joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009acd0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1017bd2b
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
push esi
push edi
mov eax, dword [0x101ce2ac]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov ecx, dword [esp + 0xe4]
mov edx, dword [esp + 0xe0]
mov esi, dword [esp + 0xdc]
mov eax, dword [esp + 0xd8]
mov edi, dword [esp + 0xd0]
push ecx
push edx
push esi
push eax
mov eax, dword [esp + 0xe4]
push eax
lea ecx, [esp + 0x64]
push ecx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], 0
call fcn.10094be0
add esp, 0x18
mov dword [esp + 0xc8], 1
test eax, eax
lea ecx, [esp + 0x1c]
call fcn.101089f7
mov byte [esp + 0xc8], 2
mov esi, esi
mov eax, dword [esp + 0x64]
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call fcn.1006e6e0
add esp, 0xc
test cl, cl
lea ecx, [esp + 0x38]
mov edx, ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], edx
mov byte [esp + 0xc8], 3
mov eax, dword [esp + 0x48]
mov byte [eax], 0
mov byte [esp + 0xc8], 4
mov bh, bh
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x1009adc3
push ecx
mov ecx, edi
call fcn.1000cf10
jmp 0x1009aed9
test esi, esi
je 0x1009ae9a
cmp esi, 2
je 0x1009ae9a
cmp esi, 3
je 0x1009ae9a
cmp esi, 1
jne 0x1009aecd
mov eax, eax
mov bl, 0x64
mov byte [esp + 0x70], 0x25
mov byte [esp + 0x71], bl
mov byte [esp + 0x72], 0x2c
mov byte [esp + 0x73], 0x25
mov byte [esp + 0x74], bl
mov byte [esp + 0x75], 0x2c
mov byte [esp + 0x76], 0x25
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0
mov al, al
cmp dword [esp + 0x24], 0
jg 0x1009ae22
jmp fcn.10105789
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x7c]
push edx
push eax
call fcn.10119565
add esp, 0x14
xchg ebx, eax
xchg ebx, eax
mov ecx, ecx
mov byte [esp + 0x68], 0x25
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], 0x2c
mov byte [esp + 0x6b], 0x25
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], 0
push ecx
pop ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x70]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.10118d49
add esp, 0x10
test dh, dh
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x3c]
call fcn.100113d0
test ch, ch
jmp 0x1009aecd
test eax, eax
jg 0x1009aea3
jmp fcn.10105789
mov edx, dword [esp + 0x20]
mov edx, dword [edx]
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1009aeb0
sub eax, esi
add eax, edx
push eax
push edx
lea ecx, [esp + 0x40]
call fcn.1000d090
test eax, 0x4783
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.1000cf10
mov dword [esp + 0x30], 1
mov byte [esp + 0xc8], 2
lea ecx, [esp + 0x38]
call fcn.10006e00
mov byte [esp + 0xc8], 1
lea ecx, [esp + 0x1c]
call fcn.10108d3f
mov byte [esp + 0xc8], 0
lea ecx, [esp + 0x50]
call fcn.10006e00
mov eax, edi
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.10116cb9
add esp, 0xbc
ret
Function at 0x1009d880
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
push edi
push eax
pop eax
push ecx
pop ecx
mov ah, ah
mov edi, dword [esp + 0x1c]
push 5
push edi
call fcn.10069d10
add esp, 8
mov bl, bl
test eax, eax
jne 0x1009d8a6
mov eax, edi
pop edi
add esp, 0x14
ret
push ebx
push ebp
push esi
push 0
push eax
call fcn.10069d10
add esp, 8
mov esi, eax
test edx, edx
mov ah, ah
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x10], eax
mov ebx, ebx
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009d974
mov ebx, dword [esp + 0x34]
mov ebp, dword [sym.imp.USER32.dll_GetWindowRect]
nop
mov edi, esi
mov ecx, ecx
test ebx, ebx
jne 0x1009d8f3
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1009d918
mov bh, bh
lea eax, [esp + 0x14]
push eax
push esi
call ebp
xchg ebx, eax
xchg ebx, eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1009d954
push 2
push esi
call fcn.10069d10
add esp, 8
mov esi, eax
mov dh, dh
cmp edi, esi
je 0x1009d974
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
test dh, dh
sub eax, dword [esp + 0x10]
cmp eax, dword [0x101b98b8]
jae 0x1009d970
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1009d8e0
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebx
push ecx
push edx
push esi
call fcn.1009d880
add esp, 0x10
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x14
ret
xor edi, edi
mov ah, ah
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
add esp, 0x14
ret
Function at 0x1009e060
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
cmp dword [esi + 0x10], 0
push edi
mov edi, dword [esp + 0x28]
jne 0x1009e0f6
cmp dword [esi], 0
je 0x1009e0f6
mov al, 0x69
mov dl, 0x54
mov cl, 0x6f
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x77
mov byte [esp + 0xa], al
mov byte [esp + 0xb], 0x74
mov byte [esp + 0xc], 0x63
mov byte [esp + 0xd], 0x68
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], cl
mov byte [esp + 0x10], dl
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], al
mov byte [esp + 0x13], 0x73
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x64
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0x77
mov byte [esp + 0x1a], 0
push edx
pop edx
mov ecx, dword [esi]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esi + 0x10], eax
test ebx, ebx
mov esi, dword [esi + 0x10]
test esi, esi
je 0x1009e11a
push 1
push edi
call esi
push eax
pop eax
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10116cb9
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10116cb9
add esp, 0x18
ret

Function at 0x1009e130
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x34
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push esi
push edi
xor edi, edi
test ch, ch
mov ecx, dword [esp + 0x48]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], 0x14
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
test eax, 0x46f5
mov byte [esp + 0x1c], 0x75
mov byte [esp + 0x1d], 0x73
mov byte [esp + 0x1e], 0x65
mov byte [esp + 0x1f], 0x72
mov byte [esp + 0x20], 0x33
mov byte [esp + 0x21], 0x32
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x6c
mov byte [esp + 0x25], 0x6c
mov byte [esp + 0x26], 0
mov bh, bh
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov esi, eax
push ecx
pop ecx
test esi, esi
je 0x1009e236
mov byte [esp + 0x28], 0x46
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], 0x61
mov byte [esp + 0x2b], 0x73
mov byte [esp + 0x2c], 0x68
mov byte [esp + 0x2d], 0x57
mov byte [esp + 0x2e], 0x69
mov byte [esp + 0x2f], 0x6e
mov byte [esp + 0x30], 0x64
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x77
mov byte [esp + 0x33], 0x45
mov byte [esp + 0x34], 0x78
mov byte [esp + 0x35], 0
mov ecx, ecx
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, 0xbcb
test eax, eax
je 0x1009e22d
lea ecx, [esp + 8]
push ecx
call eax
test eax, 0x7070
mov edi, 1
mov eax, eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test dh, dh
mov ecx, dword [esp + 0x38]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.10116cb9
add esp, 0x34
ret
Function at 0x1009e900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x5c
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
xor edi, edi
mov ah, ah
mov cl, 0x50
mov al, 0x4c
mov byte [esp + 0x44], cl
mov byte [esp + 0x45], 0x53
mov byte [esp + 0x46], 0x41
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0x49
mov byte [esp + 0x49], 0x2e
mov byte [esp + 0x4a], 0x44
mov byte [esp + 0x4b], al
mov byte [esp + 0x4c], al
mov byte [esp + 0x4d], 0
test edi, edi
mov byte [esp + 0x53], cl
mov cl, 0x72
mov al, 0x65
mov byte [esp + 0x55], cl
mov bl, 0x66
mov dl, 0x6f
mov byte [esp + 0x58], cl
mov cl, 0x6e
mov byte [esp + 0x50], 0x47
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x74
mov byte [esp + 0x54], al
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], dl
mov byte [esp + 0x59], 0x6d
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x63
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], 0x49
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], bl
mov byte [esp + 0x61], dl
mov byte [esp + 0x62], 0
mov ebp, ebp
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
push eax
pop eax
test esi, esi
jne 0x1009e9cd
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.10116cb9
add esp, 0x5c
ret
lea ecx, [esp + 0x50]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ebx, eax
test ah, ah
test bh, bh
push 0x38
lea edx, [esp + 0x10]
push 0
push edx
call fcn.10117df0
add esp, 0xc
test ah, ah
push 0x38
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
je 0x1009ea05
mov edi, dword [esp + 0x34]
mov ebp, ebp
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
mov edi, edi
mov ecx, dword [esp + 0x64]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10116cb9
add esp, 0x5c
ret
Function at 0x1009f190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov byte [esp], 0x4a
mov byte [esp + 1], 0x75
mov byte [esp + 2], 0x6c
mov byte [esp + 3], 0x5a
mov byte [esp + 4], 0x51
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x54
mov byte [esp + 7], 0x79
mov byte [esp + 8], 0x6b
mov byte [esp + 9], 0x68
mov byte [esp + 0xa], 0
test ecx, ecx
test eax, eax
je 0x1009f200
push eax
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetPropA]
test dl, dl
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10116cb9
add esp, 0x10
ret
lea edx, [esp]
push edx
push ecx
call dword [sym.imp.USER32.dll_RemovePropA]
test bh, bh
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10116cb9
add esp, 0x10
ret

Function at 0x1009f220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
mov byte [esp], 0x4a
mov byte [esp + 1], 0x75
mov byte [esp + 2], 0x6c
mov byte [esp + 3], 0x5a
mov byte [esp + 4], 0x51
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x54
mov byte [esp + 7], 0x79
mov byte [esp + 8], 0x6b
mov byte [esp + 9], 0x68
mov byte [esp + 0xa], 0
test eax, eax
lea ecx, [esp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetPropA]
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10116cb9
add esp, 0x10
ret
Function at 0x100a1940
Capabilities:
Log keystrokes

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.100a1710
add esp, 4
mov esi, eax
mov ebx, ebx
test esi, esi
je 0x100a19a9
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100a19a9
push ebx
push ebp
push edi
mov cl, cl
push 0
push esi
call fcn.10069cd0
add esp, 8
mov esi, eax
test eax, 0x40f
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test ah, ah
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
test dh, dh
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
push edx
pop edx
push 0
push esi
push edi
call ebx
push ebx
pop ebx
pop edi
mov eax, ebp
pop ebp
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100a1eb0
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
push 0xffffffffffffffff
push 0x1017c16b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101ce2ac]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov eax, dword [esp + 0x158]
xor ebx, ebx
cmp eax, ebx
jne 0x100a1f05
call dword [sym.imp.USER32.dll_GetDesktopWindow]
test eax, eax
jmp 0x100a2085
cmp eax, 1
jne 0x100a2083
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, edx
push 5
push eax
call fcn.10069d10
add esp, 8
test ch, ch
push ebx
push eax
call fcn.10069d10
add esp, 8
mov edi, eax
test edx, edx
mov esi, edi
mov dl, dl
mov ebp, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call ebp
mov dword [esp + 0x14], eax
test eax, 0x5626
mov al, 0x6c
mov byte [esp + 0x30], 0x53
mov byte [esp + 0x31], 0x68
mov byte [esp + 0x32], 0x65
mov byte [esp + 0x33], al
mov byte [esp + 0x34], al
mov byte [esp + 0x35], 0x5f
mov byte [esp + 0x36], 0x54
mov byte [esp + 0x37], 0x72
mov byte [esp + 0x38], 0x61
mov byte [esp + 0x39], 0x79
mov byte [esp + 0x3a], 0x57
mov byte [esp + 0x3b], 0x6e
mov byte [esp + 0x3c], 0x64
mov byte [esp + 0x3d], bl
test ecx, ecx
cmp edi, ebx
je 0x100a207f
mov edi, esi
test ecx, ecx
push esi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x100a2050
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100a2050
push 0xff
lea eax, [esp + 0x45]
push ebx
push eax
mov byte [esp + 0x4c], bl
call fcn.10117df0
add esp, 0xc
push ecx
pop ecx
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.100a15b0
add esp, 8
mov dword [esp + 0x14c], ebx
mov eax, dword [eax + 0x14]
lea edx, [esp + 0x40]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x100a1ff0
mov dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10006e00
mov bh, bh
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov dl, dl
cmp eax, ebx
jne 0x100a2050
lea ecx, [esp + 0x30]
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a2047
cmp dl, bl
je 0x100a2043
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a2047
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100a2027
xor eax, eax
jmp 0x100a204c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x100a207f
push 2
push esi
call fcn.10069d10
add esp, 8
mov esi, eax
test bh, bh
call ebp
mov dh, dh
sub eax, dword [esp + 0x14]
cmp eax, dword [0x101b98b8]
jae 0x100a207b
cmp esi, ebx
jne 0x100a1f95
mov eax, edi
jmp 0x100a2085
xor edi, edi
push edx
pop edx
mov eax, edi
jmp 0x100a2085
xor eax, eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.10116cb9
add esp, 0x13c
ret
Function at 0x100a23c0
Capabilities:
Log keystrokes

Disassembly:
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x100a23da
mov eax, dword [esp + 8]
push eax
call fcn.100a1710
add esp, 4
mov edi, eax
test ecx, ecx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100a23e7
pop edi
ret
push ebx
push ebp
push esi
push 5
push edi
call fcn.10069d10
add esp, 8
test eax, eax
je 0x100a2472
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
mov ebp, ebp
push 0
push edi
call fcn.10069cd0
add esp, 8
mov ebx, eax
test ah, ah
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ecx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test edx, edx
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call ebx
test eax, eax
je 0x100a2472
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100a2472
mov esi, ebp
test edi, edi
push ebp
call ebx
test eax, eax
je 0x100a2472
cmp esi, edi
je 0x100a246f
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov ecx, ecx
push esi
call ebx
test eax, eax
jne 0x100a2457
jmp 0x100a2472
mov edi, ebp
nop
mov ebp, dword [esp + 0x1c]
mov eax, ebp
lea edx, [eax + 1]
jmp 0x100a2480
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100a2480
sub eax, edx
mov ebx, eax
xchg ebx, eax
xchg ebx, eax
push edx
pop edx
xor esi, esi
test ebx, ebx
jle 0x100a24be
jmp 0x100a24a0
movzx ecx, byte [esi + ebp]
push 0x4000001
push ecx
push 0x102
push edi
call fcn.10069d00
push eax
pop eax
add esi, 1
cmp esi, ebx
jl 0x100a24a0
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
ret

Function at 0x100a24d0
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x100a24ea
mov eax, dword [esp + 8]
push eax
call fcn.100a1710
add esp, 4
mov ebx, eax
test esi, esi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100a24f7
pop ebx
ret
push 5
push ebx
call fcn.10069d10
add esp, 8
test eax, eax
je 0x100a2585
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
mov eax, eax
push 0
push ebx
call fcn.10069cd0
add esp, 8
mov edi, eax
test ah, ah
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ecx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test edi, edi
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov bl, bl
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call edi
test eax, eax
je 0x100a2582
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100a2582
mov esi, ebp
nop
push ebp
call edi
test eax, eax
je 0x100a2582
cmp esi, ebx
je 0x100a257e
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test bl, bl
push esi
call edi
test eax, eax
jne 0x100a2566
jmp 0x100a2582
mov ebx, ebp
mov bh, bh
pop edi
pop esi
pop ebp
push 0
push 0
push 0x302
push ebx
call fcn.10069d00
test ecx, ecx
mov eax, 1
pop ebx
ret
Function at 0x100a2bb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push 5
push eax
call fcn.10069d10
add esp, 8
mov dh, dh
test eax, eax
jne 0x100a2bcc
add esp, 8
ret
push ebx
push ebp
push esi
push edi
push 0
push eax
call fcn.10069d10
add esp, 8
mov esi, eax
nop
mov bh, bh
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [esp + 0x14], eax
test dl, dl
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100a2c94
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], esi
mov edi, edi
push edi
push ebx
mov ecx, ebp
mov edx, esi
call fcn.100a25a0
add esp, 8
test eax, eax
je 0x100a2c3b
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, esi
call fcn.100a25a0
add esp, 8
test eax, eax
jne 0x100a2c9e
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
push edx
push edi
push ebx
push ebp
push esi
call fcn.100a2bb0
add esp, 0x1c
test al, al
test eax, eax
jne 0x100a2c96
push 2
push esi
call fcn.10069d10
add esp, 8
mov esi, eax
test ecx, ecx
cmp dword [esp + 0x10], esi
je 0x100a2c94
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dh, dh
sub eax, dword [esp + 0x14]
cmp eax, dword [0x101b98b8]
jae 0x100a2c94
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100a2c07
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100a8c70
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x1017ca73
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x101ce2ac]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101ce2ac]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa78]
mov esi, dword [esp + 0xa80]
lea eax, [esp + 0x824]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
mov ecx, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x834], eax
mov dword [esp + 0x838], ecx
mov dword [esp + 0xa70], 1
mov edx, dword [esp + 0x834]
mov byte [edx], bl
mov dword [esp + 0xa70], 2
nop
xchg ebx, eax
xchg ebx, eax
push 0x800
lea eax, [esp + 0x28]
push ebx
push eax
call fcn.10117df0
add esp, 0xc
test dh, dh
mov dword [esp + 0x18], ebx
test eax, 0x7ffc
mov ebp, ebp
push 0x128
lea ecx, [esp + 0x840]
push ebx
push ecx
call fcn.10117df0
add esp, 0xc
test eax, 0x5f0d
mov dword [esp + 0x83c], 0x128
nop
push ebx
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
test dl, dl
cmp edi, 0xffffffff
jne 0x100a8d70
lea edx, [esp + 0x824]
push edx
mov ecx, ebp
call fcn.1000cf10
mov dword [esp + 0x1c], 1
jmp 0x100a8eb7
lea ecx, [esp + 0x14]
call fcn.1001f680
mov byte [esp + 0xa70], 3
test ch, ch
cmp esi, ebx
jne 0x100a8d8b
xor eax, eax
jmp 0x100a8d9b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x100a8d90
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.10043f80
push eax
pop eax
lea ecx, [esp + 0x14]
call fcn.10007320
test dl, dl
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32First
test ebx, ebx
cmp eax, ebx
je 0x100a8e6d
jmp 0x100a8dd0
mov bl, bl
xor eax, eax
jmp 0x100a8de0
mov cl, byte [esp + eax + 0x860]
mov byte [esp + eax + 0x964], cl
add eax, 1
cmp cl, bl
jne 0x100a8de0
test dl, dl
lea ecx, [esp + 0x964]
push ecx
call fcn.10058170
add esp, 4
test edi, edi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x964]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100a8e34
cmp dl, bl
je 0x100a8e30
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100a8e34
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100a8e14
xor eax, eax
jmp 0x100a8e39
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100a8e55
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x844]
mov dword [esp + eax*4 + 0x24], edx
add eax, 1
mov dword [esp + 0x18], eax
test ch, ch
lea eax, [esp + 0x83c]
push eax
push edi
call sub.KERNEL32.DLL_Process32Next
mov ah, ah
cmp eax, ebx
jne 0x100a8dd0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
jne 0x100a8e8f
lea ecx, [esp + 0x824]
push ecx
mov ecx, ebp
call fcn.1000cf10
jmp 0x100a8e9e
push eax
lea edx, [esp + 0x28]
push edx
push ebp
call fcn.100a75d0
add esp, 0xc
mov dword [esp + 0x1c], 1
mov byte [esp + 0xa70], 2
lea ecx, [esp + 0x14]
call fcn.10005700
mov byte [esp + 0xa70], bl
lea ecx, [esp + 0x824]
call fcn.10006e00
mov eax, ebp
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.10116cb9
add esp, 0xa60
ret