joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2f48
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff8f0
push 0x4f3f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
cmp word [ecx], 0x5a4d
jne 0x4f2fce
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
je 0x4f2fa6
xor al, al
or dword [ebp - 4], 0xffffffff
jmp 0x4f2fd4
mov edx, dword [eax + 0xd8]
lea esi, [edx + ecx]
cmp dword [ebp + 0xc], esi
jb 0x4f2f9e
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x4f2f9e
mov al, 1
jmp 0x4f2fa0
or dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f3033
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [0x5cca5c]
test esi, esi
je 0x4f3057
lea eax, [esp + 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
jmp 0x4f303b
pop esi
pop ecx
ret

Function at 0x4f305a
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5cca68], eax
je 0x4f3070
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x5cca78]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x4f30bd
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x4f30ae
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x4f30ae
push eax
call fcn.004f3124
pop ecx
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.004f3eca
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4f307f
mov dword [0x5cca78], ebx
call fcn.004f30fd
mov esi, dword [0x5cca74]
cmp esi, ebx
je 0x4f30ea
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.004f3eca
cmp edi, ebx
pop ecx
mov esi, edi
jne 0x4f30d2
pop edi
mov dword [0x5cca74], ebx
mov dword [0x5cca68], ebx
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4f33a7
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x5cca6c]
push esi
test eax, eax
push edi
jne 0x4f3411
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4f340f
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x4f33d3
push 8
pop edi
jmp 0x4f33ee
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x4f33ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.004f3eca
pop ecx
and dword [0x5cca70], 0
mov dword [0x5cca6c], edi
mov eax, edi
jmp 0x4f3411
mov dword [esi + 4], edi
mov eax, dword [0x5cca74]
mov dword [esi], eax
mov dword [0x5cca74], esi
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x4f36ce
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 0x7ff80000
mov ebx, 0x10000
jbe 0x4f36f2
lea eax, [esi - 0x7ff80000]
mov dword [ebp + 8], eax
jmp 0x4f36f5
mov dword [ebp + 8], ebx
cmp esi, 0x80000000
jae 0x4f3708
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x4f370f
mov dword [ebp - 4], 0xfff80000
mov eax, dword [0x5cca60]
mov ecx, dword [0x5cca5c]
test eax, eax
jne 0x4f3729
test ecx, ecx
je 0x4f373e
mov eax, ecx
mov dword [0x5cca60], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x4f373e
cmp edx, dword [ebp + 8]
jb 0x4f373e
cmp edx, dword [ebp - 4]
jbe 0x4f3897
mov eax, ecx
test ecx, ecx
mov dword [0x5cca60], eax
je 0x4f376e
test eax, eax
je 0x4f3762
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4f3762
cmp ecx, dword [ebp + 8]
jb 0x4f3762
cmp ecx, dword [ebp - 4]
jbe 0x4f3897
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x5cca60], eax
jne 0x4f374d
mov eax, esi
and eax, 0xffff
sub esi, eax
cmp esi, dword [ebp + 8]
mov edi, esi
jbe 0x4f37d6
cmp edi, 0x70000000
jb 0x4f3793
cmp edi, 0x80000000
ja 0x4f3793
mov edi, 0x6fff0000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f37d6
cmp dword [ebp - 0x10], ebx
jne 0x4f37ae
cmp dword [ebp - 0x14], ebx
jae 0x4f37be
mov eax, dword [ebp - 0x1c]
lea edi, [eax - 0x10000]
cmp edi, dword [ebp + 8]
ja 0x4f377e
jmp 0x4f37d6
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5cca60], eax
jne 0x4f384d
cmp esi, dword [ebp - 4]
jae 0x4f38be
cmp esi, 0x70000000
jb 0x4f37f4
cmp esi, 0x80000000
ja 0x4f37f4
mov esi, 0x80010000
lea eax, [ebp - 0x20]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f38be
cmp dword [ebp - 0x10], ebx
jne 0x4f3842
cmp dword [ebp - 0x14], ebx
jb 0x4f3842
mov ecx, esi
and ecx, 0xffff
je 0x4f382a
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x14], eax
add dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [0x5cca60], eax
jne 0x4f384d
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
lea esi, [eax + ecx]
jmp 0x4f37d6
mov dword [eax], 0x52727464
mov eax, dword [0x5cca60]
xor ecx, ecx
mov dword [eax + 8], ecx
mov eax, dword [0x5cca60]
mov edx, dword [0x5cca5c]
mov dword [eax + 4], edx
mov eax, dword [0x5cca60]
mov dword [0x5cca5c], eax
add eax, 0xffe0
mov edx, 0x7fd
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
dec edx
jne 0x4f387f
mov eax, dword [0x5cca60]
mov dword [eax + 8], ecx
mov eax, dword [0x5cca60]
mov esi, dword [eax + 8]
cmp esi, dword [ebp + 8]
jb 0x4f38be
cmp esi, dword [ebp - 4]
ja 0x4f38be
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
jmp 0x4f38c0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f38c5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff900
push 0x4f3f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f393a
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x5a4d
jne 0x4f3936
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [ebp - 0x3c], eax
cmp dword [eax], 0x4550
jne 0x4f3936
cmp word [eax + 0x14], 0
jne 0x4f392b
xor eax, eax
or dword [ebp - 4], 0xffffffff
jmp 0x4f393c
mov eax, ecx
jmp 0x4f3925
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f394b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x5cca68], eax
je 0x4f396a
mov eax, 0x10dd
jmp 0x4f3a40
mov eax, dword [0x5cca6c]
test eax, eax
jne 0x4f3a40
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4f3986
push 6
pop eax
jmp 0x4f3a40
cmp dword [edi], 0
jne 0x4f3998
push 6
pop eax
mov dword [0x5cca6c], eax
jmp 0x4f3a3a
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
test esi, esi
jne 0x4f39ab
push 8
pop edi
jmp 0x4f3a24
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.004f2ee0
movzx ecx, byte [edi + 0x17]
mov ebx, dword [edi + 0x18]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x4f3a19
cmp ecx, 0x17
ja 0x4f3a19
cmp dword [edi + 0x1c], eax
jne 0x4f3a19
lea eax, [ebp - 4]
mov dword [ebp - 4], edx
push eax
push 0x40
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4f39ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4f3a24
mov eax, dword [ebp + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x5cca78]
mov dword [esi], eax
mov dword [0x5cca78], esi
xor eax, eax
jmp 0x4f3a40
cmp dword [0x5cca64], edx
push 9
pop edi
jne 0x4f3a2a
mov dword [0x5cca6c], edi
test esi, esi
je 0x4f3a35
push esi
call fcn.004f3eca
pop ecx
mov eax, edi
mov edi, dword [ebp + 8]
mov dword [0x5cca70], edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1346f48
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1346f52
pushal
call 0x1346f58
pop ebp
sub ebp, 0x10
sub ebp, 0xf46f48
jmp 0x1346f6e
mov eax, 0xf46f48
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b6
mov edx, 0x2491cc44
xor byte [eax], dl
inc eax
dec ecx
jne 0x1346f85
jmp 0x1346f98
iretd
Function at 0x401daf
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 0
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 5
lea eax, [ebp - 0x10]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x220
mov dword [esp + 8], 0x20
mov dword [esp + 4], 2
lea eax, [ebp - 0x16]
mov dword [esp], eax
call sym._AllocateAndInitializeSid_44
sub esp, 0x2c
test eax, eax
setne al
test al, al
je 0x401e6c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CheckTokenMembership_12
sub esp, 0xc
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._FreeSid_4
sub esp, 4
mov eax, dword [ebp - 0xc]
cmp eax, 1
sete al
leave
ret

Function at 0x401e77
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
call sym.isAdmin__
xor eax, 1
test al, al
je 0x401f02
lea eax, [ebp - 9]
mov ecx, eax
call fcn.00402674
lea eax, [ebp - 0x24]
lea edx, [ebp - 9]
mov dword [esp + 4], edx
mov dword [esp], str.path_to_your_program.exe
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
sub esp, 8
lea eax, [ebp - 9]
mov ecx, eax
call sym.std::allocator_char_::allocator__
lea eax, [ebp - 0x24]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], str.runas
mov dword [esp], 0
call sym._ShellExecuteA_24
sub esp, 0x18
mov dword [esp], 0
call sym._exit
mov dword [esp + 4], str.The_program_is_already_running_as_an_administrator.
mov dword [esp], sym.imp.libstdc_6.dll_std::cout
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov dword [esp], sym.std::basic_ostream_char__std::char_traits_char____std::endl_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char____
mov ecx, eax
call sym.std::ostream::operator___std::ostream____std::ostream__
sub esp, 4
jmp 0x401f55
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401f84
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call sym._GetConsoleWindow_0
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._ShowWindow_8
sub esp, 8
nop
leave
ret
Function at 0x401fab
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp + 4], str.powershell__Command_Add_MpPreference__ExclusionPath__
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x408282
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea eax, [ebp - 0x20]
mov ecx, eax
call fcn.004025bc
lea eax, [ebp - 0x38]
mov ecx, eax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov dword [esp], eax
call sym._system
lea eax, [ebp - 0x38]
mov ecx, eax
call fcn.004025bc
jmp 0x402024
add esp, 0x44
pop ebx
pop ebp
ret
Function at 0x402d10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40d06c
call sym._EnterCriticalSection_4
mov ebx, dword [0x40d064]
sub esp, 4
test ebx, ebx
je 0x402d5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402d54
test esi, esi
je 0x402d54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402d30
mov dword [esp], 0x40d06c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402f40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402f90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x403068
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402fce
cmp eax, 4
jne 0x402ff0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402fde
cmp edx, 4
je 0x402fde
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402f40

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0xf9a261b
nop
nop
nop
nop
nop
test eax, eax
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6f865ddc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10004456
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10004475
xor eax, eax
jmp 0x100044f0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000448b
xor eax, eax
jmp 0x100044f0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x100044d3
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x100044d3
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x100044ac
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x100044df
xor eax, eax
jmp 0x100044f0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x100044ed
xor eax, eax
jmp 0x100044f0
mov eax, dword [ebp - 4]
leave
ret

Function at 0x10009d84
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10009d8d
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009dca
mov eax, dword [ebp - 0xc]
jmp 0x10009e20
cmp dword [ebp - 4], 1
je 0x10009ddb
cmp dword [ebp - 4], 2
je 0x10009ddb
push 0xd
pop eax
jmp 0x10009e20
cmp dword [ebp + 0xc], 0
je 0x10009e14
cmp dword [ebp - 8], 0
je 0x10009e0d
mov eax, dword [ebp - 8]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x10009e06
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax*2 - 2]
test eax, eax
je 0x10009e0b
push 0xd
pop eax
jmp 0x10009e20
jmp 0x10009e14
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
leave
ret 0xc
Function at 0x10009e4b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100ed3e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.1001e317
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.10009ba6
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009ea9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.10009c18
mov eax, dword [ebp - 0x21c]
jmp 0x10009f38
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10009f0e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.10009e4b
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009f05
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.10009c18
mov eax, dword [ebp - 0x220]
jmp 0x10009f38
mov dword [ebp - 4], 0x100
jmp 0x10009eb0
lea ecx, [ebp - 0x10]
call fcn.10009beb
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.10009cea
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.10009c18
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10071b0a
leave
ret 4
Function at 0x1000f8f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100ed3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10071b20
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x100d6c8c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1000f9a8
jmp 0x1000fa1c
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071b0a
leave
ret

Function at 0x10013896
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020ef2
test eax, eax
je 0x100138fb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x100138f1
cmp dword [ebp + 8], 0x1b
jne 0x100138d7
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1002100b
jmp 0x100138f1
cmp dword [ebp + 8], 0xd
jne 0x100138f1
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1002100b
push 0
mov ecx, dword [ebp - 4]
call fcn.100139a5
leave
ret 0xc