joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000be80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x1000bea0
jl 0x1000be97
cmp dword [ebp + 0xc], 0
ja 0x1000bea0
xor eax, eax
xor edx, edx
jmp 0x1000bfd8
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x1000bec2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.1000c810
jmp 0x1000bfd8
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.1000e3a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x1000bf32
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.10008620
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.1000e500
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.10007c20
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.1000e480
nop
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x1000bfc9
mov ecx, dword [ebp - 8]
call fcn.1000dfe0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x1000bfa2
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.101a3da2
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x1000bfa0
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x1000bfd8
jmp 0x1000bf4e
cmp dword [ebp - 4], 0
jbe 0x1000bfc9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.101a3da2
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10015a00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 4], 0
lea eax, [ebp - 0x108]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x10015a4a
lea edx, [ebp - 0x108]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000ced0
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
jmp 0x10015a81
push 0x100106c0
push 0x102103fc
push 0x10245a60
call fcn.100103c0
add esp, 8
mov ecx, eax
call fcn.1000ccb0
push 0x1020ef76
mov ecx, dword [ebp + 8]
call fcn.1000ced0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x100219a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c0df3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x36
mov byte [ebp - 0x19], 0x35
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x34
mov byte [ebp - 0x15], 0x31
mov byte [ebp - 0x14], 0x76
mov byte [ebp - 0x13], 0x77
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x72
mov byte [ebp - 0x10], 0x35
mov byte [ebp - 0xf], 0x36
mov byte [ebp - 0xe], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x70]
call fcn.1000ced0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x58]
call fcn.1000ced0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x88]
push ecx
call fcn.10006cd0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
call fcn.10007640
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x70]
call fcn.10007640
nop
push 1
push 1
lea edx, [ebp - 0x88]
push edx
lea ecx, [ebp - 0x160]
call fcn.100231c0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.1000cfc0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.10023d00
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 4]
call fcn.10015330
movzx ecx, al
test ecx, ecx
je 0x10021b31
push 0
push 0x1021147c
lea ecx, [ebp - 0x40]
call fcn.10023820
test eax, eax
jne 0x10021ae9
push 0xffffffffffffffff
push 3
lea edx, [ebp - 0xa0]
push edx
lea ecx, [ebp - 0x40]
call fcn.100236f0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
mov ecx, 0x10246510
call fcn.10010060
lea ecx, [ebp - 0xa0]
call fcn.10007640
nop
jmp 0x10021b2c
push 0
push str.Port
lea ecx, [ebp - 0x40]
call fcn.10023820
test eax, eax
jne 0x10021b2c
push 0xffffffffffffffff
push 5
lea ecx, [ebp - 0xb8]
push ecx
lea ecx, [ebp - 0x40]
call fcn.100236f0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
mov ecx, 0x102464f8
call fcn.10010060
lea ecx, [ebp - 0xb8]
call fcn.10007640
nop
jmp 0x10021a73
push 0x100106c0
push 0x10246510
push str.IP:
push 0x10245b48
call fcn.100103c0
add esp, 8
push eax
call fcn.10010690
add esp, 8
mov ecx, eax
call fcn.1000ccb0
push 0x100106c0
push 0x102464f8
push str.Port:
push 0x10245b48
call fcn.100103c0
add esp, 8
push eax
call fcn.10010690
add esp, 8
mov ecx, eax
call fcn.1000ccb0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.10007640
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x160]
call fcn.10021bd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.10007640
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10021d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c098d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov byte [ebp - 0x20], 0x76
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x36
mov byte [ebp - 0x1d], 0x35
mov byte [ebp - 0x1c], 0x72
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x31
mov byte [ebp - 0x18], 0x76
mov byte [ebp - 0x17], 0x77
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x72
mov byte [ebp - 0x14], 0x35
mov byte [ebp - 0x13], 0x36
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x38]
call fcn.1000ced0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x50]
push eax
call fcn.10006cd0
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, 0x10246528
call fcn.10010060
lea ecx, [ebp - 0x50]
call fcn.10007640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10007640
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10021e50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x10211498
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0xc], eax
push 0x102114a8
push 0x102114cc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10021f0d
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10021f0d
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
call fcn.100765db
add esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.101973c0
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
mov byte [edx], 0
mov eax, dword [ebp - 4]
push eax
call fcn.100219a0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.100765d6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10021f90
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10021fb3
xor al, al
jmp 0x10022070
mov dword [ebp - 0x250], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.10197940
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x10022064
push 0
push 0
push 0x104
lea eax, [ebp - 0x354]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x22c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x24]
call fcn.1000ced0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10023d40
add esp, 8
mov byte [ebp - 1], al
lea ecx, [ebp - 0x24]
call fcn.10007640
movzx edx, byte [ebp - 1]
test edx, edx
je 0x1002204f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x10022070
lea ecx, [ebp - 0x250]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10021fe8
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x10022080
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c0e50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x17c
lea eax, [ebp - 0x188]
push eax
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x10022178
lea ecx, [ebp - 0x188]
push ecx
lea ecx, [ebp - 0x84]
call fcn.1000ced0
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
push 0x102114e4
mov eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0x6c]
push ecx
call fcn.10010380
add esp, 0xc
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x54]
push edx
call fcn.1001ce20
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
push 0x102114dc
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.10010380
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.10007640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.10007640
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.10007640
nop
lea ecx, [ebp - 0x3c]
call fcn.100075a0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
call fcn.10007640
nop
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003369b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x100336da
call fcn.1003f6c4
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x100336da
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100336e2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.101104d1
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x100340ec
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10034178
cmp dword [esi + 0x20], 0
je 0x10034178
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10034178
cmp dword [ebp + 8], 0
je 0x10034178
xor edi, edi
mov ebx, edi
call fcn.1003f6c4
push 0x101d62b8
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003415c
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10034178
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.10110f55
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10034174
mov ecx, esi
call fcn.10033e95
mov eax, edi
jmp 0x1003417a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10038bdc
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x101c228d
call fcn.101947a2
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x10038c02
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10038c5c
lea ecx, [ebp - 0x10]
call fcn.100035d0
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.101a633a
push eax
call fcn.10002070
add esp, 0x14
test esi, esi
je 0x10038c4f
push esi
call fcn.101a4e8f
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.100023f0
mov eax, ebx
call fcn.10194770
ret 8
Function at 0x1004c59a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x1004c5b3
call fcn.1003f6c4
mov esi, dword [eax + 0xc]
push 0x101d8eec
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x1004c5f5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1004c5f5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x1004c5f5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.1004c5fe
jmp 0x1004c5f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10050219
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0x1b8]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov ecx, dword [0x1023b5e0]
test al, 0x80
push 0xffffffffffffffff
pop eax
cmovne ecx, eax
mov eax, dword [edi]
mov esi, dword [eax + 0x2b4]
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
push dword [ebp - 4]
mov esi, eax
push 0x1023b458
mov dword [ebp - 0xc], esi
call fcn.1003f243
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
je 0x1005032e
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1005032e
test ebx, ebx
je 0x100502be
mov eax, dword [ebx]
push 0
mov esi, dword [eax + 0x228]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, ebx
call esi
push eax
push 0x1023b914
call fcn.1003f243
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x100502c0
xor eax, eax
mov dword [ebp - 8], eax
cmp esi, 2
jne 0x10050337
test eax, eax
je 0x10050310
mov eax, dword [edi]
mov esi, dword [eax + 0x1c0]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
test al, 0x40
je 0x1005032e
cmp dword [ebp - 4], 0
je 0x10050310
mov ebx, dword [ebp - 8]
push edi
mov eax, dword [ebx]
mov esi, dword [eax + 0x24c]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, ebx
call esi
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, edi
jmp 0x10050330
mov eax, dword [edi]
push 5
push 0
push ebx
mov esi, dword [eax + 0x1f8]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp esi, 3
jne 0x1005032e
test ebx, ebx
je 0x1005032e
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 0x184]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, ebx
call esi
test eax, eax
je 0x1005032e
mov eax, dword [edi]
mov esi, dword [eax + 0x18c]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
test eax, eax
je 0x1005032e
mov eax, dword [edi]
push 0
mov esi, dword [eax + 0x240]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov eax, dword [edi]
push 0
push 1
push 5
mov esi, dword [eax + 0x34c]
mov ecx, esi
push ebx
call dword [0x101d4b00]
mov ecx, edi
call esi
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x10050330
Function at 0x100527c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x1005285f
mov eax, dword [esi + 0x34c]
test eax, eax
je 0x1005285b
mov eax, dword [eax + 0x20]
test eax, eax
je 0x1005285b
cmp dword [ebx], eax
jne 0x1005285b
mov eax, dword [ebx + 4]
sub eax, 1
je 0x10052835
sub eax, 1
je 0x10052805
sub eax, 1
jne 0x1005285b
mov edi, 0x428e
jmp 0x1005283a
push 0x11
mov edi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1005283a
mov eax, dword [esi]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, dword [ebp - 4]
call esi
test eax, eax
je 0x1005283a
add edi, 3
jmp 0x1005283a
mov edi, 0x3ea0
push edi
mov ecx, 0x10243bd4
call fcn.10003550
test eax, eax
je 0x1005285f
mov eax, dword [0x10243bd4]
mov dword [ebx + 0xc], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
xor eax, eax
jmp 0x10052854
call fcn.1003decd
int3
Function at 0x1009e275
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
test ecx, ecx
je 0x1009e3d3
push esi
push edi
push 0x101d77b8
call fcn.1003f2e2
cmp dword [ebp + 8], 0
mov dword [ebp - 0x10], eax
je 0x1009e30e
mov edi, dword [ebx + 0x168]
jmp 0x1009e2fa
mov esi, dword [edi + 8]
mov edi, dword [edi]
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009e2fa
push esi
call fcn.10033708
push eax
push 0x1023b74c
call fcn.1003f243
mov dword [ebp - 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x1009e2fa
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1a0]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, dword [ebp - 0xc]
call esi
test eax, eax
jle 0x1009e2fa
push 4
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ShowWindow]
test edi, edi
jne 0x1009e2a9
lea ecx, [ebx + 0x164]
call fcn.10030561
jmp 0x1009e3d1
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x1009e3d1
lea eax, [ebx + 0xc8]
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.1002915e
mov edi, dword [eax]
test edi, edi
jne 0x1009e33a
xor esi, esi
jmp 0x1009e33d
mov esi, dword [edi + 0x20]
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1009e3c1
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1009e3c1
cmp dword [ebp - 0x10], 0
jne 0x1009e396
push edi
push 0x1023b74c
call fcn.1003f243
mov edi, eax
pop ecx
pop ecx
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1a8]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
push eax
push 0x101daa50
call fcn.1003f243
pop ecx
pop ecx
test eax, eax
je 0x1009e3c1
mov esi, dword [ebp - 4]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [ebp - 8]
lea esi, [ebx + 0x164]
push eax
mov ecx, esi
call fcn.1009d40d
test eax, eax
jne 0x1009e3c1
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.1009b2d1
cmp dword [ebp - 0xc], 0
lea eax, [ebx + 0xc8]
jne 0x1009e325
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100bb280
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x1023c000]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x100bb2df
cmp dword [ebp + 0xc], 0
mov edx, 0xc009
mov eax, 0x400b
cmove eax, edx
push eax
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [ebp - 0x2b4]
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10194762
leave
ret 8
call fcn.1003decd
int3

Function at 0x100bb2e5
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x1023c000]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], esi
test eax, eax
je 0x100bb34f
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x100bb334
lea eax, [ebp - 0x2ac]
push eax
jmp 0x100bb339
push 0x101e4b10
call fcn.10027f20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10194762
leave
ret 8
call fcn.1003decd
int3

Function at 0x100bb82d
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.10030432
call fcn.1003f718
cmp dword [eax + 0x14], 0
jne 0x100bb848
mov ecx, esi
pop esi
jmp fcn.100bb090
pop esi
ret

Function at 0x100c1c9d
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x101c2e6b
call fcn.101947a2
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.10027f20
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x100c1cff
call fcn.1003f712
cmp eax, 1
jne 0x100c1cff
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.1007f92d
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.10039629
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.100023f0
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x100c1d11
call fcn.100c1ffd
jmp 0x100c1d17
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.100023f0
mov eax, esi
call fcn.10194770
ret 0xc