joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019f357
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101a4760], 0
mov byte [0x101a4764], 0
mov edi, dword [0x101a4754]
add edi, 0xfffff8e9
mov dword [0x101a4758], edi
mov dword [0x101a475c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x101a4754], 0x7c1
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101a4758], 0x17ea
mov eax, dword [0x101a475c]
add eax, 1
mov dword [0x101a475c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f3a4
xor eax, eax
mov dword [0x101a475c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101a4768], 0
mov edi, dword [0x101a4760]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101a4768], esi
mov dword [0x101a4754], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101a4760], edx
mov dword [0x101a4758], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101a4764], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101a4764]
mov esi, dword [0x101a4760]
mov byte [ebx + esi], cl
mov esi, dword [0x101a475c]
add esi, 1
mov dword [0x101a475c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f3ed
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f83a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101a4758], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a02cc]
mov dh, byte [eax + 0x101a029d]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1019f85c
lea eax, [ebp - 0x24]
mov dword [0x101a4758], 0x1a22
mov ecx, dword [0x101a4754]
add ecx, 0xffffefe3
mov dword [0x101a4754], ecx
mov dword [ebp - 0x34], eax
call fcn.1019ed58
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e96e
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019f972
mov eax, dword [ebp - 0x38]
mov dword [0x101a4754], 0x2091
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f1aa
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101a4754], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 4], ecx
mov dword [0x101a4758], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0xc], ecx
add ecx, 0x126e
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019f969
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1019fc7e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101a475c], 0
mov dword [0x101a4760], 0
mov dword [0x101a476c], 0
mov dword [0x101a4754], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1019fe05
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov edi, edx
add edi, 1
add eax, 1
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101a475c], edx
mov dword [0x101a4754], 0x3264
mov ebx, dword [ebp - 0x24]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101a4760], edx
mov ecx, dword [0x101a4758]
add ecx, 0xfffff82b
mov dword [0x101a4758], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101a4764], cl
mov dword [0x101a4754], 0x26b4
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x101a4758], 0x112a
mov cl, byte [0x101a4764]
mov edx, dword [0x101a4760]
mov byte [ebx + edx], cl
mov edx, dword [0x101a475c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101a4760]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x101a4758], 0x55d
and ecx, 0xff
mov dword [0x101a476c], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101a4754], 0x65f
mov dword [0x101a4758], 0xffffdf97
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1019fdf8
mov eax, dword [0x101a475c]
mov ecx, dword [0x101a4760]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
jmp 0x1019fce9
mov eax, dword [0x101a4754]
add eax, 0xe82
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x101a4754], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019fe15
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x101a4754]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101a4758], esi
add edx, 0xffffe928
mov dword [0x101a4754], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f560
lea ecx, [0x1019f2f0]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x88], edx
mov dword [esp + 0x6c], 0x148600
mov edx, dword [0x101a4740]
mov dword [esp + 0x7c], edx
mov edx, dword [0x101a4744]
mov dword [esp + 0x40], edx
mov edx, dword [0x101a4748]
mov dword [esp + 0x58], edx
mov edx, dword [0x101a474c]
mov dword [esp + 0x68], edx
mov dword [0x101a4754], 0x5bd
mov edx, dword [0x101a4750]
mov dword [esp + 0x84], edx
mov dword [0x101a4758], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1019ff04
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019f83a
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
jmp 0x1019ff5b
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1019ff27
jmp 0x1019ff13
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
je 0x1019feee
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1019ff04
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x30], edx
mov dword [0x101a4754], 0xe1c
call fcn.1019f076
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1019fec2
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x1000a609
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
push esi
mov byte [ebp - 4], dl
mov esi, ecx
je 0x1000a62b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1000a83d
add esp, 0xc
jmp 0x1000a660
test dl, dl
je 0x1000a643
push 0x1cad
push 0
push 0x1198
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000a660
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x1000a65b
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x9f9b
inc dword [edx]
cmp dword [edx], 2
jl 0x1000a64e
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000cb76
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000cba2
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.1000f68c
add esp, 0xc
jmp 0x1000cc08
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000cbe8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000cbe6
push 0x1cad
push 0
push 0x1198
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000cc08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000cc08
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov esp, ebp
pop ebp
ret
Function at 0x1000e5fa
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000e693
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000e675
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000e656
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1000e673
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10021821
mov dword [eax], 6
jmp 0x1000e64b
jmp 0x1000e691
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000e6b9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push 0x4437
push 0x45ed
call fcn.1000e4ee
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10031021
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10031084
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003105d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003105b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x10031082
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10031082
push 0
push 0
push 0x2598
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x100310aa
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
push 1
push 0x47bf
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x4e50
call fcn.1002cf27
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10031783
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100317b0
push 0x19b5
push 0x195a
push 1
push 0xf5b
push 0x6d7d
call fcn.100317e5
add esp, 0x14
jmp 0x100317e1
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100317cd
push 0x224d
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x100317e1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100317e1
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret

Function at 0x10032535
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003256b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 1
push 0x2350
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x69b8
call fcn.100325b0
add esp, 0x14
jmp 0x100325ac
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1003259a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x100325ac
push 0x1cad
push 0
push 0x1198
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x100364c6
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100364f1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x4e10
push 1
call fcn.10036575
add esp, 0xc
jmp 0x10036571
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003653f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003653d
push 0x4026
push 1
push 1
push 0x75a7
push 0x61fa
push 0x620f
push 0x1a16
push 0x37f9
call fcn.1002f181
add esp, 0x20
jmp 0x10036571
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10036571
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x1003be95
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003bf05
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003bedf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003bedd
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1003bf03
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1003bf22
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 0
push 0x4225
push 0x4caf
call fcn.1002f3b3
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1003cf3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072f6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003cf7d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push 1
call fcn.1003d123
pop ecx
pop ecx
jmp 0x1003d112
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x21bb
mov dword [ebp - 0x3c], 0x10008640
cmp dword [ebp - 0x1c], 0x23cc
jle 0x1003d014
and dword [ebp - 0x14], 0
jmp 0x1003cfad
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x79ec
jge 0x1003d009
and dword [ebp - 0x18], 0
jmp 0x1003cfc3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6490
jge 0x1003d007
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x80]
call fcn.1000a4b3
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10021246
push eax
call fcn.10059c65
pop ecx
lea ecx, [ebp - 0x80]
call fcn.1002123c
jmp 0x1003cfbc
jmp 0x1003cfa6
push 0x50e
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003d0aa
mov dword [ebp - 0x40], 0x7e8e
mov dword [ebp - 0x44], 0xfffffff9
mov dword [ebp - 0x48], 0xfffffff8
push 1
lea ecx, [ebp - 0x68]
call fcn.10021783
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x50], 0xc781ced8
mov dword [ebp - 0x2c], 0xa4d63a88
push 0x6277
lea eax, [ebp - 0x68]
push eax
push 0x7c84
push 0x41b5
push 1
push 0x2738
lea eax, [ebp - 0x54]
push eax
push 1
call fcn.10031fab
add esp, 0x20
push 0x673b
push 1
push 1
push 0x2a64
lea eax, [ebp - 0x2c]
push eax
call fcn.100320c8
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10021805
jmp 0x1003d0d3
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1003d0d3
push 1
push 0
push 0x2682
push 0
call fcn.10036da1
add esp, 0x10
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], 0x1e45
jge 0x1003d0ec
push dword [ebp - 0x3c]
call fcn.10059c65
pop ecx
jmp 0x1003d108
or dword [ebp - 4], 0xffffffff
jmp 0x1003d112
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d254
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003d2d9
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003d28c
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1003d2d7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003d2ba
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003d2d7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10021821
mov dword [eax], 0x9f9b
jmp 0x1003d2af
jmp 0x1003d2e7
push 0
push 0x42e5
call fcn.1002f5fb
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003db54
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003dc30
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003dc1c
mov dword [ebp - 0x10], 0x506e60b0
mov dword [ebp - 0x1c], 0x3648bd92
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x18], 0xed99ea7
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x6b1a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0x2b6d
push 0x5e64
push 1
push 0x6c5
lea eax, [ebp - 0x24]
push eax
call fcn.1003c31f
add esp, 0x34
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003dc1a
push 0x1ca7
push 0x1eed
push 0x3b8d
push 1
push 0x674e
push 0x3d16
push 0
push 1
call fcn.1003d430
add esp, 0x20
jmp 0x1003dc2e
push 0x1cad
push 0
push 0x1198
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1003dc52
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push 0x195c
push 0x4ab6
push 1
push 0x2226
push dword [ebp - 0x28]
call fcn.10033606
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1003e0ed
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003e16e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003e164
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003e145
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1003e162
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10021821
mov dword [eax], 1
jmp 0x1003e13a
jmp 0x1003e16c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x1003e180
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
call fcn.10034699
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004643b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100464ae
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1004648e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
jmp 0x100464ac
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100464ac
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x100464d4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push 0x5136
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push 0x5769
call fcn.10043a77
add esp, 0x14
mov esp, ebp
pop ebp
ret