joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101fa271
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov ecx, dword [esi]
test ecx, ecx
je 0x101fa286
mov eax, dword [ecx - 4]
jmp 0x101fa288
xor eax, eax
mov edx, dword [ebp + 8]
test edx, edx
js 0x101fa343
cmp edx, eax
jge 0x101fa343
dec eax
mov dword [ebp + 8], eax
push edi
test eax, eax
jle 0x101fa313
cmp edx, eax
jge 0x101fa2be
sub eax, edx
lea ecx, [ecx + edx*4]
shl eax, 2
push eax
lea eax, [ecx + 4]
push eax
push ecx
call fcn.1027a3ab
add esp, 0xc
push dword [0x1065880c]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x101fa309
push ebx
push dword [0x1065880c]
call edi
mov edi, dword [esi]
mov ebx, eax
push 0
push SysReAllocString
push 0
mov esi, dword [ebx]
sub edi, 4
push 4
push dword [ebp + 8]
call fcn.101b7f4d
push eax
push edi
mov ecx, ebx
call dword [esi + 8]
mov esi, dword [ebp - 4]
pop ebx
test eax, eax
je 0x101fa309
add eax, 4
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [eax - 4], ecx
jmp 0x101fa33d
push dword [0x1065880c]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x101fa33a
push dword [0x1065880c]
call edi
mov ecx, dword [esi]
sub ecx, 4
push ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
and dword [esi], 0
xor eax, eax
inc eax
pop edi
jmp 0x101fa345
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x101fa36f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jle 0x101fa3e4
cmp edi, dword [ebp + 0xc]
je 0x101fa3e4
push dword [0x1065880c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x101fa3da
push dword [0x1065880c]
call esi
mov ecx, dword [ebx]
mov edx, eax
mov dword [ebp + 0xc], edx
test ecx, ecx
je 0x101fa3b0
lea eax, [ecx - 4]
mov dword [ebp + 8], eax
jmp 0x101fa3b4
and dword [ebp + 8], 0
mov esi, dword [edx]
push 0
push SysReAllocString
push 0
push 4
push edi
call fcn.101b7f4d
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [esi + 8]
test eax, eax
je 0x101fa3e4
add eax, 4
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax - 4], edi
xor eax, eax
inc eax
jmp 0x101fa3e6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x101fa6f1
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x101fa752
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax]
mov eax, dword [esi + 0x100]
mov dword [esi + eax*4], edi
inc dword [esi + 0x100]
cmp dword [esi + 0x100], 0x40
jl 0x101fa752
push dword [0x1065880c]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x101fa74b
push dword [0x1065880c]
call edi
push 0x50
lea ecx, [esi + 0x80]
push ecx
mov edx, dword [eax]
mov ecx, eax
push 0x20
call dword [edx + 0x14]
add dword [esi + 0x100], 0xffffffe0
pop edi
pop esi
pop ebp
ret 4
Function at 0x101fab47
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x100]
mov eax, dword [esi]
test eax, eax
jg 0x101fab7a
push dword [0x1065880c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0x50
push 0x20
push edi
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx + 0xc]
mov eax, dword [esi]
test eax, eax
jne 0x101fab7a
xor esi, esi
jmp 0x101fab98
dec eax
push 0x50
mov dword [esi], eax
push 0
mov esi, dword [edi + eax*4]
push esi
call fcn.1027bff1
add esp, 0xc
test esi, esi
je 0x101fab98
mov ecx, esi
call fcn.101fa47d
pop edi
mov eax, esi
pop esi
ret

Function at 0x101fc580
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
and dword [eax], 0
test byte [ecx + 0x38], 0x80
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], eax
jne 0x101fc5b1
push 2
pop eax
jmp 0x101fc687
mov ecx, dword [edx + 4]
push esi
push edi
cmp dword [ecx + 0x10], 0
je 0x101fc63b
mov eax, dword [ecx + 0x10]
mov byte [ecx + 0x28], 1
push dword [0x1065a1cc]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edi, [eax + 8]
mov ecx, edi
call fcn.1024d2a3
mov esi, eax
test esi, esi
je 0x101fc661
push esi
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_GetClipRgn]
cmp eax, 0xffffffff
jne 0x101fc5fb
push esi
mov ecx, edi
call fcn.1024d2f4
jmp 0x101fc661
test eax, eax
jne 0x101fc609
push esi
mov ecx, edi
call fcn.1024d2f4
xor esi, esi
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov ebx, eax
cmp ebx, 1
jne 0x101fc632
test esi, esi
je 0x101fc632
push esi
mov ecx, edi
call fcn.1024d2f4
jmp 0x101fc637
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov eax, ebx
jmp 0x101fc685
lea eax, [ebp - 0x14]
push eax
call fcn.10196f57
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x101fc682
push 0x10
call sym.osetup.dll_void____stdcall_NetUI::HAlloc_unsigned_long_int_
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x101fc665
xor eax, eax
jmp 0x101fc685
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, eax
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ecx + 4]
call fcn.10197001
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push 2
pop eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x101fcfc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.1019b49a
test eax, eax
je 0x101fd08b
mov esi, dword [eax + 0x18]
test esi, esi
je 0x101fd08b
mov edi, dword [ebp + 8]
test edi, edi
je 0x101fd08b
cmp dword [esi + 0x50], 0
je 0x101fd008
push dword [ebp + 0xc]
push edi
call fcn.101fceaf
jmp 0x101fd08d
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call ebx
test ax, ax
js 0x101fd029
push 4
call ebx
test ax, ax
js 0x101fd029
push 2
call ebx
test ax, ax
jns 0x101fd08b
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x50], edi
test ecx, ecx
je 0x101fd03e
mov eax, dword [ecx]
mov dword [esi + 0x54], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x58], eax
mov ecx, edi
call fcn.1019b4c2
mov edi, eax
mov ecx, edi
call fcn.101fd0cf
and dword [ebp - 0xc], 0
mov ecx, edi
call fcn.1019b4c2
mov esi, dword [eax + 0x50]
call fcn.1019b49a
push eax
push esi
push 1
lea ecx, [ebp - 0xc]
call fcn.101f90a3
test eax, eax
je 0x101fd07e
push 0
lea ecx, [ebp + 8]
push ecx
mov ecx, edi
call fcn.101fdba2
lea ecx, [ebp - 0xc]
call fcn.101f8f0d
xor eax, eax
inc eax
jmp 0x101fd08d
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x101fed1d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x101fed59
add eax, 0xfffffff8
je 0x101fed59
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x101fed3f
add ecx, 0xfffffff8
jmp 0x101fed41
xor ecx, ecx
mov eax, dword [eax + 0x28]
cmp eax, esi
jae 0x101fed4e
mov esi, eax
test eax, eax
je 0x101fed54
mov eax, ecx
test ecx, ecx
jne 0x101fed33
cmp esi, 0xa
jbe 0x101feda5
push ebx
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov eax, dword [edi + 0x20]
test eax, eax
je 0x101fed74
add eax, 0xfffffff8
jmp 0x101fed76
xor eax, eax
test eax, eax
je 0x101feda4
mov edx, dword [eax + 8]
test edx, edx
je 0x101fed86
add edx, 0xfffffff8
jmp 0x101fed88
xor edx, edx
cmp dword [eax + 0x10], ebx
jne 0x101fed9e
mov eax, dword [eax + 0x44]
sub eax, dword [ebp + 8]
push 0
pop ecx
cmovns ecx, eax
cmp ecx, esi
cmovb esi, ecx
mov eax, edx
test edx, edx
jne 0x101fed7a
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x101ff4ee
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10669f04]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
test eax, eax
jne 0x101ff5b6
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push edi
push eax
call fcn.1027bff1
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jbe 0x101ff567
mov dword [0x10669f04], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4
jne 0x101ff5ae
xor esi, esi
inc esi
cmp dword [ebp - 0x110], esi
jb 0x101ff59a
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x101ff5a6
cmp dword [ebp - 0x11c], edi
je 0x101ff5a6
mov dword [0x10669f04], 2
jmp 0x101ff5bb
mov dword [0x10669f04], esi
jmp 0x101ff552
push 2
pop eax
mov dword [0x10669f04], eax
cmp eax, 2
jne 0x101ff552
mov esi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push edi
call esi
mov edi, eax
push edi
call esi
xor esi, esi
test edi, edi
je 0x101ff5dd
push ebx
call edi
mov esi, eax
test esi, esi
je 0x101ff5dd
cmp esi, 1
jne 0x101ff5e5
push 0
call fcn.100e01e5
pop ecx
mov eax, esi
jmp 0x101ff554
Function at 0x10239781
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [0x10669fa8]
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x10239907
xor eax, eax
cmp dword [0x10669fa4], eax
jne 0x1023991a
push eax
push eax
push str.UIAutomationCore.DLL
mov dword [0x10669fa4], 1
call fcn.10012074
mov esi, eax
test esi, esi
je 0x102397e3
push esi
call fcn.10239933
test eax, eax
jne 0x102398de
and dword [ebp - 0x214], 0
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftMOTIF16.0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102398de
and dword [ebp - 0x218], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x21c], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.UiaCorePath
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102398d2
cmp dword [ebp - 0x218], 1
jne 0x102398d2
mov eax, dword [ebp - 0x21c]
cmp eax, 2
jbe 0x102398d2
shr eax, 1
xor esi, esi
lea ecx, [eax + eax]
cmp word [ebp + ecx - 0x212], si
je 0x1023988a
cmp ecx, 0x20a
jae 0x1023992d
xor edx, edx
mov word [ebp + ecx - 0x210], dx
jmp 0x1023988b
dec eax
cmp word [ebp + eax*2 - 0x212], 0x5c
je 0x102398ac
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x103334e8
call fcn.102ded4b
push 0x104
lea eax, [ebp - 0x210]
push eax
push str.UIAutomationCore.DLL
call fcn.102ded4b
push esi
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.10012074
mov esi, eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x102398f0
push 0x646e6d75
call fcn.10153dc1
xor eax, eax
jmp 0x1023991a
push esi
call fcn.10239933
test eax, eax
jne 0x10239901
push 0x646e6d76
jmp 0x102398e7
mov dword [0x10669fa8], esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov dword [edi], eax
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
call fcn.10279be9
int3
Function at 0x10239933
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
push 0x208
xor edi, edi
push edi
push eax
call fcn.1027bff1
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x10239a38
cmp word [ebp - 0x20c], di
je 0x10239a38
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jne 0x102399ae
push 0x646e6d71
jmp 0x10239a3d
push ebx
call sym.osetup.dll_void____stdcall_NetUI::HAlloc_unsigned_long_int_
mov esi, eax
test esi, esi
jne 0x102399c1
push 0x646e6d72
jmp 0x10239a3d
push esi
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x102399db
push 0x646e6d73
jmp 0x10239a29
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x214]
push eax
push 0x103334e8
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10239a24
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x10239a24
mov ecx, 0x60001
cmp dword [eax + 8], ecx
jbe 0x10239a17
xor edi, edi
inc edi
jmp 0x10239a2e
jne 0x10239a2e
cmp dword [eax + 0xc], 0x194c0001
jb 0x10239a2e
jmp 0x10239a12
push 0x646e6d74
call fcn.10153dc1
push esi
call sym.osetup.dll_void___stdcall_NetUI::HFree_void__
mov eax, edi
jmp 0x10239a44
push 0x646e6c73
call fcn.10153dc1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 4

Function at 0x1023b257
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jle 0x1023b2cc
cmp edi, dword [ebp + 0xc]
je 0x1023b2cc
push dword [0x1065880c]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x1023b2c2
push dword [0x1065880c]
call esi
mov ecx, dword [ebx]
mov edx, eax
mov dword [ebp + 0xc], edx
test ecx, ecx
je 0x1023b298
lea eax, [ecx - 8]
mov dword [ebp + 8], eax
jmp 0x1023b29c
and dword [ebp + 8], 0
mov esi, dword [edx]
push 0
push SysReAllocString
push 0
push 8
push edi
call fcn.101afac0
mov ecx, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [esi + 8]
test eax, eax
je 0x1023b2cc
add eax, 8
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [eax - 8], edi
xor eax, eax
inc eax
jmp 0x1023b2ce
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1024c9fd
Capabilities:
Get thread local storage value

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x40]
call fcn.1024c9e3
lea ecx, [esi + 0x20]
call fcn.1024c9e3
mov ecx, esi
pop esi
push esi
mov esi, ecx
or dword [esi + 0x9c], 2
mov ecx, dword [esi + 0x74]
test ecx, ecx
je 0x1024ca28
push esi
push 0x1024cb6d
call fcn.101f9bb6
test eax, eax
je 0x1024ca24
mov ecx, esi
call fcn.1024cb84
and dword [esi + 0x74], 0
push 1
lea ecx, [esi + 0x78]
call fcn.1024cf6d
lea ecx, [esi + 0x68]
call fcn.1024d4eb
lea ecx, [esi + 8]
pop esi
jmp 0x1024c9cd
Function at 0x1024caa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1024cabf
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
jmp 0x1024cb4a
push ebx
push esi
push edi
mov edi, 0x80070057
call fcn.1024c904
mov esi, eax
test esi, esi
jne 0x1024cad7
add edi, 0xffffffb7
jmp 0x1024cb3f
mov eax, dword [esi + 0x9c]
mov ebx, 0x1065d058
xor eax, dword [ebp + 8]
and eax, 1
xor dword [esi + 0x9c], eax
lea eax, [esi + 0x94]
mov dword [ebp + 8], eax
mov ecx, dword [ebx]
push esi
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test eax, eax
je 0x1024cb39
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov edi, eax
test edi, edi
js 0x1024cb39
add dword [ebp + 8], 4
add ebx, 4
cmp ebx, 0x1065d05c
jl 0x1024caf7
push esi
push dword [0x1065a1cc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
xor eax, eax
jmp 0x1024cb47
push esi
call fcn.101f91ed
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1024cd94
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 4], esi
mov ecx, dword [esi]
test ecx, ecx
je 0x1024cda9
mov eax, dword [ecx - 8]
jmp 0x1024cdab
xor eax, eax
mov edx, dword [ebp + 8]
test edx, edx
js 0x1024ce66
cmp edx, eax
jge 0x1024ce66
dec eax
mov dword [ebp + 8], eax
push edi
test eax, eax
jle 0x1024ce36
cmp edx, eax
jge 0x1024cde1
sub eax, edx
lea ecx, [ecx + edx*8]
shl eax, 3
push eax
lea eax, [ecx + 8]
push eax
push ecx
call fcn.1027a3ab
add esp, 0xc
push dword [0x1065880c]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x1024ce2c
push ebx
push dword [0x1065880c]
call edi
mov edi, dword [esi]
mov ebx, eax
push 0
push SysReAllocString
push 0
mov esi, dword [ebx]
sub edi, 8
push 8
push dword [ebp + 8]
call fcn.101afac0
push eax
push edi
mov ecx, ebx
call dword [esi + 8]
mov esi, dword [ebp - 4]
pop ebx
test eax, eax
je 0x1024ce2c
add eax, 8
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
mov dword [eax - 8], ecx
jmp 0x1024ce60
push dword [0x1065880c]
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call edi
test eax, eax
je 0x1024ce5d
push dword [0x1065880c]
call edi
mov ecx, dword [esi]
sub ecx, 8
push ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
and dword [esi], 0
xor eax, eax
inc eax
pop edi
jmp 0x1024ce68
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1024ce6f
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1024cd94
Function at 0x1024ceaf
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
jns 0x1024cec3
xor eax, eax
jmp 0x1024cf68
push esi
push edi
cmp ecx, dword [ebx + 0x18]
jle 0x1024cf06
push dword [0x1065880c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
push SysReAllocString
push 0
push dword [ebp + 8]
mov esi, eax
push 1
mov edi, dword [esi]
call fcn.101b7f4d
push eax
mov ecx, esi
call dword [edi + 4]
mov ecx, eax
test ecx, ecx
je 0x1024cf40
mov eax, dword [ebx + 0xc]
mov dword [ecx], eax
lea eax, [ecx + 4]
mov dword [ebx + 0xc], ecx
jmp 0x1024cf66
cmp dword [ebx + 8], 0
je 0x1024cf11
cmp ecx, dword [ebx + 0x10]
jle 0x1024cf5b
push dword [0x1065880c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 1
push SysReAllocString
push 0
push dword [ebx + 0x14]
mov edi, eax
push 1
mov esi, dword [edi]
call fcn.101b7f4d
push eax
mov ecx, edi
call dword [esi + 4]
mov ecx, eax
test ecx, ecx
jne 0x1024cf44
xor eax, eax
jmp 0x1024cf66
mov eax, dword [ebx + 8]
mov dword [ecx], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x10], eax
lea eax, [ecx + 4]
mov dword [ebx + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
sub dword [ebx + 0x10], ecx
add ecx, eax
mov dword [ebx + 4], ecx
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x1024cf6d
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xc]
test edi, edi
je 0x1024cfad
mov eax, dword [edi]
push dword [0x1065880c]
mov dword [ebp - 4], eax
call ebx
test eax, eax
je 0x1024cfa4
push dword [0x1065880c]
call ebx
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp - 4]
mov edi, eax
test eax, eax
jne 0x1024cf83
and dword [esi + 0xc], 0
mov edi, dword [esi + 8]
test edi, edi
je 0x1024cffc
mov eax, dword [edi]
mov dword [ebp - 4], eax
test eax, eax
jne 0x1024cfc6
cmp dword [ebp + 8], eax
je 0x1024cfed
push dword [0x1065880c]
call ebx
test eax, eax
je 0x1024cfe2
push dword [0x1065880c]
call ebx
push edi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp - 4]
mov edi, eax
test eax, eax
jne 0x1024cfb8
jmp 0x1024cffc
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
lea eax, [edi + 4]
mov dword [esi + 8], edi
mov dword [esi + 4], eax
cmp dword [ebp + 8], 0
je 0x1024d00e
and dword [esi + 8], 0
and dword [esi + 4], 0
and dword [esi + 0x10], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1024d85f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push 0
push edi
call fcn.1027bff1
add esp, 0xc
mov dword [edi], esi
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [edi + 0x18], 0
mov dword [edi + 0x1c], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1024d907
mov eax, 0x80
test byte [ebp - 0x103], al
je 0x1024d8b7
or dword [edi + 0x18], 0x40
test byte [ebp - 0x102], al
je 0x1024d8c2
or dword [edi + 0x18], eax
test byte [ebp - 0x100], al
je 0x1024d8d1
or dword [edi + 0x18], 0x100
test byte [ebp - 0x64], al
je 0x1024d8da
or dword [edi + 0x18], 4
test byte [ebp - 0x63], al
je 0x1024d8e3
or dword [edi + 0x18], 8
test byte [ebp - 0x62], al
je 0x1024d8ec
or dword [edi + 0x18], 1
test byte [ebp - 0x61], al
je 0x1024d8f5
or dword [edi + 0x18], 2
test byte [ebp - 0x60], al
je 0x1024d8fe
or dword [edi + 0x18], 0x10
test byte [ebp - 0x5f], al
je 0x1024d907
or dword [edi + 0x18], 0x20
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8
Function at 0x1026b666
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov edx, edi
sar edx, 5
mov ebx, edi
inc edx
mov esi, edi
cmp edi, edx
jl 0x1026b69e
mov edi, dword [ebp + 0xc]
movzx ecx, byte [edi + esi - 1]
mov eax, ebx
shl eax, 5
sub esi, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, eax
xor ebx, ecx
cmp esi, edx
jge 0x1026b680
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov esi, dword [eax + ecx*4]
jmp 0x1026b6cc
cmp dword [esi + 0xc], edi
jne 0x1026b6ca
push edi
lea eax, [esi + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.1027c66d
add esp, 0xc
test eax, eax
je 0x1026b6e4
mov esi, dword [esi]
test esi, esi
jne 0x1026b6b1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1026b89e
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
mov edi, dword [ebp + 8]
mov al, byte [esi + 5]
movzx edx, al
and edx, 3
mov ecx, dword [edi + 0x10]
movzx ecx, byte [ecx + 0x14]
not ecx
test cl, dl
je 0x1026b702
xor al, 3
mov byte [esi + 5], al
mov eax, esi
jmp 0x1026b6dd

Function at 0x102808c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x102b0d9d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.102b0c1c

Function at 0x102b3651
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.102b3311