joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10709d0
Capabilities:
Create process memory minidump

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
cmp word [0x11a2b40], 0
push 0x10102c4
push 0x3e
push 0xd
push 0
push 9
je 0x1070a1a
movzx eax, word [0x11a2d4a]
push eax
push 0x11a2b40
push 0x1010288
lea ecx, [ebp - 0x80c]
push 0x400
push ecx
call fcn.01197c5e
add esp, 0x28
jmp 0x1070a33
push 0x1010228
lea edx, [ebp - 0x80c]
push 0x400
push edx
call fcn.01197c5e
add esp, 0x20
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x1070a9f
cmp esi, 0xffffffff
je 0x1070a9f
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
neg eax
push 0
sbb eax, eax
lea ecx, [ebp - 0xc]
and eax, ecx
push eax
push 2
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1071050
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10710b7
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x802
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10710b0
push 0x802
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x10710a7
push 0x3ff
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 8

Function at 0x1071800
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x3ae
cmp byte [edi], 0
mov dword [ebp - 4], 0xffffffff
je 0x1071854
xor ebx, ebx
mov esi, 0x119fda8
mov eax, dword [esi]
test edi, edi
je 0x107183a
test eax, eax
je 0x107183e
push eax
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x107184c
add esi, 0x20
inc ebx
cmp esi, 0x119ff48
jl 0x1071825
jmp 0x1071854
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x107188e
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx edi, ax
test edi, edi
je 0x107188e
xor esi, esi
mov edx, 0x119fdb4
xor eax, eax
mov ecx, edx
lea esp, [esp]
cmp dword [ecx], edi
je 0x107187f
inc eax
add ecx, 4
cmp eax, 5
jl 0x1071870
jmp 0x1071882
mov dword [ebp - 4], esi
add edx, 0x20
inc esi
cmp edx, 0x119ff54
jl 0x1071868
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1071ad0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x4064], edi
jne 0x1071b9e
push ebx
lea ebx, [esi + 0x1c]
test ebx, ebx
je 0x1071b9d
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x4060]
cmp eax, 0x1000
jge 0x1071b92
mov ecx, dword [ebp + 0x10]
shl eax, 5
mov dword [eax + esi + 0x40cc], ecx
mov edx, dword [esi + 0x4060]
mov ecx, dword [ebp + 0xc]
shl edx, 5
mov dword [edx + esi + 0x40d0], 1
mov eax, dword [esi + 0x4060]
shl eax, 5
lea eax, [eax + esi + 0x40bc]
push eax
push edi
push eax
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x1071b7e
cmp edi, 0xffffffff
je 0x1071b7e
mov edx, dword [esi + 0x4060]
mov dword [esi + edx*4 + 0x60], edi
mov eax, dword [esi + 0x4060]
inc eax
and eax, 0x80000fff
jns 0x1071b76
dec eax
or eax, 0xfffff000
inc eax
mov dword [esi + 0x4060], eax
jmp 0x1071b92
mov ecx, dword [esi + 0x4060]
shl ecx, 5
mov dword [ecx + esi + 0x40d0], 0
test ebx, ebx
je 0x1071b9d
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1074c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xcc], 0
jne 0x1074cd0
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x32
call ebx
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x1074ccf
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xcc], 0
je 0x1074cb4
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1076730
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x2a56c], 0
je 0x10767a5
mov ecx, dword [edi + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10767a5
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x107679e
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov edx, dword [edi]
mov eax, dword [edx + 0x2a56c]
add esp, 0xc
test eax, eax
je 0x1076795
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4
Function at 0x10767b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1076817
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1076810
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
add eax, 0x2b6f4
je 0x1076807
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4

Function at 0x107a310
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x25a8c]
mov eax, dword [eax + 0x1c]
push edi
push 0
push 0
push 0x147
push eax
call ebx
mov edi, dword [ebp + 0x10]
push 0
mov dword [edi + 0x1fc], eax
mov eax, dword [esi + 0x25a90]
mov ecx, dword [eax + 0x1c]
push 0
push 0x147
push ecx
call ebx
mov ebx, dword [ebp + 8]
push 0x3f
lea edx, [edi + 0x308]
mov dword [edi + 0x1f8], eax
mov eax, dword [esi + 0x25aa0]
push edx
push eax
push ebx
call fcn.0105a600
mov edx, dword [esi + 0x25a9c]
push 0x3f
lea ecx, [edi + 0x286]
push ecx
push edx
push ebx
call fcn.0105a600
push 0x3f
lea eax, [edi + 0x204]
push eax
mov eax, dword [esi + 0x25a94]
push eax
push ebx
call fcn.0105a600
lea eax, [edi + 0x204]
push eax
push esi
call fcn.0107a250
mov esi, dword [esi + 0x25a98]
test ebx, ebx
je 0x107a416
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x107a416
test esi, esi
je 0x107a3e4
mov ecx, dword [esi + 0x1c]
push 0x1ff
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
cmp eax, 0xffff
mov dword [edi + 0x200], eax
jle 0x107a400
mov eax, 0xffff
push ebx
push 0
mov dword [edi + 0x200], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x107c730
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
test esi, esi
je 0x107c765
push 2
push 0x100d0a4
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x107c765
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov cx, word [esi + 2]
mov ax, word [esi]
mov dx, word [esi + 4]
mov word [ebp - 6], cx
mov word [ebp - 8], ax
lea ecx, [ebp - 8]
xor eax, eax
push ecx
mov word [ebp - 4], dx
mov word [ebp - 2], ax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x107c75b
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x107d390
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push ecx
push 0
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
call fcn.0102f120
mov esi, dword [ebp - 4]
test esi, esi
je 0x107d4b9
lea eax, [eax + eax + 0x864]
test eax, eax
je 0x107d4a9
push ebx
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x107d4a8
push edi
push 9
push esi
call fcn.0102d940
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x107d44f
mov eax, dword [ebp - 4]
mov esi, edi
sub esi, eax
sar esi, 1
push esi
push eax
push ebx
call fcn.0102d520
cmp esi, 0x31
jl 0x107d416
mov esi, 0x31
cmp esi, 0x32
jge 0x107d440
mov eax, 0x20
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x32
sub ecx, esi
or eax, edx
shr ecx, 1
lea edi, [ebx + esi*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 8]
add edi, 2
push edi
push ebx
call fcn.0102d4b0
mov esi, dword [ebp - 4]
jmp 0x107d45f
push 0x103
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
cmp word [ebx], 0
mov eax, ebx
pop edi
je 0x107d479
jmp 0x107d470
add eax, 2
cmp word [eax], 0
jne 0x107d470
sub eax, ebx
push 0
sar eax, 1
lea ecx, [ebp - 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30900]
push edx
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x107e160
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x281
push 8
mov dword [ebp - 4], 0x280
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
call ebx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x107e369
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x107e1cb
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x107e369
inc eax
push eax
push 8
call esi
push eax
call ebx
mov dword [ebp - 8], eax
mov edi, eax
test edi, edi
je 0x107e369
lea ecx, [ebp - 4]
push ecx
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x107e35d
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcrt.dll_strncpy]
mov edi, edi
mov eax, dword [esi + 0x2e664]
cmp eax, 8
jge 0x107e354
imul eax, eax, 0x360
push 0x103
lea edx, [edi + 0x10c]
push edx
lea eax, [eax + esi + 0x2cc69]
push eax
call ebx
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
push 0x103
lea ecx, [edi + 8]
push ecx
lea eax, [edx + esi + 0x2cb64]
push eax
call ebx
mov eax, dword [edi + 0x190]
add esp, 0x18
cmp eax, 0x41
jb 0x107e24d
mov eax, 0x41
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
mov dword [ecx + esi + 0x2cdb0], eax
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov ecx, dword [edx + esi + 0x2cdb0]
lea eax, [edx + esi]
push ecx
lea edx, [edi + 0x194]
push edx
add eax, 0x2cd6e
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x2e664]
mov ecx, dword [edi + 0x1a0]
imul eax, eax, 0x360
mov dword [eax + esi + 0x2cec0], ecx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1b0]
push edx
lea ecx, [eax + esi + 0x2cdb4]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1c0]
push edx
lea ecx, [eax + esi + 0x2cdf5]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1d8]
push edx
lea ecx, [eax + esi + 0x2ce36]
push ecx
call ebx
add esp, 0x30
cmp dword [edi + 0x1a4], 0
je 0x107e344
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov dword [edx + esi + 0x2ce78], 1
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
push 0x3f
lea eax, [edi + 0x200]
push eax
lea edx, [ecx + esi + 0x2ce7c]
push edx
call ebx
add esp, 0xc
inc dword [esi + 0x2e664]
mov edi, dword [edi]
test edi, edi
jne 0x107e1f0
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x107e900
Capabilities:
List user accounts

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push 2
push 2
push edi
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
cmp ebx, edi
je 0x107e940
cmp ebx, 0xea
jne 0x107e979
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x107e98d
cmp dword [ebp - 8], edi
jbe 0x107e97c
lea esi, [eax + 0x24]
nop
mov ecx, dword [esi - 0x18]
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi - 0x1c]
push eax
mov eax, dword [esi - 0x24]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.0107e870
inc edi
add esi, 0x60
cmp edi, dword [ebp - 8]
jb 0x107e950
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
je 0x107e98d
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [ebp - 4], eax
cmp ebx, 0xea
je 0x107e916
cmp eax, edi
pop edi
pop esi
pop ebx
je 0x107e9a2
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov esp, ebp
pop ebp
ret 4
Function at 0x107ff00
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x108006b
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x108005f
push edi
push 0
push 0
mov ecx, 1
mov word [ebp - 0x3c], cx
mov edx, 0x18
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x44], 0x2a6
mov dword [ebp - 0x40], 0x1c2
mov word [ebp - 0x3a], dx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xdfae8
mov ecx, 0xa
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x1080054
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push esi
push 0x1c2
push 0x2a6
push 0
push 0
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
add eax, 0x12
push 0
lea edx, [eax + eax*2]
push 0x40000000
mov eax, 0x4d42
push ecx
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1e], edx
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x1080042
cmp esi, 0xffffffff
je 0x1080042
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
push 0xe
lea eax, [ebp - 0x20]
push eax
push esi
call edi
push 0
lea ecx, [ebp - 4]
push ecx
push 0x28
lea edx, [ebp - 0x48]
push edx
push esi
call edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [ebp - 8]
pop edi
mov ecx, dword [ebp + 8]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1082030
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push edi
push 5
push eax
call ebx
mov edi, dword [esi + 0xc]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x108205c
push 9
push edi
call ebx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
push ecx
add edx, 0x2c608
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov esi, dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
cmp ebx, esi
je 0x10820cf
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10820cf
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10820f0
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0xf
push esi
call fcn.01060b20
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov esi, dword [esi + 0xc]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1082127
push 9
push esi
call edi
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
ret 8
Function at 0x1083dd0
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xffffffff
je 0x1083ea4
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x1f288]
mov dword [ebp - 8], esi
test esi, esi
je 0x1083ea2
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [edi + 0x1f278]
test eax, eax
je 0x1083e97
push ebx
xor ebx, ebx
test eax, eax
jle 0x1083e96
add edi, 0x1ec60
cmp dword [ebp - 4], 0
jne 0x1083e96
mov eax, dword [edi]
test eax, eax
je 0x1083e84
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1083e84
mov ecx, dword [edi - 0x808]
push ecx
push 0
push 0x13143a
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
test esi, esi
je 0x1083e84
cmp esi, 0xffffffff
je 0x1083e84
lea edx, [ebp - 0xc]
push edx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1083e7d
mov dword [ebp - 4], 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 8]
inc ebx
add edi, 4
cmp ebx, dword [eax + 0x1f278]
jl 0x1083e28
pop ebx
test esi, esi
je 0x1083ea2
push esi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop edi
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1083eb0
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10841b0
Capabilities:
Get file version info

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
test ebx, ebx
je 0x108429a
push esi
lea eax, [ebp + 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x108428f
lea ecx, [esi + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1084283
mov edx, dword [ebp + 8]
push edi
push esi
push edx
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1084265
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0x100c124
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1084265
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
test eax, eax
je 0x1084234
mov dx, word [ecx + 0xa]
mov word [eax], dx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1084242
mov dx, word [ecx + 8]
mov word [eax], dx
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1084250
mov dx, word [ecx + 0xe]
mov word [eax], dx
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x108425e
mov cx, word [ecx + 0xc]
mov word [eax], cx
mov esi, 1
jmp 0x1084268
mov esi, dword [ebp - 4]
push edi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 4]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1084da0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1084de6
cmp byte [esi], 0
je 0x1084de6
mov ecx, esi
push edi
mov edx, esi
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1084dc0
sub ecx, edi
lea ecx, [ecx + esi - 1]
pop edi
cmp ecx, esi
jbe 0x1084de6
push ebx
mov al, byte [ecx]
xor byte [edx], al
mov bl, byte [edx]
xor byte [ecx], bl
mov bl, byte [ecx]
xor byte [edx], bl
inc edx
dec ecx
cmp ecx, edx
ja 0x1084dd3
pop ebx
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1085390
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10853df
test esi, esi
je 0x10853df
mov ecx, 1
cmp esi, ecx
jbe 0x10853da
movzx eax, byte [ebp + 0x10]
cdq
push ebx
mov ebx, 0xff
idiv ebx
lea eax, [edi + 1]
or edi, 0xffffffff
mov bl, dl
add bl, cl
xor bl, byte [edi + eax]
inc ecx
xor bl, byte [eax]
inc eax
xor bl, 0xac
mov byte [eax - 1], bl
cmp ecx, esi
jb 0x10853c1
mov edi, dword [ebp + 8]
pop ebx
mov al, byte [ebp + 0x10]
xor byte [edi], al
cmp esi, 0xa
jb 0x10853e9
mov esi, 0xa
push 0xfa
push esi
push edi
call fcn.010303b0
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1085400
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x1085467
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x1085466
mov eax, edi
cmp edi, 0xa
jb 0x1085421
mov eax, 0xa
push 0xfa
push eax
push esi
call fcn.01030410
mov al, byte [ebp + 0x10]
xor byte [esi], al
lea ecx, [edi - 1]
test ecx, ecx
jbe 0x1085466
movzx eax, al
cdq
mov edi, 0xff
idiv edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
jmp 0x1085450
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor bl, byte [eax]
dec eax
xor bl, 0xac
mov byte [eax + 1], bl
test ecx, ecx
ja 0x1085450
pop ebx
pop edi
pop esi
pop ebp
ret 0xc