joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x401730
Capabilities:
Create thread
Initialize winsock library
Set socket configuration

Disassembly:
sub esp, 0x1a4
lea eax, [esp + 0x14]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
push 0
je 0x401765
push 0x4041e0
push str.WSAStartup_error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0x1a4
ret
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push str.127.0.0.1
mov dword [0x4041dc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x2717
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [0x4041dc]
lea ecx, [esp + 4]
push 0x10
push ecx
push edx
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x4017df
push 0
push 0x4041e0
push str.bind_error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x4041dc]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
add esp, 0x1a4
ret
mov ecx, dword [0x4041dc]
push 5
push ecx
call dword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x401819
push 0
push 0x4041e0
push str.Listen_is_error
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [0x4041dc]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [0x4041dc]
lea eax, [esp]
push esi
push eax
push 0x8004667e
push ecx
mov dword [esp + 0x10], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x4041b4
push 0
push 0
push 0x401660
push 0
push 0
call esi
push 0x4041b4
push 0
push 0
push 0x401690
push 0
push 0
mov dword [0x4041c0], eax
call esi
mov dword [0x4041bc], eax
pop esi
add esp, 0x1a4
ret
Function at 0x401c17
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 0x1c], 0x6b
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x6e
mov byte [ebp - 0x18], 0x65
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x33
mov byte [ebp - 0x15], 0x32
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x3c], 0x46
mov byte [ebp - 0x3b], 0x69
mov byte [ebp - 0x3a], 0x6e
mov byte [ebp - 0x39], 0x64
mov byte [ebp - 0x38], 0x52
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x73
mov byte [ebp - 0x35], 0x6f
mov byte [ebp - 0x34], 0x75
mov byte [ebp - 0x33], 0x72
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x57
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x4c], 0x53
mov byte [ebp - 0x4b], 0x69
mov byte [ebp - 0x4a], 0x7a
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x6f
mov byte [ebp - 0x47], 0x66
mov byte [ebp - 0x46], 0x52
mov byte [ebp - 0x45], 0x65
mov byte [ebp - 0x44], 0x73
mov byte [ebp - 0x43], 0x6f
mov byte [ebp - 0x42], 0x75
mov byte [ebp - 0x41], 0x72
mov byte [ebp - 0x40], 0x63
mov byte [ebp - 0x3f], 0x65
mov byte [ebp - 0x3e], bl
mov byte [ebp - 0x2c], 0x4c
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x64
mov byte [ebp - 0x28], 0x52
mov byte [ebp - 0x27], 0x65
mov byte [ebp - 0x26], 0x73
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x75
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x63
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], bl
call dword [0x40c014]
push ebx
mov edi, eax
call dword [0x40c00c]
mov esi, dword [0x40c008]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x3c]
push eax
push edi
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x4c]
push eax
push edi
call esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2c]
push eax
push edi
call esi
mov esi, dword [ebp - 8]
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x401d81
push 0xa
push 1
push esi
call dword [ebp - 4]
mov edi, eax
cmp edi, ebx
je 0x401d81
push edi
push esi
call dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x401d81
push edi
push esi
call dword [ebp - 0x10]
mov edi, eax
cmp edi, ebx
je 0x401d81
push 4
push 0x3000
push dword [ebp - 4]
push ebx
call dword [0x40c010]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x10], esi
je 0x401d81
mov edx, dword [ebp - 4]
mov ecx, edi
sub esi, edi
mov al, byte [ecx]
dec edx
mov byte [esi + ecx], al
inc ecx
cmp edx, ebx
jne 0x401d71
mov eax, dword [ebp - 0x10]
jmp 0x401d83
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40597a
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
mov esi, 0x100
mov dword [ebp + eax*4 - 0x408], eax
inc eax
cmp eax, esi
jl 0x40598f
xor ecx, ecx
mov ebx, dword [ebp + 0x10]
mov edx, ecx
and edx, 0x3f
movzx edx, byte [edx + ebx]
lea eax, [ebp + ecx*4 - 0x408]
add edx, dword [eax]
add edi, edx
and edi, 0x800000ff
jns 0x4059c4
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [eax]
mov byte [ebp - 1], dl
lea edx, [ebp + edi*4 - 0x408]
mov ebx, dword [edx]
mov dword [eax], ebx
movzx eax, byte [ebp - 1]
inc ecx
cmp ecx, esi
mov dword [edx], eax
jl 0x40599d
and dword [ebp - 8], 0
cmp dword [ebp + 0xc], 0
jbe 0x405a53
inc ecx
and ecx, 0x800000ff
jns 0x4059fa
dec ecx
or ecx, 0xffffff00
inc ecx
lea eax, [ebp + ecx*4 - 0x408]
mov edx, dword [eax]
add edi, edx
and edi, 0x800000ff
jns 0x405a15
dec edi
or edi, 0xffffff00
inc edi
lea esi, [ebp + edi*4 - 0x408]
mov ebx, dword [esi]
mov dword [eax], ebx
movzx ebx, dl
mov edx, dword [ebp + 8]
mov dword [esi], ebx
mov eax, dword [eax]
mov esi, dword [ebp - 8]
add eax, ebx
add edx, esi
and eax, 0x800000ff
jns 0x405a3f
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x408]
xor byte [edx], al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jb 0x4059e9
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405afb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x50
push 0x40d528
call 0x40bff4
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
fldlg2
movq qword [ebp - 0x2c], mm7
cmp dword [ebp - 0x2c], ebx
je 0x405c8a
mov byte [ebp - 0x4c], 0x4e
mov byte [ebp - 0x4b], 0x74
mov byte [ebp - 0x4a], 0x50
mov byte [ebp - 0x49], 0x6f
mov byte [ebp - 0x48], 0x77
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x72
mov byte [ebp - 0x45], 0x49
mov byte [ebp - 0x44], 0x6e
mov byte [ebp - 0x43], 0x66
mov byte [ebp - 0x42], 0x6f
mov byte [ebp - 0x41], 0x72
mov byte [ebp - 0x40], 0x6d
mov byte [ebp - 0x3f], 0x61
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x69
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x3b], 0x6e
mov byte [ebp - 0x3a], bl
mov byte [ebp - 0x60], 0x5a
mov byte [ebp - 0x5f], 0x77
mov byte [ebp - 0x5e], 0x50
mov byte [ebp - 0x5d], 0x6f
mov byte [ebp - 0x5c], 0x77
mov byte [ebp - 0x5b], 0x65
mov byte [ebp - 0x5a], 0x72
mov byte [ebp - 0x59], 0x49
mov byte [ebp - 0x58], 0x6e
mov byte [ebp - 0x57], 0x66
mov byte [ebp - 0x56], 0x6f
mov byte [ebp - 0x55], 0x72
mov byte [ebp - 0x54], 0x6d
mov byte [ebp - 0x53], 0x61
mov byte [ebp - 0x52], 0x74
mov byte [ebp - 0x51], 0x69
mov byte [ebp - 0x50], 0x6f
mov byte [ebp - 0x4f], 0x6e
mov byte [ebp - 0x4e], bl
call fcn.00405a58
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
mov eax, 5
xor eax, 0x35
mov eax, dword fs:[eax]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
wait
mov dword [ebp - 4], ebx
xor eax, eax
div eax
wait
or dword [ebp - 4], 0xffffffff
jmp 0x405bfe
call fcn.00405a58
push 0x40ed50
push eax
mov esi, dword [0x40c008]
call esi
mov edi, eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x1c]
call esi
mov dword [0x40f8c8], eax
cmp eax, ebx
jne 0x405c33
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x20]
call esi
mov dword [0x40f8c8], eax
lea ecx, [ebp - 0x2c]
push ecx
push 0x40
push 5
push eax
call edi
test eax, eax
je 0x405c86
mov eax, dword [0x40f8c8]
mov cl, byte [eax]
mov byte [0x40f8cc], cl
mov ecx, dword [eax + 1]
mov dword [0x40f8d0], ecx
mov byte [eax], 0xe9
mov ecx, 0x404e80
mov eax, dword [0x40f8c8]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
push 0x40d26c
push dword [ebp - 0x24]
call esi
lea ecx, [ebp - 0x38]
push ecx
call eax
xor eax, eax
inc eax
call 0x40c02f
ret
xor eax, eax
jmp 0x405c80
push ebx
call dword [0x40c004]
int3
Function at 0x1001585
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
call dword [0x100114c]
call dword [0x1001150]
push edi
call dword [0x1001154]

Function at 0x1001821
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x210], 0
and dword [ebp - 0x214], 0
push ebx
push esi
push edi
call dword [0x100116c]
mov edi, dword [0x10012c0]
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x22
je 0x100328d
cmp ax, 0x20
jbe 0x1001873
push esi
call edi
mov esi, eax
cmp word [esi], 0x20
ja 0x1001868
movzx eax, word [esi]
test ax, ax
je 0x1001888
cmp ax, 0x20
ja 0x1001888
push esi
call edi
mov esi, eax
jmp 0x1001873
mov ebx, dword [0x1001438]
cmp word [esi], 0x20
je 0x1001f20
movzx eax, word [esi]
cmp ax, 0x2f
je 0x10018a7
cmp ax, 0x2d
jne 0x10018fb
push esi
call edi
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x100188e
cmp ax, 0x20
je 0x100188e
movzx eax, ax
cmp eax, 0x61
jle 0x1004811
sub eax, 0x65
je 0x1004846
sub eax, 7
je 0x100489c
dec eax
je 0x10032b6
sub eax, 5
je 0x100489c
dec eax
jne 0x10029ca
mov dword [ebp - 0x210], 1
jmp 0x10018a7
xor ebx, ebx
cmp dword [ebp + 8], 1
je 0x10047fe
cmp dword [ebp - 0x214], ebx
jne 0x1004864
cmp word [esi], bx
je 0x10032af
push esi
call fcn.0100269e
cmp dword [ebp + 8], 1
mov edi, eax
je 0x1004855
cmp edi, ebx
je 0x100196e
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [0x1001170]
cmp eax, ebx
je 0x1001954
cmp eax, esi
jae 0x1001954
lea edi, [ebp - 0x20c]
push ebx
push edi
push dword [ebp - 0x210]
push ebx
call fcn.010023b8
push ebx
call fcn.0100269e
mov edi, eax
cmp edi, ebx
jne 0x1001937
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4
push esi
call edi
mov esi, eax
jmp 0x100188e
dec eax
dec eax
jne 0x10018a7
jmp 0x1004820
push esi
call edi
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x10032a0
cmp ax, 0x22
jne 0x100328d
cmp word [esi], 0x22
je 0x1001881
jmp 0x1001873
xor eax, eax
jmp 0x1001971
and dword [0x101d074], 0
jmp 0x10018a7
cmp dword [ebp - 0x210], ebx
je 0x100485d
cmp word [esi], bx
jne 0x1001907
jmp 0x100485d
je 0x100483c
sub eax, 0x41
je 0x100483c
sub eax, 4
jmp 0x10018c9
push 0xb
push 0x10048f8
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x10018a7
push 0x10048e4
jmp 0x10048b2
mov dword [0x101d0ec], 4
mov dword [ebp - 0x214], 1
jmp 0x10018a7
cmp edi, ebx
jne 0x1001932
call fcn.0100c84f
jmp 0x10048b7
push esi
call fcn.0100269e
push ebx
mov esi, eax
call fcn.0100269e
cmp dword [ebp + 8], 1
mov edi, eax
jne 0x1004882
cmp esi, ebx
je 0x100485d
cmp edi, ebx
je 0x100485d
push ebx
call fcn.0100269e
test eax, eax
jne 0x10048b7
push edi
push esi
push dword [ebp - 0x210]
push ebx
call fcn.010110e5
jmp 0x10048b7
push 9
push 0x10048d0
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x10048b7
push 0x10048c0
call fcn.0100c86b
push 2
pop eax
jmp 0x1001971
Function at 0x1002090
Capabilities:
Read file on windows

Disassembly:
cmp dword [0x101d040], 1
push 0
lea eax, [ebp - 4]
push eax
jne 0x1004a90
push 0x10000
push 0x103d100
push dword [0x105d100]
call dword [0x10010fc]
test eax, eax
je 0x1004a81
mov eax, dword [ebp - 4]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [0x105d110]
and dword [0x105d104], 0
mov dword [0x105d10c], eax
mov eax, dword [ebp - 4]
add dword [0x105d114], eax
test ecx, ecx
je 0x1002064
mov eax, dword [0x105d114]
xor edx, edx
div ecx
cmp eax, 0x64
jbe 0x1002067
push 0x64
pop eax
cmp dword [0x105d118], eax
je 0x10020a9
push eax
mov dword [0x105d118], eax
call fcn.01001f3f
jmp 0x10020a9
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x105d104]
push esi
push edi
cmp eax, dword [0x105d10c]
je 0x1001ffe
mov eax, dword [0x105d104]
cmp eax, dword [0x105d10c]
jge 0x10020d3
mov ax, word [eax*2 + 0x103d100]
mov ecx, dword [ebp + 8]
mov word [ecx], ax
inc dword [0x105d104]
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 4
xor eax, eax
jmp 0x10020cd
mov dword [0x101d068], 0x82
jmp 0x10020d3
mov edi, 0x10000
push edi
mov esi, 0x101d100
push esi
push dword [0x105d100]
call dword [0x10010fc]
test eax, eax
je 0x1004a81
push edi
push 0x103d100
push dword [ebp - 4]
push esi
push 1
push 3
call dword [0x10010e8]
jmp 0x1002037
Function at 0x1002dfb
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x80c]
push eax
push 0x10029e8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, dword [fcn.01001388]
xor ebx, ebx
test eax, eax
jne 0x1002f4c
lea eax, [ebp - 0x84c]
push eax
push edi
mov dword [ebp - 0x84c], 0x2c
call dword [0x1001354]
mov eax, dword [0x101d0a0]
push ebx
push ebx
mov dword [ebp - 0x820], eax
mov eax, dword [0x101d094]
mov edi, 0x101d
push edi
push eax
mov dword [ebp - 0x808], eax
call esi
push ebx
push 1
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x81c], eax
call esi
push ebx
push 2
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x818], eax
call esi
mov edi, dword [entry0]
mov dword [ebp - 0x814], eax
xor eax, eax
cmp dword [0x101d0b0], ebx
push 0x40
setne al
mov dword [ebp - 0x810], eax
lea eax, [ebp - 0x84c]
push eax
push 3
push ebx
push 0x10029d8
push dword [ebp - 0x80c]
call edi
push 4
push 0x105d120
push 4
push ebx
push 0x1002a60
push dword [ebp - 0x80c]
call edi
mov eax, dword [0x101d090]
push 3
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push ebx
push 9
push 0x110a
push eax
mov dword [ebp - 0x808], eax
call esi
push eax
push dword [ebp - 0x808]
call fcn.01002c60
lea eax, [ebp - 0x804]
push eax
call dword [fcn.01001190]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push 1
push ebx
push 0x1002a74
push dword [ebp - 0x80c]
call edi
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 9
push 0x110b
push dword [0x101d090]
call esi
mov eax, dword [0x101d0a8]
cmp eax, ebx
jne 0x10040dc
mov eax, dword [0x101d0a4]
cmp eax, ebx
je 0x1002f79
push eax
call dword [0x10014b0]
push ebx
call dword [0x1001358]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002f69

Function at 0x100309b
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x1001248]
push 0xe
call esi
push 0xd
mov dword [0x101d07c], eax
call esi
push 8
mov dword [0x101d070], eax
call esi
push 5
mov dword [0x101d078], eax
call esi
push eax
push dword [0x101d0a4]
mov dword [0x101d06c], eax
call dword [fcn.01001498]
push dword [0x101d06c]
push 0
push 0x1001
push dword [0x101d094]
call dword [fcn.01001388]
pop esi
ret
Function at 0x10060da
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x105e2e0]
push esi
mov esi, dword [0x105e2e4]
push edi
xor edi, edi
sub esi, eax
je 0x1006160
mov ecx, dword [0x105e2a4]
push dword [ebp + 8]
add ecx, eax
mov dword [ebp - 4], ecx
call dword [fcn.01001350]
test eax, eax
je 0x1006160
push ebx
lea eax, [esi + 7]
push eax
push 0x2002
call dword [fcn.01001198]
mov ebx, eax
test ebx, ebx
je 0x1006159
push ebx
call dword [fcn.0100119c]
push esi
push dword [ebp - 4]
mov edi, eax
lea eax, [edi + 4]
push eax
call fcn.01019f83
add esp, 0xc
push ebx
mov dword [edi], esi
call dword [fcn.010011a0]
call dword [fcn.0100134c]
push ebx
push dword [0x101d080]
call dword [fcn.01001348]
xor edi, edi
inc edi
call dword [fcn.01001344]
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x100616d
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
test byte [0x105e2a0], 8
je 0x100618f
and dword [0x105e2a0], 0xfffffff7
inc dword [0x105e2dc]
push dword [ebp + 8]
call dword [fcn.01001350]
test eax, eax
je 0x1006297
push dword [0x101d080]
call dword [0x1001374]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1006291
push ebx
push eax
call dword [fcn.0100119c]
mov ebx, eax
test ebx, ebx
je 0x1006287
mov ecx, dword [ebx]
mov eax, dword [0x105e2a8]
push esi
push edi
xor edi, edi
inc edi
lea edx, [ecx + eax]
cmp edx, dword [0x105e2ac]
mov dword [ebp - 4], edi
jle 0x1006227
and dword [ebp - 4], 0
lea edx, [ebp - 8]
push edx
push ecx
push eax
call fcn.0100e39f
test eax, eax
jl 0x100629e
mov esi, dword [ebp - 8]
push 2
push esi
push dword [0x105e2a4]
call dword [0x1001194]
test eax, eax
je 0x100629e
mov dword [0x105e2a4], eax
mov eax, dword [0x105e2a8]
mov dword [0x105e2ac], esi
mov dword [ebp - 4], edi
mov ecx, dword [0x105e2e0]
cmp ecx, dword [0x105e2e4]
je 0x1006244
push 8
push dword [ebp + 8]
call fcn.01005fef
mov eax, dword [0x105e2a8]
mov ecx, dword [0x105e2dc]
mov edx, dword [0x105e2a4]
mov esi, dword [ebx]
sub eax, ecx
push eax
lea edi, [edx + ecx]
lea eax, [esi + edi]
push edi
push eax
call dword [0x1001454]
push esi
add ebx, 4
push ebx
push edi
call fcn.01019f83
add dword [0x105e2a8], esi
add dword [0x105e2dc], esi
add esp, 0x18
push dword [ebp + 8]
call fcn.01005d53
pop edi
pop esi
push dword [ebp - 0xc]
call dword [fcn.010011a0]
pop ebx
call dword [fcn.01001344]
mov eax, dword [ebp - 4]
leave
ret 4
push 0
push 0x10
push 0x70
push 0x76
push dword [ebp + 8]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
jmp 0x1006285
Function at 0x1006dc6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [0x1001224]
push edi
push 0x11
call esi
xor ebx, ebx
test ax, ax
push 0x10
setl bl
call esi
mov edi, dword [ebp + 0xc]
mov esi, dword [0x105e2dc]
xor ecx, ecx
test ax, ax
setl cl
mov dword [ebp - 4], ecx
cmp edi, 0x26
ja 0x1006edb
je 0x1006ec3
cmp edi, 0x21
jb 0x1006f7d
cmp edi, 0x22
jbe 0x1006e8f
cmp edi, 0x23
je 0x1006e5b
cmp edi, 0x24
je 0x1006e36
cmp edi, 0x25
jne 0x1006f7d
and dword [0x105e2a0], 0xffffffef
dec esi
jmp 0x1006ece
test ebx, ebx
je 0x1006e3e
xor esi, esi
jmp 0x1006e4f
test byte [0x105e2a0], 0x10
je 0x1006e4c
sub esi, 8
jmp 0x1006e4f
and esi, 0xfffffff8
and dword [0x105e2a0], 0xffffffef
jmp 0x1006f71
test ebx, ebx
jne 0x1006f4f
test byte [0x105e2a0], 0x10
jne 0x1006f7d
mov eax, dword [0x105e2a8]
and esi, 0xfffffff8
add esi, 8
cmp esi, eax
jg 0x1006f6f
or dword [0x105e2a0], 0x10
jmp 0x1006f71
mov eax, dword [0x105e2cc]
imul eax, eax, 0xfffffff8
add esi, eax
xor eax, eax
cmp edi, 0x21
setne al
push 0
inc eax
inc eax
push eax
push 0
push dword [ebp + 8]
call fcn.010063bd
mov eax, dword [0x105e2cc]
lea esi, [esi + eax*8]
cmp edi, 0x21
jne 0x1006f66
jmp 0x1006ece
test ebx, ebx
jne 0x1006f7d
sub esi, 8
test esi, esi
jge 0x1006f71
jmp 0x1006f7d
sub edi, 0x27
je 0x1006f5e
dec edi
je 0x1006f2c
sub edi, 5
je 0x1006f0c
dec edi
jne 0x1006f7d
test ebx, ebx
jne 0x1006f7d
test ecx, ecx
je 0x1006f00
push ebx
push 0x18
jmp 0x1006f22
push 0x2e
push dword [ebp + 8]
call fcn.01005fef
jmp 0x1006f7d
xor eax, eax
cmp ecx, eax
je 0x1006f1b
cmp ebx, eax
jne 0x1006f7d
push eax
push 0x16
jmp 0x1006f22
cmp ebx, eax
je 0x1006f7d
push eax
push 3
push dword [ebp + 8]
call fcn.010067d8
jmp 0x1006f7d
test ebx, ebx
jne 0x1006f7d
add esi, 8
mov eax, esi
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, dword [0x105e2c8]
jle 0x1006f66
test byte [0x105e2a0], 0x10
je 0x1006f7d
and dword [0x105e2a0], 0xffffffef
mov esi, dword [0x105e2a8]
jmp 0x1006f71
and dword [0x105e2a0], 0xffffffef
inc esi
mov eax, dword [0x105e2a8]
cmp esi, eax
jle 0x1006f71
mov esi, eax
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call fcn.010069e2
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x100724f
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x500
push edi
call dword [0x100136c]
mov dword [0x105e038], eax
test eax, eax
jne 0x100732e
push 0x128
mov esi, 0x105e040
push esi
push 0x502
push edi
call dword [0x1001370]
cmp word [0x105e040], 0
jne 0x10072af
mov dword [0x105e038], 1
jmp 0x100732e
push 0
push 9
push 0x110a
push dword [0x101d090]
call dword [fcn.01001388]
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.010086ed
push eax
call fcn.01002732
test eax, eax
je 0x1007322
cmp dword [ebp + 0xc], 0
je 0x10072ed
push edi
call dword [0x1001380]
mov edi, eax
push 0x100
lea eax, [ebp - 0x204]
push eax
push edi
call dword [0x1001384]
push 0x10
lea eax, [ebp - 0x204]
push eax
push 0x94
push edi
push dword [0x101d054]
call fcn.0100ca02
xor eax, eax
add esp, 0x14
inc eax
jmp 0x1007330
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100160d
leave
ret 8