joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009a92
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009b8c
mov edx, dword [ebp + 8]
mov eax, edx
mov ecx, 0x202
sub eax, ecx
mov ebx, 0x707
je 0x1009ae0
dec eax
je 0x1009ad9
dec eax
dec eax
je 0x1009ae0
dec eax
je 0x1009ad9
dec eax
dec eax
je 0x1009ae0
dec eax
jne 0x1009aee
mov edi, 0x708
jmp 0x1009af1
mov edi, dword [esi + 0x74]
neg edi
sbb edi, edi
and edi, 3
add edi, ebx
jmp 0x1009af1
mov edi, dword [ebp + 0xc]
cmp edx, ecx
jb 0x1009b2d
cmp edx, 0x203
jbe 0x1009b29
cmp edx, 0x204
jbe 0x1009b2d
cmp edx, 0x206
jbe 0x1009b23
cmp edx, 0x207
jbe 0x1009b2d
cmp edx, 0x209
ja 0x1009b2d
or dword [ebp + 0xc], 0x10
jmp 0x1009b2d
or dword [ebp + 0xc], 2
jmp 0x1009b2d
or dword [ebp + 0xc], 1
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x1009b3d
or dword [ebp + 0xc], 0x20
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp edi, ebx
je 0x1009b69
cmp edi, 0x708
je 0x1009b69
cmp edi, 0x70a
jne 0x1009b71
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x13c]
mov edi, dword [esi + 0x74]
xor ebx, ebx
cmp eax, ebx
mov dword [esi + 0x74], ebx
je 0x1009c3a
push dword [eax]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x1009c3a
cmp edi, ebx
jne 0x1009bd2
cmp dword [esi + 0x8c], ebx
jne 0x1009c3a
mov ecx, dword [esi + 0x13c]
call fcn.01006987
test eax, eax
je 0x1009c3a
push 1
push ebx
jmp 0x1009c2f
mov eax, dword [esi + 0x84]
cmp eax, ebx
jl 0x1009bed
push eax
push ebx
push 0x614
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1009c3a
cmp dword [esi + 0x8c], ebx
je 0x1009c3a
mov eax, dword [esi + 0x13c]
test byte [eax + 0x9a], 4
je 0x1009c1c
mov ecx, dword [esi + 0x138]
push ebx
call fcn.0100dc54
mov ecx, dword [esi + 0x13c]
push eax
call fcn.01008ccc
mov ecx, dword [esi + 0x138]
call fcn.0100d505
test eax, eax
je 0x1009c3a
push 1
push 1
mov ecx, dword [esi + 0x13c]
call fcn.01008047
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1009e16
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
neg eax
push edi
sbb eax, eax
and eax, 4
mov edi, ecx
push eax
push dword [edi]
mov dword [edi + 0x1c], esi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
je 0x1009e46
push dword [edi + 8]
call dword [sym.imp.GDI32.dll_RealizePalette]
cmp dword [edi + 0x74], 0
je 0x1009ee2
and dword [ebp + 8], 0
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call ebx
test ah, ah
jns 0x1009e80
mov dword [ebp + 8], 8
push 0x10
call ebx
test ah, ah
jns 0x1009e8c
or dword [ebp + 8], 4
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
mov esi, eax
call ebx
test ah, ah
pop ebx
jns 0x1009eb9
xor eax, eax
test esi, esi
sete al
inc eax
or dword [ebp + 8], eax
neg esi
sbb esi, esi
and esi, 0xfffffffd
add esi, 0x205
jmp 0x1009ed1
xor eax, eax
test esi, esi
setne al
inc eax
or dword [ebp + 8], eax
neg esi
sbb esi, esi
and esi, 3
add esi, 0x202
push dword [ebp - 4]
mov ecx, edi
push dword [ebp - 8]
push dword [ebp + 8]
push esi
call fcn.01009a92
pop edi
pop esi
leave
ret 4
Function at 0x100b180
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esi]
jne 0x100b2ed
test byte [ebp + 8], 3
je 0x100b2ed
cmp dword [esi + 0x74], 0
push ebx
mov ebx, dword [ebp + 0x10]
push edi
jne 0x100b283
movsx ecx, word [esi + 0x70]
mov eax, dword [ebp + 0xc]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jge 0x100b1db
movsx ecx, word [esi + 0x72]
mov eax, ebx
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 2
jl 0x100b2eb
lea edi, [esi + 0x13c]
mov ecx, dword [edi]
test ecx, ecx
mov dword [esi + 0x74], 1
je 0x100b202
call fcn.01006987
test eax, eax
je 0x100b202
mov ecx, dword [edi]
push 1
push 0
call fcn.01008047
mov eax, dword [esi + 0x48]
test eax, eax
je 0x100b230
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 4]
and dword [esi + 0x48], 0
test eax, eax
je 0x100b230
push 0
push 0x80042010
push 0x702
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100b283
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, ah
jns 0x100b24d
or dword [ebp + 8], 0x20
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push dword [esi]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp - 0x10]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
push 0x709
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100b286
mov edi, dword [ebp + 0xc]
movsx eax, word [esi + 0x70]
sub edi, eax
movsx eax, word [esi + 0x72]
sub ebx, eax
test edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
jne 0x100b2a0
test ebx, ebx
je 0x100b2eb
lea eax, [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
cmp dword [esi + 0xc], eax
je 0x100b2c9
mov ecx, dword [ebp - 8]
mov dword [esi + 0x10], ecx
mov ecx, dword [ebp - 4]
mov dword [esi + 0x14], ecx
push eax
mov ecx, esi
call fcn.0100a90d
jmp 0x100b2eb
push 0x415
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp - 4]
mov dword [esi + 0xa8], 1
push dword [ebp - 8]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x1011b6a
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10372d8]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x120]
push edi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 0x108], edi
je 0x1011c9d
cmp eax, edi
je 0x1011baf
movzx eax, word [0x1037120]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_UnregisterHotKey]
cmp ebx, edi
jne 0x1011bca
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
jmp 0x1011c9d
mov eax, ebx
shr eax, 8
mov edi, ebx
mov dword [ebp - 0x110], eax
and edi, 0xff
and dword [ebp - 0x110], 4
je 0x1011beb
xor ecx, ecx
inc ecx
jmp 0x1011bf1
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0x10c], eax
and dword [ebp - 0x10c], 2
je 0x1011c03
or ecx, 2
mov dword [ebp - 0x108], eax
and dword [ebp - 0x108], 1
je 0x1011c15
or ecx, 4
movzx eax, word [0x1037120]
push edi
push ecx
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
jne 0x1011c3f
mov dword [esi + 0x120], eax
mov dword [esi + 0x124], eax
mov dword [esi + 0x128], eax
jmp 0x1011c9d
lea eax, [ebp - 0x104]
push eax
mov dword [esi + 0x120], ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
and eax, 1
cmp dword [ebp - 0x110], ecx
je 0x1011c6f
movzx edx, byte [ebp - 0xf2]
and eax, edx
cmp dword [ebp - 0x10c], ecx
je 0x1011c80
movzx edx, byte [ebp - 0xf3]
and eax, edx
cmp dword [ebp - 0x108], ecx
je 0x1011c91
movzx edx, byte [ebp - 0xf4]
and eax, edx
cmp eax, ecx
je 0x1011c9d
push ecx
mov ecx, esi
call fcn.01011a78
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01034242
leave
ret 4
Function at 0x1012a65
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push 0x40
push 0x1002888
call fcn.0103454c
mov eax, dword [0x10372d8]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x34], eax
push esi
push 0x103713c
mov ebx, 0x1037388
mov ecx, ebx
call fcn.01012959
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x10373f0], eax
xor eax, eax
mov dword [0x10373f4], eax
mov esi, 0x100287c
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x28], eax
xor edi, edi
inc edi
mov dword [ebp - 0x2c], edi
push dword [0x1037138]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x30], eax
xor esi, esi
cmp eax, esi
je 0x1012af0
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1012af7
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
jmp 0x1012c3a
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x34]
jmp 0x1012b2c
push 0x1002864
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1012b39
push 0x1002850
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1012b42
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.0101290c
mov edi, eax
cmp edi, esi
jne 0x1012b07
jmp 0x1012b52
push esi
push ebx
call fcn.0102f09e
jmp 0x1012b4c
push esi
push 1
mov ecx, ebx
call fcn.01012021
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], esi
je 0x1012c18
call fcn.010124f0
test eax, eax
jge 0x1012b6b
xor eax, eax
jmp 0x1012c3a
push 1
push 4
push ebx
call fcn.0102f02a
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [0x1037380]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x1012bf5
mov ecx, dword [0x10376e4]
cmp ecx, esi
je 0x1012bab
cmp dword [ecx + 0x1c], esi
je 0x1012bab
lea eax, [ebp - 0x50]
push eax
call fcn.0102b874
test eax, eax
jne 0x1012bf5
mov eax, dword [0x10376b0]
cmp eax, esi
je 0x1012bca
mov eax, dword [eax + 4]
cmp eax, esi
je 0x1012bca
lea ecx, [ebp - 0x50]
push ecx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x1012bf5
mov ecx, dword [0x1037eb4]
cmp ecx, esi
je 0x1012be1
lea eax, [ebp - 0x50]
push eax
call fcn.0103408a
test eax, eax
jne 0x1012bf5
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
lea eax, [ebp - 0x50]
push esi
push eax
call edi
cmp eax, 1
je 0x1012b8f
mov dword [0x10373f4], 1
push ebx
call fcn.0102f067
call fcn.01012223
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], esi
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x1012c33
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
call fcn.01034242
call fcn.01034587
ret 0x10
Function at 0x1015f92
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c4
mov eax, dword [0x10372d8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x45
mov dword [ebp - 4], eax
mov dword [ebp - 0x5c0], ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x360]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x360]
push eax
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 0x360], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x350], 1
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
setne al
mov dword [ebp - 0x5c4], eax
call esi
mov ebx, 0x104
cmp eax, ebx
pop ecx
jae 0x1016038
push dword [ebp - 0x5b4]
mov edi, 0x124
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.01006b55
push 0x1002b8c
push edi
lea eax, [ebp - 0x24c]
push eax
call fcn.01007b43
lea eax, [ebp - 0x24c]
push eax
call esi
cmp eax, ebx
pop ecx
jb 0x1016042
mov eax, 0x80070057
jmp 0x1016153
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x5b8], eax
je 0x1016151
xor esi, esi
xor edi, edi
xor ecx, ecx
xor eax, eax
mov ax, word [ebp + ecx*2 - 0x57e]
shl edi, 4
cmp ax, 0x30
jb 0x101608a
cmp ax, 0x39
ja 0x101608a
lea edi, [edi + eax - 0x30]
jmp 0x10160b0
cmp ax, 0x61
jb 0x101609c
cmp ax, 0x66
ja 0x101609c
lea edi, [edi + eax - 0x57]
jmp 0x10160b0
cmp ax, 0x41
jb 0x101612a
cmp ax, 0x46
ja 0x101612a
lea edi, [edi + eax - 0x37]
inc ecx
cmp ecx, 4
jl 0x101606b
push 0x10
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x10160d2
mov ecx, dword [ebp - 0x5c4]
mov dword [eax], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], ecx
mov esi, eax
test esi, esi
je 0x101616b
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
mov dword [ebp - 0x5bc], eax
je 0x1016162
lea ecx, [ebp - 0x584]
push ecx
push dword [ebp - 0x5b4]
push 0x1002b80
push ebx
push eax
call fcn.0100d577
mov eax, dword [ebp - 0x5bc]
mov ecx, dword [ebp - 0x5c0]
add esp, 0x14
push esi
add ecx, 4
mov dword [esi], eax
mov word [esi + 4], di
call fcn.0101ee6c
test eax, eax
je 0x1016162
lea eax, [ebp - 0x5b0]
push eax
push dword [ebp - 0x5b8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1016065
push dword [ebp - 0x5b8]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01034242
leave
ret 4
push 1
mov ecx, esi
call fcn.0101468d
mov eax, 0x8007000e
jmp 0x1016153
Function at 0x10163a6
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x10372d8]
and word [ebp - 0x904], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp + 0x10]
push 0
and eax, 0xff
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, byte [ebp + 0x11]
shl eax, 0x10
test cl, 8
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x910], ecx
je 0x10163fe
or eax, 0x1000000
mov dword [ebp - 0x90c], eax
test cl, 2
push ebx
push esi
push edi
mov edi, 0x80
mov esi, 0x400
mov ebx, 0x1002bb0
je 0x1016446
push edi
lea eax, [ebp - 0x104]
push eax
push 0x11
call fcn.010145e2
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
push ebx
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
test byte [ebp - 0x910], 1
je 0x1016480
push edi
lea eax, [ebp - 0x104]
push eax
push 0x10
call fcn.010145e2
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
push ebx
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
test byte [ebp - 0x910], 4
je 0x10164ba
push edi
lea eax, [ebp - 0x104]
push eax
push 0x12
call fcn.010145e2
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
push ebx
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x90c]
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x104]
push eax
push esi
lea eax, [ebp - 0x904]
push eax
call fcn.01007b43
lea eax, [ebp - 0x904]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x908]
call fcn.01007263
push dword [ebp - 0x908]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01034242
leave
ret 0xc

Function at 0x1016633
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [0x10373fc], 0
jne 0x1016650
call fcn.01016550
test eax, eax
jge 0x1016650
xor eax, eax
pop ebp
ret 0x10
mov ecx, dword [0x10373fc]
pop ebp
jmp fcn.01015a00

Function at 0x101b2d2
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [0x1037408], 0
mov eax, dword [0x10372d8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jne 0x101b33c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x101b332
push 0x1002e7c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01007b43
test eax, eax
jl 0x101b332
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1037408], eax
cmp dword [0x1037408], 0
pop esi
je 0x101b365
mov eax, dword [0x103740c]
test eax, eax
jne 0x101b35f
push 0x1002e68
push dword [0x1037408]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x103740c], eax
je 0x101b365
push edi
push dword [ebp + 8]
call eax
mov ecx, dword [ebp - 4]
pop edi
call fcn.01034242
leave
ret 8
Function at 0x101b910
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
mov esi, 0x1000
call edi
test ah, ah
jns 0x101b93d
add esi, 8
push 0x10
call edi
test ah, ah
jns 0x101b948
or esi, 4
push 0x12
call edi
test ah, ah
jns 0x101b953
or esi, 0x20
mov eax, dword [ebp + 8]
sub eax, 0x202
je 0x101b982
dec eax
je 0x101b971
dec eax
dec eax
je 0x101b96c
dec eax
jne 0x101b9ab
or esi, 2
jmp 0x101b974
or esi, 2
jmp 0x101b997
or esi, 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
push 0x708
jmp 0x101b9a3
mov ecx, dword [ebp - 4]
xor eax, eax
push eax
push eax
push eax
push eax
push 1
push 0xfffffffffffffffe
call fcn.01019269
or esi, 1
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
push 0x707
mov ecx, dword [ebp - 4]
call fcn.0101a7cc
pop edi
pop esi
leave
ret 4
Function at 0x101baa5
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x101baef
push dword [esi + 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_SetEvent]
call ebx
push dword [esi + 0x3c]
call ebx
push 0x1388
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x101baea
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x101baef
push dword [esi + 0x40]
call edi
mov ecx, dword [esi + 0x4c]
test ecx, ecx
je 0x101bafd
push 1
call fcn.01016b0e
mov eax, dword [esi + 0x28]
test eax, eax
je 0x101bb07
push eax
call edi
mov eax, dword [esi + 0x2c]
test eax, eax
je 0x101bb11
push eax
call edi
mov eax, dword [esi + 0x34]
test eax, eax
je 0x101bb1b
push eax
call edi
mov eax, dword [esi + 0x30]
test eax, eax
je 0x101bb25
push eax
call edi
mov eax, dword [esi + 0x38]
test eax, eax
je 0x101bb2f
push eax
call edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x101bb39
push eax
call edi
lea edi, [esi + 0x98]
mov eax, dword [edi]
test eax, eax
je 0x101bb54
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [esi + 8], 0
je 0x101bb6e
mov ecx, esi
call fcn.0101b47a
push dword [esi + 8]
call dword [sym.imp.USER32.dll_DestroyIcon]
and dword [esi + 8], 0
push dword [esi + 0x50]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [esi + 0x94]
test ecx, ecx
je 0x101bb88
push 1
call fcn.0101afc0
mov ecx, dword [esi + 0x90]
test ecx, ecx
je 0x101bb98
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0x64]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_KillTimer]
je 0x101bbaa
push eax
push dword [esi]
call edi
mov eax, dword [esi + 0x60]
test eax, eax
je 0x101bbb6
push eax
push dword [esi]
call edi
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x101bbc6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
call edi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_DestroyWindow]
je 0x101bbe0
push dword [esi + 4]
call ebx
push dword [esi]
call edi
test eax, eax
je 0x101bbec
push dword [esi]
call ebx
pop edi
pop esi
mov ecx, 0x1037388
pop ebx
jmp fcn.010129f5
Function at 0x101c21f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov esi, ecx
call fcn.01016b34
xor edi, edi
cmp eax, edi
jl 0x101c387
push 0x10
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
mov dword [esi + 0x50], eax
je 0x101c367
push 0x10
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
je 0x101c26a
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], 1
jmp 0x101c26c
xor eax, eax
cmp eax, edi
mov dword [esi + 0x94], eax
je 0x101c367
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
je 0x101c28f
mov ecx, eax
call fcn.01029259
jmp 0x101c291
xor eax, eax
cmp eax, edi
mov dword [esi + 0x4c], eax
je 0x101c367
lea eax, [esi + 0x44]
push eax
push edi
push esi
push 0x101682c
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x40], eax
je 0x101c322
push ebx
push 0xffffffffffffffff
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x103738c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
mov ebx, 0x1002ec4
push eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0x101bc24
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
push esi
push dword [0x103738c]
push edi
push edi
push edi
push edi
push edi
push edi
push 0x80000000
push 0x1001f0c
push ebx
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
cmp eax, edi
mov dword [esi], eax
pop ebx
jne 0x101c340
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x101c332
call esi
jmp 0x101c387
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x101c387
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
je 0x101c359
mov dword [eax + 4], edi
mov dword [eax], 0x1002e40
mov ecx, eax
jmp 0x101c35b
xor ecx, ecx
cmp ecx, edi
lea eax, [esi + 0x9c]
mov dword [eax], ecx
jne 0x101c36e
mov eax, 0x8007000e
jmp 0x101c387
mov edx, dword [esi]
mov dword [ecx + 8], edx
mov eax, dword [eax]
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov dword [esi + 0x80], 1
xor eax, eax
pop edi
pop esi
leave
ret