joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012c76
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
test byte [0x10382cc], 0x20
jne 0x1012df7
push dword [0x1038260]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1012df7
mov eax, dword [0x1038258]
test byte [eax], 1
push esi
push edi
je 0x1012ce2
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x1012def
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
shr eax, 1
push eax
push edi
call fcn.010128dd
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1012def
push ebx
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1012dee
mov esi, dword [0x1038258]
push ebx
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtWaitForSingleObject]
push dword [esi + 0x58]
mov eax, dword [esi + 0x40]
push eax
push dword [esi + 0x44]
push 4
push eax
push dword [0x1038268]
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x1012de4
push dword [0x1038268]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call edi
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1012dcd
push dword [0x1038268]
call edi
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x1012dc4
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 4]
call edi
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call edi
mov edi, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 0x10]
call edi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
lea eax, [ebp - 0x28]
push eax
push 0x18
push dword [ebp - 8]
call edi
push dword [esi + 0x58]
push dword [esi + 0x40]
push dword [esi + 0x44]
push dword [ebp - 0x20]
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_GetDIBits]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push ebx
push dword [0x1038260]
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
push dword [esi + 0x50]
call dword [sym.imp.ntdll.dll_NtReleaseMutant]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
leave
ret
Function at 0x1015173
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x10152e5
cmp word [ebx + 0x18], 0
je 0x10152e5
mov cx, word [ebp + 0x10]
test cx, cx
jne 0x10151a1
xor eax, eax
jmp 0x10152ea
cmp word [ebx + 0x10], 0
je 0x10151c8
movsx eax, word [ebx + 0x12]
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x10151c8
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x101530a
xor esi, esi
mov dword [ebp + 8], esi
cmp dword [ebp + 0x14], esi
je 0x10151fa
movzx eax, word [ebx + 0x14]
push 1
push eax
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
push ebx
call fcn.010149aa
movzx eax, ax
cmp ax, 0xffff
je 0x10151fa
push eax
push ebx
call fcn.01014859
mov dword [ebp + 8], eax
movzx eax, word [ebx + 0x10]
movzx ecx, word [ebx + 0x18]
inc word [ebx + 0x12]
cmp ax, cx
jge 0x1015212
inc eax
mov word [ebx + 0x10], ax
jmp 0x1015262
movzx eax, word [ebx + 0x12]
cmp ax, cx
jl 0x1015221
xor eax, eax
mov word [ebx + 0x12], ax
inc word [ebx + 0x16]
movzx eax, word [ebx + 0x16]
cmp ax, cx
jl 0x1015234
xor eax, eax
mov word [ebx + 0x16], ax
movsx eax, word [ebx + 0x12]
push dword [ebx + eax*4 + 0x28]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ax, word [ebx + 0x14]
cmp ax, word [ebx + 0x12]
jne 0x1015262
mov eax, 0xffffffff
mov word [ebx + 0x14], ax
movzx eax, word [ebx + 0x14]
cmp ax, 0xffff
je 0x1015289
mov cx, word [ebp + 0x10]
cwde
mov eax, dword [ebx + eax*4 + 0x28]
cmp word [eax], cx
jne 0x1015289
mov edi, dword [ebp + 0xc]
movzx ecx, cx
lea esi, [eax + 2]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x101528f
push ebx
call fcn.01015152
movsx eax, word [ebx + 0x12]
lea esi, [ebx + eax*4 + 0x28]
mov eax, dword [ebp + 8]
test eax, eax
je 0x10152a2
mov dword [esi], eax
jmp 0x101530a
movzx edi, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea edx, [edi + 2]
push edx
add ecx, 0xc0000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi], eax
test eax, eax
jne 0x10152f1
cmp word [ebx + 0x12], ax
jg 0x10152dd
mov ax, word [ebx + 0x10]
mov word [ebx + 0x12], ax
dec word [ebx + 0x12]
dec word [ebx + 0x10]
mov eax, 0xc0000017
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov cx, word [ebp + 0x10]
mov word [eax], cx
mov eax, dword [esi]
push edi
push dword [ebp + 0xc]
inc eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
or dword [ebx + 8], 2
jmp 0x101519a
Function at 0x1015392
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x10153a3
xor eax, eax
jmp 0x1015422
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x18]
movzx eax, di
shr eax, 4
xor esi, esi
inc eax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x1015412
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1015412
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x1015412
and edi, 0xf
jmp 0x10153e6
dec edi
lea eax, [eax + esi*2]
movzx esi, word [eax]
inc eax
inc eax
test edi, edi
jne 0x10153e2
cmp dword [ebp + 0x14], edi
jne 0x10153f8
mov dword [ebx], eax
jmp 0x101541e
dec dword [ebp + 0x14]
cmp esi, dword [ebp + 0x14]
jbe 0x1015403
mov esi, dword [ebp + 0x14]
lea ecx, [esi + esi]
push ecx
push eax
push ebx
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x101541e
xor eax, eax
mov word [ebx + esi*2], ax
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x1015633
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x14
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov esi, eax
test esi, esi
jne 0x101566e
mov eax, 0xc0000017
jmp 0x1015740
movzx edx, word [ebp + 0x10]
mov ecx, dword [0x1038030]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
mov dword [ebp - 4], edx
call edi
mov dword [esi + 0xc], eax
test eax, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
jne 0x10156af
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1015664
mov ecx, dword [0x1038030]
push ebx
movzx ebx, word [ebp + 0x18]
push ebx
add ecx, 0x80000
push ecx
push dword [eax + 0x18]
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10156fe
push dword [esi + 0xc]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
mov eax, 0xc0000017
jmp 0x101573f
push dword [ebp - 4]
mov ax, word [ebp + 0x10]
push dword [ebp + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_memmove]
push dword [esi + 0xc]
mov word [esi + 8], ax
mov ax, word [ebp + 0x18]
mov word [esi + 0xa], ax
call edi
push ebx
push dword [ebp + 0x14]
push dword [esi + 0x10]
call edi
mov eax, dword [ebp + 8]
add eax, 0x10
mov ecx, dword [eax]
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [ecx + 4], esi
add esp, 0x18
mov dword [eax], esi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x14
Function at 0x10157c5
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
push edi
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [eax + 4], ecx
push dword [esi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
push dword [esi + 0x10]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call edi
pop edi
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x101aed0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101af0f
cmp dword [ebp - 8], 2
jne 0x101af0f
movzx eax, word [ebp - 4]
push 1
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101af0f
inc esi
mov eax, esi
pop esi
leave
ret 4

Function at 0x101af1b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101af61
cmp dword [ebp - 4], 4
jne 0x101af61
mov eax, dword [ebp - 8]
cmp eax, 4
jbe 0x101af61
push 1
push esi
add eax, 0xfffffffc
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101af61
inc esi
mov eax, esi
pop esi
leave
ret 4

Function at 0x101af6d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101afc3
cmp dword [ebp - 8], 2
jne 0x101afc3
mov eax, 0x104
cmp word [ebp - 4], ax
ja 0x101afc3
movzx ecx, word [ebp - 4]
xor eax, eax
cmp dword [ebp + 0xc], esi
push 1
setne al
push esi
inc eax
imul eax, ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x101afc3
inc esi
mov eax, esi
pop esi
leave
ret 8
Function at 0x101afcf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
and dword [ebp - 0x11c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push 0
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x114]
push eax
push 2
lea eax, [ebp - 0x110]
push eax
push ebx
call esi
test eax, eax
je 0x101b0da
cmp dword [ebp - 0x114], 2
jne 0x101b0da
mov eax, 0x104
cmp word [ebp - 0x110], ax
ja 0x101b0da
movzx edi, word [ebp - 0x110]
cmp edi, dword [ebp + 0x14]
jae 0x101b0da
xor eax, eax
cmp dword [ebp + 0xc], eax
push eax
lea eax, [ebp - 0x114]
push eax
je 0x101b088
add edi, edi
push edi
push dword [ebp - 0x118]
push ebx
call esi
test eax, eax
je 0x101b0da
cmp dword [ebp - 0x114], edi
jne 0x101b0da
movzx eax, word [ebp - 0x110]
mov edx, dword [ebp - 0x118]
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x101b0ce
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
call esi
test eax, eax
je 0x101b0da
cmp dword [ebp - 0x114], edi
jne 0x101b0da
push dword [ebp + 0x14]
movzx eax, word [ebp - 0x110]
push dword [ebp - 0x118]
mov byte [ebp + eax - 0x10c], 0
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x101b0da
mov dword [ebp - 0x11c], 1
jmp 0x101b0eb
cmp dword [ebp + 0x14], 0
jbe 0x101b0eb
mov ecx, dword [ebp - 0x118]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010015a8
leave
ret 0x10

Function at 0x101b107
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
lea eax, [ebp + 0xc]
push eax
mov edi, 0xc4
push edi
lea eax, [esi + 8]
push eax
push dword [ebp + 8]
mov dword [esi], 0xcc
mov dword [esi + 4], 0xa0000002
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101b171
cmp dword [ebp + 0xc], edi
jne 0x101b171
mov eax, 0x7fff
cmp dword [esi + 0x80], eax
ja 0x101b171
cmp dword [esi + 0x84], eax
ja 0x101b171
cmp word [esi + 0xc], 0
jl 0x101b171
cmp word [esi + 0xe], 0
jl 0x101b171
mov dword [ebp - 4], 1
jmp 0x101b181
push 0xcc
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x101b18f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
push esi
lea ecx, [ebp + 0xc]
push ecx
mov dword [eax], 0xc
mov dword [eax + 4], 0xa0000004
push 4
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x101b1c6
cmp dword [ebp + 0xc], 4
jne 0x101b1c6
inc esi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x101b318
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x214], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x210], eax
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.010058fe
test eax, eax
jl 0x101b499
mov edi, dword [sym.imp.msvcrt.dll_wcsrchr]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x101b37e
mov word [ebp - 0x20c], ax
jmp 0x101b38f
xor ecx, ecx
push 0x5c
push esi
mov word [eax + 2], cx
call edi
mov esi, eax
pop ecx
inc esi
pop ecx
inc esi
push 0x101b4e4
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0101b2a2
test eax, eax
jl 0x101b499
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x210]
push 0
push esi
push 0x101b4bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x101b45e
mov eax, dword [ebp - 0x210]
cmp word [eax], 0x40
jne 0x101b499
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x101b499
cmp eax, ebx
ja 0x101b499
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101ae7f
test eax, eax
je 0x101b499
push 2
push 0
lea eax, [ebp - 0x20a]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x101b499
push dword [ebp + 0x10]
push dword [ebp - 0x210]
push dword [ebp - 0x218]
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x101b455
mov dword [ebp - 0x214], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x101b490
push esi
push dword [ebp + 0x10]
push dword [ebp - 0x210]
call fcn.010058fe
test eax, eax
jl 0x101b499
push 0x2e
push dword [ebp - 0x210]
call edi
pop ecx
pop ecx
test eax, eax
je 0x101b486
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x214], 1
cmp dword [ebp - 0x214], 0
jne 0x101b4aa
cmp dword [ebp + 0x10], 0
jbe 0x101b4aa
mov ecx, dword [ebp - 0x210]
xor eax, eax
mov word [ecx], ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010015a8
leave
ret 0xc
Function at 0x101b755
Capabilities:
Accept command line arguments

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp word [eax], 0x22
push 2
pop edx
jne 0x101b77f
add eax, edx
movzx ecx, word [eax]
test cx, cx
je 0x101b77a
cmp cx, 0x22
jne 0x101b764
cmp word [eax], 0
jne 0x101b77d
xor eax, eax
ret
add eax, edx
movzx ecx, word [eax]
test cx, cx
je 0x101b77a
cmp cx, 0x22
je 0x101b797
add eax, edx
movzx ecx, word [eax]
test cx, cx
jne 0x101b787
cmp word [eax], 0
je 0x101b77a
add eax, edx
cmp word [eax], 0
mov ecx, eax
je 0x101b7bb
cmp word [ecx], 0x22
je 0x101b7b6
add ecx, edx
cmp word [ecx], 0
jne 0x101b7a7
ret
xor edx, edx
mov word [ecx], dx
ret

Function at 0x101be18
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x14
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
push dword [0x1038040]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [ebp + 0xc], 0
mov edi, eax
je 0x101be7c
push 0
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x100
lea eax, [ebp - 0x22c]
push eax
call fcn.0101bcbe
mov esi, dword [ebp - 0x230]
push 0x20
pop eax
mov word [esi], ax
inc esi
inc esi
jmp 0x101be82
lea esi, [ebp - 0x22c]
mov eax, 0xff
sub eax, edi
push eax
push esi
push dword [0x1038260]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x101bed0
cmp dword [ebp + 0xc], 0
je 0x101bea9
lea eax, [ebp - 0x22c]
jmp 0x101bec3
push edi
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x101bed0
lea eax, [ebp + edi*2 - 0x22a]
push eax
push dword [0x1038260]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.010015a8
leave
ret 8
Function at 0x101c061
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x2d4]
cmp dword [ebp + 0xc], ebx
je 0x101c09a
push 0xc4
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x101c0a7
push eax
call fcn.0101bee5
and dword [ebp - 0x274], 0xffffffbf
mov eax, dword [ebp + 0xc]
shl eax, 7
xor eax, dword [ebp - 0x274]
mov dword [ebp - 0x224], edi
and eax, 0x80
xor dword [ebp - 0x274], eax
call fcn.01001530
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
jae 0x101c14e
push 0x101c180
sub esi, eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.0101b2a2
test eax, eax
jl 0x101c14e
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x2d8], eax
cmp eax, ebx
je 0x101c14e
push 0x101c19c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x101c142
push ebx
push ebx
push 1
push edi
call esi
push ebx
lea eax, [ebp - 0x2d4]
push eax
push 5
push edi
call esi
push ebx
push ebx
push 7
push edi
call esi
push dword [ebp - 0x2d8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.01001510
cmp dword [ebp + 0xc], ebx
pop edi
pop esi
pop ebx
jne 0x101c170
test byte [ebp - 0x274], 0x40
je 0x101c170
lea eax, [ebp - 0x2d4]
push eax
call fcn.0101b966
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010015a8
leave
ret 8

Function at 0x101ddc7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp dword [edi], ebx
je 0x101de26
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [edi + 4]
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi + 0xc]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
push dword [edi]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call esi
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
pop ebp
ret 4
Function at 0x1020429
Capabilities:
Map section object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x4000000
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x20]
push eax
push 0xf001f
push edi
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.ntdll.dll_NtCreateSection]
cmp eax, esi
jl 0x10204f0
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
push 4
push esi
push 2
push ebx
push esi
push dword [ebp + 0xc]
mov dword [eax], esi
push esi
push eax
push 0xffffffffffffffff
mov dword [ebx], esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, esi
mov dword [ebp + 8], eax
jge 0x10204b0
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp + 8]
jmp 0x10204ef
mov eax, dword [ebp + 0x1c]
push 4
push 0x100000
push 2
push ebx
push esi
push dword [ebp + 0xc]
mov dword [eax], esi
push esi
push eax
push dword [ebp + 0x18]
mov dword [ebx], esi
push dword [edi]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
mov ebx, eax
cmp ebx, esi
jge 0x10204ed
mov eax, dword [ebp + 0x10]
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
push dword [edi]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x18

Function at 0x10207c6
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi + 2]
push 1
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, word [esi]
pop esi
test cl, 3
je 0x10207ea
or eax, 0x100
test cl, 4
je 0x10207f4
or eax, 0x200
test cl, 8
je 0x10207fe
or eax, 0x400
pop ebp
ret 4
Function at 0x1023fc1
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1038416], 0
je 0x1023fd5
pop ebp
jmp fcn.01033763
pop ebp
jmp fcn.01002ed4

Function at 0x102402b
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp byte [0x1038416], 0
je 0x102403f
pop ebp
jmp fcn.0103540a
pop ebp
jmp fcn.01002348
Function at 0x102a016
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
test byte [0x1038f18], 1
push ebx
push esi
push edi
jne 0x102a045
or dword [0x1038f18], 1
call fcn.01029fb5
mov dword [0x1038f14], eax
push 4
pop eax
call fcn.0100bd4c
mov esi, esp
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x102a067
xor eax, eax
jmp 0x102a124
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x4c]
lea edi, [eax - 1]
not edi
and edi, esi
sub edi, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x1038f10]
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xffff1000
add esi, 0x11000
add esi, ebx
cmp edi, esi
jb 0x102a060
cmp eax, 1
je 0x102a105
mov dword [ebp - 8], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102a060
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
test dword [ebp - 0x1c], ebx
je 0x102a0ae
test dword [ebp - 0x18], 0x100
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
je 0x102a0e0
xor eax, eax
inc eax
jmp 0x102a124
cmp edi, eax
jb 0x102a060
cmp eax, esi
jae 0x102a0ef
mov dword [ebp - 8], esi
push 4
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x1038f10]
jmp 0x102a108
mov dword [ebp - 8], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0x10]
push ecx
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x5c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010015a8
leave
ret