edx, byte [edi]
mov byte [ecx], dl
movzx edx, byte [edi + 0xff]
mov byte [edi + eax + 0xff], dl
inc eax
dec ecx
cmp eax, 0xff
jle 0x10104600
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, dword [ecx + 0x64]
jl 0x10104555
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010e6b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov al, byte [edx + 8]
sub esp, 0x10
cmp al, 3
je 0x1010e84e
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [edx]
push esi
xor esi, esi
push edi
mov dword [ebp + 8], esi
test al, 2
je 0x1010e701
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [ebp - 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], eax
mov edi, 3
jmp 0x1010e713
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [ebp - 0x10], edi
mov edi, 1
test byte [edx + 8], 4
je 0x1010e728
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [ebp + edi*4 - 0x10], eax
inc edi
xor eax, eax
test edi, edi
jle case.0x1010e76d.3
cmp dword [ebp + eax*4 - 0x10], 0
jg 0x1010e743
mov dword [ebp + eax*4 - 0x10], 0
jmp 0x1010e748
mov esi, 1
inc eax
cmp eax, edi
jl 0x1010e732
test si, si
je case.0x1010e76d.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x1010e76d.3
movzx ecx, byte [eax + 0x1010e868]
jmp dword [ecx*4 + 0x1010e854]
mov edx, dword [edx + 4]
mov eax, dword [ebp + 0xc]
test edx, edx
je case.0x1010e76d.3
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
dec edx
jne 0x1010e782
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [edx + 4]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, eax
mov edx, 0xf0
sar edx, cl
mov ebx, 0xf
sar ebx, cl
and dl, 0xf0
or dl, bl
test edi, edi
je case.0x1010e76d.3
lea esp, [esp]
mov bl, byte [esi]
mov cl, al
shr bl, cl
inc esi
and bl, dl
dec edi
mov byte [esi - 1], bl
jne 0x1010e7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
imul ebx, edi
mov eax, ebx
xor ebx, ebx
mov dword [ebp + 8], eax
test eax, eax
je case.0x1010e76d.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [ebp + edx*4 - 0x10]
shr byte [esi - 1], cl
cmp ebx, dword [ebp + 8]
jb 0x1010e7e7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
imul ebx, edi
mov eax, ebx
xor ebx, ebx
mov dword [ebp + 8], eax
test eax, eax
je case.0x1010e76d.3
xor edx, edx
mov eax, ebx
div edi
movzx eax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc ebx
add esi, 2
movzx ecx, word [ebp + edx*4 - 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, dword [ebp + 8]
jb 0x1010e813
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10133390
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 8
call fcn.10136e50
add esp, 4
test eax, eax
jne 0x101333af
push eax
call fcn.10143fc0
add esp, 4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov edx, fcn.102349f4
add esi, 4
mov dword [eax + 4], fcn.1023492f
mov dword [eax], ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x101333ec
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10133360
push 0
push 0
call fcn.102349f4
add esp, 0x18
jmp 0x10133402
lea edx, [ebp - 4]
push edx
push 0
push eax
push 0x10133360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
pop esi
test eax, eax
jne 0x1013341a
push str.Not_enough_resources_to_create_thread
call fcn.10143da0
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10136de0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102dc63c]
mov ecx, dword [0x102dc638]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push edi
mov edi, dword [ebp + 8]
push eax
push ecx
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x10136e0c
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
cmp esi, dword [0x102dc63c]
jbe 0x10136e38
mov edx, dword [0x102dc638]
push esi
push edx
call fcn.10136e70
add esp, 8
test eax, eax
je 0x10136e05
push esi
push eax
push edi
mov dword [0x102dc638], eax
mov dword [0x102dc63c], esi
call ebx
mov eax, dword [0x102dc638]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10141c90
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, 0x1505
xor ecx, ecx
push edi
mov edi, edi
fld dword [esi + ecx*8]
mov edi, edx
fnstcw word [ebp - 2]
shl edi, 5
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
add edi, edx
inc ecx
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add eax, edi
mov edx, eax
fldcw word [ebp - 2]
shl edx, 5
add edx, eax
fld dword [esi + ecx*8 - 4]
fnstcw word [ebp - 2]
movzx eax, word [ebp - 2]
or eax, 0xc00
mov dword [ebp - 8], eax
fldcw word [ebp - 8]
fistp qword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add edx, eax
fldcw word [ebp - 2]
cmp ecx, 0x40
jl 0x10141ca0
mov eax, edx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10144bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.101447ed
push eax
push esi
push dword [ebp + 8]
call fcn.101447a2
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.101447ed
sti
invalid
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.101447a2
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.101447dd
movsb byte es:[edi], byte [esi]
aam 0xab
sub ecx, dword [eax - 0x8363]
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x10148ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0
call fcn.1013e030
mov edi, eax
add esp, 8
mov esi, edi
push 1
and esi, 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, dword [ebp + 8]
and eax, 0x8000
je 0x10148aea
test esi, esi
jne 0x10148aff
mov eax, dword [ebx]
push 1
push 1
push esi
push eax
jmp 0x10148af7
test esi, esi
je 0x10148aff
mov ecx, dword [ebx]
push 1
push 0
push 0
push ecx
call fcn.1013e510
add esp, 0x10
mov esi, edi
push 2
and esi, 4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x10148b21
test esi, esi
jne 0x10148b36
mov edx, dword [ebx]
push 3
push 1
push esi
push edx
jmp 0x10148b2e
test esi, esi
je 0x10148b36
mov eax, dword [ebx]
push 3
push 0
push 0
push eax
call fcn.1013e510
add esp, 0x10
mov esi, edi
push 4
and esi, 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x10148b58
test esi, esi
jne 0x10148b6d
mov ecx, dword [ebx]
push 2
push 1
push esi
push ecx
jmp 0x10148b65
test esi, esi
je 0x10148b6d
mov edx, dword [ebx]
push 2
push 0
push 0
push edx
call fcn.1013e510
add esp, 0x10
mov esi, edi
push 5
and esi, 8
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
je 0x10148b8f
test esi, esi
jne 0x10148ba4
mov eax, dword [ebx]
push 4
push 1
push esi
push eax
jmp 0x10148b9c
test esi, esi
je 0x10148ba4
mov ecx, dword [ebx]
push 4
push 0
push 0
push ecx
call fcn.1013e510
add esp, 0x10
push 6
and edi, 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
and eax, 0x8000
je 0x10148bd6
cmp edi, esi
jne 0x10148be9
mov edx, dword [ebx]
push 5
push 1
push esi
push edx
call fcn.1013e510
add esp, 0x10
pop edi
mov dword [ebx + 0x1c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, esi
je 0x10148be9
mov eax, dword [ebx]
push 5
push esi
push esi
push eax
call fcn.1013e510
add esp, 0x10
pop edi
mov dword [ebx + 0x1c], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101499b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x1c]
push eax
call edi
test eax, eax
je 0x10149a0c
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
nop
lea ecx, [ebp - 0x1c]
push ecx
call ebx
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, esi
sub eax, dword [ebp - 0xc]
test eax, eax
jle 0x10149a0b
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call edi
test eax, eax
jne 0x101499e0
pop ebx
push 0
call fcn.1013f6f0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, eax
add esp, 4
cmp byte [esi + 0xe1], 1
jne 0x10149a47
push 0xa0
call edi
mov edx, 0x8000
test dx, ax
jne 0x10149a47
push 0xe1
push 0
call fcn.1013f260
add esp, 8
cmp byte [esi + 0xe5], 1
jne 0x10149a70
push 0xa1
call edi
mov ecx, 0x8000
test cx, ax
jne 0x10149a70
push 0xe5
push 0
call fcn.1013f260
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1014a050
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
lea eax, [ebp - 0x800]
push edi
push eax
call fcn.1013f1d0
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
add esp, 4
xor esi, esi
mov eax, dword [esi*4 + 0x10279768]
test eax, eax
je 0x1014a0c3
test dword [ebp + eax*4 - 0x800], 0x40000000
lea edi, [ebp + eax*4 - 0x800]
jne 0x1014a0c3
cmp eax, 0x35
je 0x1014a0c3
cmp eax, 0x1e
jl 0x1014a0a1
cmp eax, 0x27
jle 0x1014a0c3
push 1
push esi
call ebx
test eax, eax
je 0x1014a0c3
push 2
push eax
call ebx
and eax, 0x7fff
je 0x1014a0c3
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x1014a0c1
add eax, 0x20
mov dword [edi], eax
inc esi
cmp esi, 0x80
jb 0x1014a073
push 0x200
lea edx, [ebp - 0x800]
push edx
push 0
call fcn.1013f1f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1014c6c0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push 0xd
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1014c74d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xf0]
test eax, eax
je 0x1014c6e7
mov ecx, dword [eax + 0x7c]
mov eax, dword [ecx + 4]
jmp 0x1014c6e9
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1014c74d
push esi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x1014c735
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
call fcn.10130300
lea edx, [eax + eax + 2]
push edx
push edi
push 0x10275010
push 0x10275008
call fcn.10136a80
add esp, 0x14
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1014c742
push str.Couldnt_get_clipboard_data
call fcn.101511c0
add esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
test edi, edi
jne 0x1014c75d
push 0x102547bf
call fcn.10130590
add esp, 4
pop edi
pop ebp
ret
mov eax, edi
pop edi
pop ebp
ret

Function at 0x10151070
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push esi
push edi
call sub.KERNEL32.dll_GetCurrentThreadId
xor edi, edi
mov esi, eax
cmp dword [0x102dc318], edi
jne 0x10132e65
push 0x102dc310
call fcn.10148290
add esp, 4
cmp dword [0x102dc318], edi
jne 0x10132e58
call fcn.1013dcb0
mov dword [0x102dc318], eax
test eax, eax
jne 0x10132e58
push 0x102dc310
call fcn.101482c0
add esp, 4
pop edi
xor eax, eax
pop esi
ret
push 0x102dc310
call fcn.101482c0
add esp, 4
mov eax, dword [0x102dc318]
push eax
call fcn.1013dd00
mov eax, dword [0x102dc328]
add esp, 4
test eax, eax
je 0x10132ea2
lea esp, [esp]
cmp dword [eax], esi
je 0x10132e9f
mov eax, dword [eax + 8]
test eax, eax
jne 0x10132e80
mov ecx, dword [0x102dc318]
push ecx
call fcn.1013dd70
add esp, 4
mov eax, edi
pop edi
pop esi
ret
mov edi, dword [eax + 4]
mov ecx, dword [0x102dc318]
push ecx
call fcn.1013dd70
add esp, 4
mov eax, edi
pop edi
pop esi
ret
cmp dword [0x102d8864], 0xffffffff
jne 0x101510ca
cmp dword [0x102ddb20], 0
jne 0x101510d3
push 0x102ddb1c
call fcn.10148290
add esp, 4
cmp dword [0x102d8864], 0xffffffff
jne 0x101510bd
cmp dword [0x102ddb20], 0
jne 0x101510bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x101510b3
mov dword [0x102d8864], eax
jmp 0x101510bd
mov dword [0x102ddb20], 1
push 0x102ddb1c
call fcn.101482c0
add esp, 4
cmp dword [0x102ddb20], 0
je 0x101510d8
jmp 0x10132e10
mov eax, dword [0x102d8864]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret

Function at 0x101510f0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102ddb20], 0
je 0x10151102
pop ebp
jmp fcn.10132ec0
mov ecx, dword [ebp + 8]
mov edx, dword [0x102d8864]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x10151126
push str.TlsSetValue___failed
call fcn.10143da0
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x101c7290
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x101c72b4
push ecx
push eax
push 0x102df460
call fcn.101c6f10
add esp, 0xc
xor eax, eax
pop ebp
ret

Function at 0x101d38a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x102de14c], 0
jne 0x101d3944
push 0
push 0
push 0
push 0
mov dword [0x102de154], 0x80004005
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 8], eax
test eax, eax
jne 0x101d3908
cmp dword [0x102d9578], 1
jl 0x101d3944
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_create_event:__lu_n
push str.MMDevApiLoad
push str._EE_
call fcn.101c6c20
xor eax, eax
add esp, 0x10
cmp dword [0x102de154], eax
setge al
mov esp, ebp
pop ebp
ret
push 0x102de144
push 0
lea eax, [ebp - 8]
push eax
push 0x101d3310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x102de14c], eax
test eax, eax
je 0x101d393a
push esi
lea esi, [ebp - 8]
call fcn.101d25b0
mov dword [0x102de154], eax
pop esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x102de154], eax
setge al
mov esp, ebp
pop ebp
ret

Function at 0x101d6490
Capabilities:
Get common file path

Disassembly:
push esi
push 0xc
push 1
call fcn.10232993
push str.general
mov dword [0x102de16c], eax
call fcn.10250a5b
mov ecx, dword [0x102de16c]
add esp, 0xc
push 0
push 0x1a
push 0x102de170
push 0
mov dword [ecx], eax
mov dword [0x102de168], 1
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x101d6529
mov eax, 0x102de170
lea edx, [eax + 1]
jmp 0x101d64e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x101d64e0
sub eax, edx
mov edx, 0x400
sub edx, eax
push str._alsoft.ini
push edx
lea eax, [eax + 0x102de170]
push eax
call fcn.10233ed9
push 0x102894f8
push 0x102de170
call fcn.102327c7
mov esi, eax
add esp, 0x14
test esi, esi
je 0x101d6529
push esi
call fcn.101d5fb0
push esi
call fcn.102322dc
add esp, 8
push str.ALSOFT_CONF
call fcn.102355e7
add esp, 4
test eax, eax
je 0x101d6562
cmp byte [eax], 0
je 0x101d6562
push 0x102750ec
push eax
call fcn.102327c7
mov esi, eax
add esp, 8
test esi, esi
je 0x101d6562
push esi
call fcn.101d5fb0
push esi
call fcn.102322dc
add esp, 8
pop esi
ret
Function at 0x101dcbc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
call fcn.10231473
mov esi, eax
add esp, 4
test esi, esi
je 0x101dcc09
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 4]
push edx
push 0
push esi
push 0x101dcba0
push 0x100000
push 0
mov dword [esi], eax
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
test eax, eax
jne 0x101dcc10
push esi
call fcn.1023138c
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret