joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433e12
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x44a2b0]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
push 0x43cc64
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], ebx
xor esi, esi
call edi
push str.GetUserDefaultUILanguage
push eax
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x433eb4
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ebx, 0x3ff
mov edi, 0xfc00
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ecx, cx
and eax, edi
or eax, ecx
push eax
mov dword [ebp - 0x2c], ecx
call esi
push dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
call esi
push str.GetSystemDefaultUILanguage
push dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, ebx
movzx ebx, cx
and eax, edi
or eax, ebx
push eax
call esi
push ebx
mov dword [ebp - 0x40], eax
call esi
mov dword [ebp - 0x3c], eax
push 4
xor ebx, ebx
jmp 0x433fb6
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x433f64
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push str.Control_PanelDesktopResourceLocale
push SysReAllocStringLen
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433fb7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x433f59
cmp dword [ebp - 0x34], 1
jne 0x433f59
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x24]
push 0x43cbd4
push eax
call fcn.0041e00d
add esp, 0xc
cmp eax, 1
jne 0x433f59
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x28], eax
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
push 2
mov dword [ebp - 0x44], eax
pop esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x433fb7
push str.ntdll.dll
call edi
cmp eax, ebx
je 0x433fb7
lea ecx, [ebp - 0x28]
push ecx
push 0x433dfc
push 1
push 0x10
push eax
mov dword [ebp - 0x28], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
cmp word [ebp - 0x28], bx
je 0x433fb7
movzx eax, word [ebp - 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
and ecx, 0x3ff
movzx edi, cx
and eax, 0xfc00
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x48], eax
call esi
mov dword [ebp - 0x44], eax
push 2
pop esi
mov dword [ebp + esi*4 - 0x48], 0x800
inc esi
xor edi, edi
cmp esi, ebx
jle 0x433fdd
push dword [ebp + edi*4 - 0x48]
push dword [ebp + 8]
call fcn.00433d7d
cmp eax, ebx
pop ecx
pop ecx
jne 0x433fdf
inc edi
cmp edi, esi
jl 0x433fc6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0041c960
leave
ret 4
Function at 0x433fee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x449534
je 0x4340aa
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x434092
mov esi, dword [ebx + 4]
jmp 0x43408c
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43407c
cmp dword [ebp - 0xc], 4
jne 0x43407c
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x434074
or dword [eax + 0x9c], ecx
jmp 0x43407c
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x434040
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x434023
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x434466
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x438bf5
call fcn.0041ddac
sub esp, 0x220
mov eax, dword [0x44a2b0]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x228]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x43455f
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x434533
and dword [ebp - 4], eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.004010e0
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
mov byte [ebp - 4], 1
call fcn.00434466
mov ecx, dword [ebp - 0x224]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.004014d0
test bl, bl
jne 0x434533
or dword [ebp - 4], 0xffffffff
jmp 0x4344a4
cmp esi, 0x103
je 0x434543
cmp esi, 0x3f2
jne 0x434553
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0041c960
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x435254
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x435289
cmp edi, dword [esi + 0xc]
jge 0x435289
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x435289
cmp edi, dword [eax + 8]
jge 0x435289
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x43528b
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43538f
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4353c3
jmp fcn.00429d83
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x435434
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x43552d
cmp eax, dword [edi + 0xc]
jge 0x43552d
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x435485
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x435516
cmp dword [ebp + 0xc], ebx
je 0x435516
jmp 0x4354af
push 0x10
call fcn.00435120
cmp eax, ebx
je 0x43549b
mov ecx, eax
call fcn.00435386
mov esi, eax
jmp 0x43549d
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x4354c6
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x4354d6
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x4354e8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.00429d83
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0041ddd0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x435528
cmp ecx, dword [esi + 8]
jge 0x435528
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x43552e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4355ed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43561b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x435639
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00435557
jmp 0x435639
mov eax, dword [esi + 0x14]
test eax, eax
je 0x435639
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00435557
test edi, edi
mov eax, edi
jne 0x435623
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x44d2c4]
test ecx, ecx
je 0x4356ec
jmp 0x4355ec
ret 8
Function at 0x1001717b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100172c2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100171f9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100171d7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100171f4
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.100267ee
mov dword [eax], 0x674643a6
jmp 0x100171cc
jmp 0x100172c0
mov dword [ebp - 0x18], 0x37b
mov dword [ebp - 0x34], 0x10007c90
cmp dword [ebp - 0x18], 0x428
jle 0x100172a2
and dword [ebp - 0x14], 0
jmp 0x10017221
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x231c
jge 0x10017298
and dword [ebp - 8], 0
jmp 0x10017237
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1002
jge 0x10017296
and dword [ebp - 0xc], 0
jmp 0x1001724d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7471
jge 0x10017294
and dword [ebp - 0x10], 0
jmp 0x10017263
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x4331
jge 0x10017292
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
or eax, dword [ebp - 0x14]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1001725c
jmp 0x10017246
jmp 0x10017230
jmp 0x1001721a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [ebp - 0x18], 0xc1
jge 0x100172c0
mov edx, dword [ebp - 0x34]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x100172de
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
push 1
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.10017159
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001e920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001e947
push 1
push 0x34bf
push 0x7354
call fcn.1001ea73
add esp, 0xc
jmp 0x1001ea6f
lea eax, [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x574a
mov dword [ebp - 0x20], 0x10008e60
cmp dword [ebp - 0x14], 0x5925
jle 0x1001e9f4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
and dword [ebp - 8], 0
jmp 0x1001e97f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4c5
jge 0x1001e9f4
and dword [ebp - 0xc], 0
jmp 0x1001e995
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7bf
jge 0x1001e9f2
and dword [ebp - 0x10], 0
jmp 0x1001e9ab
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x11d3
jge 0x1001e9f0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x40]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x40]
call fcn.1002640c
jmp 0x1001e9a4
jmp 0x1001e98e
jmp 0x1001e978
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ea37
mov byte [ebp - 1], 0
push 0x1b5f
push 0xce0
push 0
lea eax, [ebp - 1]
push eax
push 0x433d
push 0x64d9
push 0x5759
push 1
push 0x782d
push 0x35d9
call fcn.10017d7d
add esp, 0x28
jmp 0x1001ea5d
mov byte [ebp - 2], 0
lea eax, [ebp - 2]
push eax
push 0xa60
push 0x3993
push 0xfed
push 0x7bef
push 0
call fcn.1001c88e
add esp, 0x18
cmp dword [ebp - 0x14], 0x5562
jge 0x1001ea6f
push dword [ebp - 0x20]
call fcn.10079103
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002a21f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov dword [esp + 0x10], 0x4dff
mov eax, edx
cmp dword [esp + 0x10], 0x4ef4
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jle 0x1002a2a4
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0xebd
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10094c18
xor eax, edi
cdq
push edx
push eax
call fcn.10026436
dec esi
dec dword [esp + 0x10]
jne 0x1002a25d
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x5c30
jl 0x1002a251
inc ebx
cmp ebx, 0x5453
jl 0x1002a24b
inc edi
cmp edi, 0x86
jl 0x1002a249
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x13]
push edx
push 0x4e10
push ecx
push eax
push 0x5785
call fcn.1002ba7b
add esp, 0x18
cmp dword [esp + 0x18], 0x4a85
jge 0x1002a2d8
mov edx, 0x10009a34
mov ecx, 0x10094c18
call fcn.10029186
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e3bc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1002e419
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push dword [ebp - 0x28]
push 0x522
push 0x2730
push dword [ebp - 0x2c]
call fcn.10033b36
add esp, 0x24
jmp 0x1002e524
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002e442
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002e43d
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002e524
mov dword [ebp - 0x14], 0x15be
mov dword [ebp - 0x38], 0x1000a0e8
cmp dword [ebp - 0x14], 0x1710
jle 0x1002e4ef
and dword [ebp - 0x10], 0
jmp 0x1002e46a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x40d9
jge 0x1002e4df
and dword [ebp - 8], 0
jmp 0x1002e480
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x55be
jge 0x1002e4dd
and dword [ebp - 0xc], 0
jmp 0x1002e496
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x4aad
jge 0x1002e4db
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x58]
call fcn.1002640c
jmp 0x1002e48f
jmp 0x1002e479
jmp 0x1002e463
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov byte [ebp - 2], 0
cmp dword [ebp - 0x14], 0x12fc
jge 0x1002e505
push dword [ebp - 0x38]
call fcn.10079103
pop ecx
push 1
push 0x33fc
lea eax, [ebp - 2]
push eax
push 0x7a2a
push 0
push 0x5935
call fcn.1002b2b5
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1004df86
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004e06b
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004e04d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004e04b
mov dword [ebp - 0x10], 0x511d
mov dword [ebp - 0x18], 0x1000c830
cmp dword [ebp - 0x10], 0x5166
jle 0x1004e02b
and dword [ebp - 8], 0
jmp 0x1004dfe0
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2492
jge 0x1004e023
and dword [ebp - 0xc], 0
jmp 0x1004dff6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x4d03
jge 0x1004e021
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
mov eax, edx
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10094c18
call fcn.10026436
jmp 0x1004dfef
jmp 0x1004dfd9
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 0
call dword [sym.imp.USER32.dll_SetCaretPos]
cmp dword [ebp - 0x10], 0x4d53
jge 0x1004e04b
mov edx, dword [ebp - 0x18]
mov ecx, 0x10094c18
call fcn.10029186
jmp 0x1004e069
mov byte [ebp - 2], 0
push 0
push 0x6966
lea eax, [ebp - 2]
push eax
push 0xdcb
call fcn.10053bc6
add esp, 0x10
jmp 0x1004e0aa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
push 0xd10
push 0x41f
push 0x8f8
push 0x635a
push 0x74ab
push dword [ebp - 0x1c]
push 0x2e5c
push dword [ebp - 0x20]
push 0
push 0x34c8
call fcn.10054982
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x1005193d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100519ec
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100519be
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1005199f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100519bc
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100267ee
mov dword [eax], 1
jmp 0x10051994
jmp 0x100519ea
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100519ea
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10051a42
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10051a2c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10051a42
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10051a42
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
mov esp, ebp
pop ebp
ret
Function at 0x1005396b
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10053a90
lea eax, [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10053a86
mov dword [ebp - 0x14], 0x6f4
mov dword [ebp - 0x24], 0x1000d340
cmp dword [ebp - 0x14], 0xa12
jle 0x10053a5b
and dword [ebp - 0x10], 0
jmp 0x100539bf
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2101
jge 0x10053a5b
and dword [ebp - 4], 0
jmp 0x100539d9
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x215b
jge 0x10053a56
and dword [ebp - 8], 0
jmp 0x100539ef
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x5182
jge 0x10053a51
and dword [ebp - 0xc], 0
jmp 0x10053a05
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x221c
jge 0x10053a4f
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar eax, cl
and eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.100127de
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.10026416
push eax
call fcn.10079103
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1002640c
jmp 0x100539fe
jmp 0x100539e8
jmp 0x100539d2
jmp 0x100539b8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x14], 0x6d3
jge 0x10053a73
push dword [ebp - 0x24]
call fcn.10079103
pop ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0xc], 0
jmp 0x10053a8e
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x10053ae9
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10053abe
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x10053ae9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.100267ee
mov dword [eax], 0x9ce4
mov esp, ebp
pop ebp
ret