joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012846
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x10382cc], 0x20
jne 0x10129c7
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10129c7
mov eax, dword [0x1038258]
test byte [eax], 1
push esi
push edi
je 0x10128b2
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x10129bf
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push edi
call fcn.010124ad
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10129bf
push ebx
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x10129be
mov esi, dword [0x1038258]
push ebx
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [esi + 0x58]
mov eax, dword [esi + 0x40]
push eax
push dword [esi + 0x44]
push 4
push eax
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x10129b4
push dword [0x1038268]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x101299d
push dword [0x1038268]
call edi
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1012994
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call edi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 0x10]
call edi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 8]
call edi
push dword [esi + 0x58]
push dword [esi + 0x40]
push dword [esi + 0x44]
push dword [ebp - 0x20]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetDIBits]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push ebx
push dword [0x1038260]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
leave
ret
Function at 0x1014d43
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x1014eb5
cmp word [ebx + 0x18], 0
je 0x1014eb5
mov cx, word [ebp + 0x10]
test cx, cx
jne 0x1014d71
xor eax, eax
jmp 0x1014eba
cmp word [ebx + 0x10], 0
je 0x1014d98
movsx eax, word [ebx + 0x12]
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x1014d98
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1014eda
xor esi, esi
mov dword [ebp + 8], esi
cmp dword [ebp + 0x14], esi
je 0x1014dca
movzx eax, word [ebx + 0x14]
push 1
push eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.0101457a
movzx eax, ax
cmp ax, 0xffff
je 0x1014dca
push eax
push ebx
call fcn.01014429
mov dword [ebp + 8], eax
movzx eax, word [ebx + 0x10]
movzx ecx, word [ebx + 0x18]
inc word [ebx + 0x12]
cmp ax, cx
jge 0x1014de2
inc eax
mov word [ebx + 0x10], ax
jmp 0x1014e32
movzx eax, word [ebx + 0x12]
cmp ax, cx
jl 0x1014df1
xor eax, eax
mov word [ebx + 0x12], ax
inc word [ebx + 0x16]
movzx eax, word [ebx + 0x16]
cmp ax, cx
jl 0x1014e04
xor eax, eax
mov word [ebx + 0x16], ax
movsx eax, word [ebx + 0x12]
push dword [ebx + eax*4 + 0x28]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ax, word [ebx + 0x14]
cmp ax, word [ebx + 0x12]
jne 0x1014e32
mov eax, 0xffffffff
mov word [ebx + 0x14], ax
movzx eax, word [ebx + 0x14]
cmp ax, 0xffff
je 0x1014e59
mov cx, word [ebp + 0x10]
cwde
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x1014e59
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x1014e5f
push ebx
call fcn.01014d22
movsx eax, word [ebx + 0x12]
lea esi, [ebx + eax*4 + 0x28]
mov eax, dword [ebp + 8]
test eax, eax
je 0x1014e72
mov dword [esi], eax
jmp 0x1014eda
movzx edi, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edx, [edi + 2]
push edx
add ecx, 0xc0000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi], eax
test eax, eax
jne 0x1014ec1
cmp word [ebx + 0x12], ax
jg 0x1014ead
mov ax, word [ebx + 0x10]
mov word [ebx + 0x12], ax
dec word [ebx + 0x12]
dec word [ebx + 0x10]
mov eax, 0xc0000017
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov cx, word [ebp + 0x10]
mov word [eax], cx
mov eax, dword [esi]
push edi
push dword [ebp + 0xc]
inc eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
or dword [ebx + 8], 2
jmp 0x1014d6a
Function at 0x1014f62
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x1014f73
xor eax, eax
jmp 0x1014ff2
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x18]
movzx eax, di
shr eax, 4
xor esi, esi
inc eax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1014fe2
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1014fe2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1014fe2
and edi, 0xf
jmp 0x1014fb6
dec edi
lea eax, [eax + esi*2]
movzx esi, word [eax]
inc eax
inc eax
test edi, edi
jne 0x1014fb2
cmp dword [ebp + 0x14], edi
jne 0x1014fc8
mov dword [ebx], eax
jmp 0x1014fee
dec dword [ebp + 0x14]
cmp esi, dword [ebp + 0x14]
jbe 0x1014fd3
mov esi, dword [ebp + 0x14]
lea ecx, [esi + esi]
push ecx
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x1014fee
xor eax, eax
mov word [ebx + esi*2], ax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x1015203
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x14
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov esi, eax
test esi, esi
jne 0x101523e
mov eax, 0xc0000017
jmp 0x1015310
movzx edx, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 4], edx
call edi
mov dword [esi + 0xc], eax
test eax, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
jne 0x101527f
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1015234
mov ecx, dword [0x1038030]
push ebx
movzx ebx, word [ebp + 0x18]
push ebx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10152ce
push dword [esi + 0xc]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
mov eax, 0xc0000017
jmp 0x101530f
push dword [ebp - 4]
mov ax, word [ebp + 0x10]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_memmove]
push dword [esi + 0xc]
mov word [esi + 8], ax
mov ax, word [ebp + 0x18]
mov word [esi + 0xa], ax
call edi
push ebx
push dword [ebp + 0x14]
push dword [esi + 0x10]
call edi
mov eax, dword [ebp + 8]
add eax, 0x10
mov ecx, dword [eax]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [ecx + 4], esi
add esp, 0x18
mov dword [eax], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x14
Function at 0x1015395
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [eax + 4], ecx
push dword [esi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
push dword [esi + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x101a5e5
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x10]
test esi, esi
je 0x101a647
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x28]
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test al, 2
je 0x101a627
push dword [esi + 0x34]
and eax, 0xfffffffd
mov dword [esi + 0x28], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
and dword [ebx + 0x10], 0
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x101a652
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x1038250]
cmp ebx, 0x1038250
je 0x101a6c9
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, ebx
mov eax, dword [esi + 8]
mov ebx, dword [ebx]
cmp eax, dword [ebp + 8]
jne 0x101a6bf
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov dword [eax + 4], ecx
mov eax, dword [esi + 0x28]
test al, 2
je 0x101a6a4
push dword [esi + 0x34]
and eax, 0xfffffffd
mov dword [esi + 0x28], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.ntdll.dll_RtlDeleteCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
cmp ebx, 0x1038250
jne 0x101a66e
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x101addf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101ae1e
cmp dword [ebp - 8], 2
jne 0x101ae1e
movzx eax, word [ebp - 4]
push 1
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101ae1e
inc esi
mov eax, esi
pop esi
leave
ret 4

Function at 0x101ae2a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101ae70
cmp dword [ebp - 4], 4
jne 0x101ae70
mov eax, dword [ebp - 8]
cmp eax, 4
jbe 0x101ae70
push 1
push esi
add eax, 0xfffffffc
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101ae70
inc esi
mov eax, esi
pop esi
leave
ret 4
Function at 0x101ae7c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101aed2
cmp dword [ebp - 8], 2
jne 0x101aed2
mov eax, 0x104
cmp word [ebp - 4], ax
ja 0x101aed2
movzx ecx, word [ebp - 4]
xor eax, eax
cmp dword [ebp + 0xc], esi
push 1
setne al
push esi
inc eax
imul eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101aed2
inc esi
mov eax, esi
pop esi
leave
ret 8

Function at 0x101aede
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x11c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push 0
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x114]
push eax
push 2
lea eax, [ebp - 0x110]
push eax
push ebx
call esi
test eax, eax
je 0x101afe9
cmp dword [ebp - 0x114], 2
jne 0x101afe9
mov eax, 0x104
cmp word [ebp - 0x110], ax
ja 0x101afe9
movzx edi, word [ebp - 0x110]
cmp edi, dword [ebp + 0x14]
jae 0x101afe9
xor eax, eax
cmp dword [ebp + 0xc], eax
push eax
lea eax, [ebp - 0x114]
push eax
je 0x101af97
add edi, edi
push edi
push dword [ebp - 0x118]
push ebx
call esi
test eax, eax
je 0x101afe9
cmp dword [ebp - 0x114], edi
jne 0x101afe9
movzx eax, word [ebp - 0x110]
mov edx, dword [ebp - 0x118]
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x101afdd
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
call esi
test eax, eax
je 0x101afe9
cmp dword [ebp - 0x114], edi
jne 0x101afe9
push dword [ebp + 0x14]
movzx eax, word [ebp - 0x110]
push dword [ebp - 0x118]
mov byte [ebp + eax - 0x10c], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x101afe9
mov dword [ebp - 0x11c], 1
jmp 0x101affa
cmp dword [ebp + 0x14], 0
jbe 0x101affa
mov ecx, dword [ebp - 0x118]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100158a
leave
ret 0x10

Function at 0x101b016
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
lea eax, [ebp + 0xc]
push eax
mov edi, 0xc4
push edi
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
mov dword [esi], 0xcc
mov dword [esi + 4], 0xa0000002
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101b080
cmp dword [ebp + 0xc], edi
jne 0x101b080
mov eax, 0x7fff
cmp dword [esi + 0x80], eax
ja 0x101b080
cmp dword [esi + 0x84], eax
ja 0x101b080
cmp word [esi + 0xc], 0
jl 0x101b080
cmp word [esi + 0xe], 0
jl 0x101b080
mov dword [ebp - 4], 1
jmp 0x101b090
push 0xcc
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x101b09e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
push esi
lea ecx, [ebp + 0xc]
push ecx
mov dword [eax], 0xc
mov dword [eax + 4], 0xa0000004
push 4
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101b0d5
cmp dword [ebp + 0xc], 4
jne 0x101b0d5
inc esi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x101b227
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x214], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x210], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01005512
test eax, eax
jl 0x101b3a8
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x101b28d
mov word [ebp - 0x20c], ax
jmp 0x101b29e
xor ecx, ecx
push 0x5c
push esi
mov word [eax + 2], cx
call edi
mov esi, eax
pop ecx
inc esi
pop ecx
inc esi
push 0x101b3f4
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0101b1b1
test eax, eax
jl 0x101b3a8
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x210]
push 0
push esi
push 0x101b3cc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x101b36d
mov eax, dword [ebp - 0x210]
cmp word [eax], 0x40
jne 0x101b3a8
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x101b3a8
cmp eax, ebx
ja 0x101b3a8
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ad8e
test eax, eax
je 0x101b3a8
push 2
push 0
lea eax, [ebp - 0x20a]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x101b3a8
push dword [ebp + 0x10]
push dword [ebp - 0x210]
push dword [ebp - 0x218]
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x101b364
mov dword [ebp - 0x214], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x101b39f
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x210]
call fcn.01005512
test eax, eax
jl 0x101b3a8
push 0x2e
push dword [ebp - 0x210]
call edi
pop ecx
pop ecx
test eax, eax
je 0x101b395
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x214], 0
jne 0x101b3b9
cmp dword [ebp + 0x10], 0
jbe 0x101b3b9
mov ecx, dword [ebp - 0x210]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100158a
leave
ret 0xc
Function at 0x101bcbc
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x14
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
push dword [0x1038040]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [ebp + 0xc], 0
mov edi, eax
je 0x101bd20
push 0
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x100
lea eax, [ebp - 0x22c]
push eax
call fcn.0101bb62
mov esi, dword [ebp - 0x230]
push 0x20
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x101bd26
lea esi, [ebp - 0x22c]
mov eax, 0xff
sub eax, edi
push eax
push esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x101bd74
cmp dword [ebp + 0xc], 0
je 0x101bd4d
lea eax, [ebp - 0x22c]
jmp 0x101bd67
push edi
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x101bd74
lea eax, [ebp + edi*2 - 0x22a]
push eax
push dword [0x1038260]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100158a
leave
ret 8

Function at 0x101bf05
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2d4]
cmp dword [ebp + 0xc], ebx
je 0x101bf3e
push 0xc4
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x101bf4b
push eax
call fcn.0101bd89
and dword [ebp - 0x274], 0xffffffbf
mov eax, dword [ebp + 0xc]
shl eax, 7
xor eax, dword [ebp - 0x274]
mov dword [ebp - 0x224], edi
and eax, 0x80
xor dword [ebp - 0x274], eax
call fcn.01001505
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jae 0x101bff2
push 0x101c024
sub esi, eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101b1b1
test eax, eax
jl 0x101bff2
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2d8], eax
cmp eax, ebx
je 0x101bff2
push 0x101c040
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x101bfe6
push ebx
push ebx
push 1
push edi
call esi
push ebx
lea eax, [ebp - 0x2d4]
push eax
push 5
push edi
call esi
push ebx
push ebx
push 7
push edi
call esi
push dword [ebp - 0x2d8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.01001579
cmp dword [ebp + 0xc], ebx
pop edi
pop esi
pop ebx
jne 0x101c014
test byte [ebp - 0x274], 0x40
je 0x101c014
lea eax, [ebp - 0x2d4]
push eax
call fcn.0101b80a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100158a
leave
ret 8
Function at 0x101dd77
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi], ebx
je 0x101ddd6
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [edi + 4]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
pop ebp
ret 4

Function at 0x10203d5
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x4000000
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0xf001f
push edi
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ntdll.dll_NtCreateSection]
cmp eax, esi
jl 0x102049c
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push 4
push esi
push 2
push ebx
push esi
push dword [ebp + 0xc]
mov dword [eax], esi
push esi
push eax
push 0xffffffffffffffff
mov dword [ebx], esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
mov dword [ebp + 8], eax
jge 0x102045c
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp + 8]
jmp 0x102049b
mov eax, dword [ebp + 0x1c]
push 4
push 0x100000
push 2
push ebx
push esi
push dword [ebp + 0xc]
mov dword [eax], esi
push esi
push eax
push dword [ebp + 0x18]
mov dword [ebx], esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
cmp ebx, esi
jge 0x1020499
mov eax, dword [ebp + 0x10]
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x18

Function at 0x1020772
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi + 2]
push 1
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, word [esi]
pop esi
test cl, 3
je 0x1020796
or eax, 0x100
test cl, 4
je 0x10207a0
or eax, 0x200
test cl, 8
je 0x10207aa
or eax, 0x400
pop ebp
ret 4
Function at 0x1023f71
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1038416], 0
je 0x1023f85
pop ebp
jmp fcn.01033763
pop ebp
jmp fcn.01002d70

Function at 0x1023fdb
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1038416], 0
je 0x1023fef
pop ebp
jmp fcn.0103540a
pop ebp
jmp fcn.01002351