joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006dd60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], edi
je 0x1006deb9
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1006deb9
push dword [esi + 0x1c]
call fcn.10091350
add esp, 4
mov dword [esi + 0x1c], edi
call fcn.100637f0
mov eax, dword [esi + 0x38]
mov dword [ebp - 8], eax
cmp dword [esi + 0x20], edi
jne 0x1006de13
push dword [esi + 0x10]
mov dword [esi + 0x20], 1
push edi
push dword [esi + 0x24]
call fcn.100f8590
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0x28]
push eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x10]
push dword [esi + 0x24]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006de47
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1006de13
lea eax, [esi + 0x1c]
push 0x1013226c
push eax
call fcn.10073260
add esp, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [esi + 0x20], edi
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
test eax, eax
cmovns ecx, eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1006de35
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 4]
push eax
lea eax, [esi + 0x28]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [esi + 0x20], edi
test eax, eax
je 0x1006de9e
mov eax, dword [ebp - 4]
test eax, eax
je 0x1006de95
mov ecx, dword [esi + 0x24]
mov edi, ebx
cmp byte [ecx], 0
jne 0x1006de82
dec eax
cmp ebx, eax
mov dword [ebp - 4], eax
cmova edi, eax
lea eax, [ecx + 1]
push edi
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.100f86f0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, eax
cmova edi, eax
mov eax, dword [ebp + 0xc]
push edi
push ecx
push eax
call fcn.100f86f0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x1c]
push str.hid_read_timeout_GetOverlappedResult
push eax
call fcn.10073260
add esp, 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x1c]
call fcn.10091350
push str.Zero_buffer_length
mov dword [esi + 0x1c], edi
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push str.Zero_buffer_length
push str.WCHAR_T
push str.UTF_8
call fcn.10089410
mov esi, eax
add esp, 0x18
test esi, esi
je 0x1006df11
push esi
push 0x1011b494
call fcn.100638c0
push esi
call fcn.10091350
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100637f0
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100873e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x78], 0
jle 0x100873f9
mov eax, 0x101639f0
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x20]
sub esp, 0x10
mov ecx, esp
push dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x28]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [ecx + 0xc], eax
call fcn.1008f0a0
add esp, 0x14
test eax, eax
jne 0x100874a2
mov eax, 0x28de
cmp word [esi + 0x14], ax
je 0x10087455
movzx eax, word [esi + 0x40]
test ax, ax
je 0x1008743d
cmp eax, 1
jne 0x100874a2
movzx eax, word [esi + 0x42]
test ax, ax
je 0x10087455
cmp eax, 4
je 0x10087455
cmp eax, 5
je 0x10087455
cmp eax, 8
jne 0x100874a2
xor edi, edi
jmp 0x10087460
mov ebx, dword [edi + 0x10164048]
cmp dword [ebx + 4], 0
je 0x1008749a
push dword [esi + 0x3c]
movzx eax, word [esi + 0x18]
push dword [esi + 0x38]
push dword [esi + 0x34]
push dword [esi + 0x30]
push eax
movzx eax, word [esi + 0x16]
push eax
movzx eax, word [esi + 0x14]
push eax
push dword [esi + 0x4c]
mov eax, dword [ebx + 0x14]
push dword [esi + 4]
push esi
call eax
add esp, 0x28
test eax, eax
jne 0x100874a9
add edi, 4
cmp edi, 0x44
jb 0x10087460
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x10098d30
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1016ca48], 0
je 0x10098d76
mov eax, dword [ebp + 8]
push 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push 1
push eax
mov dword [ebp - 0xc], 0x50001
mov dword [ebp - 8], 0x2100
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10098d76
push str.Couldnt_register_for_raw_input_events
call fcn.100638c0
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10098e70
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1016ca48], 0
je 0x10098eb7
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x50001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x10098eb7
push str.Couldnt_unregister_for_raw_input_events
call fcn.100638c0
add esp, 4
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100bedd0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 0x20]
push edi
push 0x10
push eax
push 0x59
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x10
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push 0x5a
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test edi, edi
mov ecx, eax
pop edi
jne 0x100bee17
push str.Couldnt_obtain_language_info
call fcn.100638c0
add esp, 4
mov esp, ebp
pop ebp
ret
test ecx, ecx
lea eax, [ebp - 0x10]
mov edx, 0x101149ab
cmove eax, edx
push eax
mov eax, 0x10142974
cmove eax, edx
push eax
lea eax, [ebp - 0x20]
push eax
push str._s_s_s
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100ba560
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100bfd20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 0
mov edx, dword [esi + 0x2c]
mov ecx, edx
neg ecx
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
and ecx, 0x10000
test eax, eax
je 0x100bfd61
push edi
lea edi, [ebp + 8]
push edi
push ecx
push esi
push 0x100bfce0
push edx
push 0
call eax
add esp, 0x18
pop edi
jmp 0x100bfd75
lea eax, [ebp + 8]
push eax
push ecx
push esi
push 0x100bfce0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
pop esi
test eax, eax
jne 0x100bfd8c
push str.Not_enough_resources_to_create_thread
call fcn.100638c0
add esp, 4
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100c00a0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
cmp dword [0x10165844], 0xffffffff
jne 0x100c00fb
cmp dword [0x1016cc04], 0
jne 0x100c0104
push 0x1016cc08
call fcn.100b87c0
add esp, 4
cmp dword [0x10165844], 0xffffffff
jne 0x100c00ee
cmp dword [0x1016cc04], 0
jne 0x100c00ee
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x100c00e4
nop
mov dword [0x10165844], eax
jmp 0x100c00ee
mov dword [0x1016cc04], 1
push 0x1016cc08
call fcn.100b8820
add esp, 4
cmp dword [0x1016cc04], 0
je 0x100c0109
jmp 0x100c0420
nop
push dword [0x10165844]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
ret
push ebx
push esi
push edi
call fcn.100bfd10
xor ebx, ebx
mov esi, eax
mov edi, edx
cmp dword [0x1016cc14], ebx
jne 0x100c047a
push 0x1016cc1c
call fcn.100b87c0
add esp, 4
cmp dword [0x1016cc14], ebx
jne 0x100c046d
call fcn.100bf100
nop
mov dword [0x1016cc14], eax
test eax, eax
jne 0x100c046d
push 0x1016cc1c
call fcn.100b8820
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x1016cc1c
call fcn.100b8820
add esp, 4
nop
push dword [0x1016cc14]
call fcn.100bf200
mov eax, dword [0x1016cc18]
add esp, 4
test eax, eax
je 0x100c04b9
cmp dword [eax], esi
jne 0x100c049b
cmp dword [eax + 4], edi
je 0x100c04b6
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x100c0492
push dword [0x1016cc14]
call fcn.100bf240
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
mov ebx, dword [eax + 8]
push dword [0x1016cc14]
call fcn.100bf240
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x100c0120
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1016cc04], 0
je 0x100c0132
pop ebp
jmp fcn.100c04d0
push dword [ebp + 8]
push dword [0x10165844]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100c0152
mov dword [ebp + 8], str.TlsSetValue___failed
pop ebp
jmp fcn.100638c0
xor eax, eax
pop ebp
ret
Function at 0x100d0730
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x7fff
mov word [ebp - 0x14], ax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0x8060402
mov al, byte [esi]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0x8060402
mov dword [ebp - 0xc4], 0x80007
mov dword [ebp - 0xc0], 0xa0009
mov dword [ebp - 0xbc], 0xc000b
mov dword [ebp - 0xb8], 0xe000d
mov dword [ebp - 0xb4], 0x110010
mov dword [ebp - 0xb0], 0x150013
mov dword [ebp - 0xac], 0x190017
mov dword [ebp - 0xa8], 0x1f001c
mov dword [ebp - 0xa4], 0x250022
mov dword [ebp - 0xa0], 0x2d0029
mov dword [ebp - 0x9c], 0x370032
mov dword [ebp - 0x98], 0x42003c
mov dword [ebp - 0x94], 0x500049
mov dword [ebp - 0x90], 0x610058
mov dword [ebp - 0x8c], 0x76006b
mov dword [ebp - 0x88], 0x8f0082
mov dword [ebp - 0x84], 0xad009d
mov dword [ebp - 0x80], 0xd100be
mov dword [ebp - 0x7c], 0xfd00e6
mov dword [ebp - 0x78], 0x1330117
mov dword [ebp - 0x74], 0x1730151
mov dword [ebp - 0x70], 0x1c10198
mov dword [ebp - 0x6c], 0x22001ee
mov dword [ebp - 0x68], 0x2920256
mov dword [ebp - 0x64], 0x31c02d4
mov dword [ebp - 0x60], 0x3c3036c
mov dword [ebp - 0x5c], 0x48e0424
mov dword [ebp - 0x58], 0x5830502
mov dword [ebp - 0x54], 0x6ab0610
mov dword [ebp - 0x50], 0x8120756
mov dword [ebp - 0x4c], 0x9c308e0
mov dword [ebp - 0x48], 0xbd00abd
mov dword [ebp - 0x44], 0xe4c0cff
mov dword [ebp - 0x40], 0x114c0fba
mov dword [ebp - 0x3c], 0x14ee1307
mov dword [ebp - 0x38], 0x19541706
mov dword [ebp - 0x34], 0x1ea51bdc
mov dword [ebp - 0x30], 0x251521b6
mov dword [ebp - 0x2c], 0x2cdf28ca
mov dword [ebp - 0x28], 0x364b315b
mov dword [ebp - 0x24], 0x41b23bb9
mov dword [ebp - 0x20], 0x4f7e4844
mov dword [ebp - 0x1c], 0x602f5771
mov dword [ebp - 0x18], 0x746269ce
cmp al, 0x58
jle 0x100d08d4
mov dl, 0x58
jmp 0x100d08de
xor ecx, ecx
movzx edx, al
test al, al
cmovs edx, ecx
mov bl, byte [ebp + 0x10]
movsx eax, dl
movzx ecx, word [ebp + eax*2 - 0xc4]
movzx eax, bl
mov al, byte [ebp + eax - 0x10]
add al, dl
mov edx, ecx
shr edx, 3
mov byte [esi], al
test bl, 4
je 0x100d0903
add edx, ecx
test bl, 2
je 0x100d090e
mov eax, ecx
shr eax, 1
add edx, eax
test bl, 1
je 0x100d0918
shr ecx, 2
add edx, ecx
movsx eax, word [ebp + 0xc]
mov ecx, edx
neg ecx
and bl, 8
pop esi
cmove ecx, edx
add ecx, eax
pop ebx
cmp ecx, 0x7fff
jle 0x100d093b
mov eax, 0x7fff
mov esp, ebp
pop ebp
ret
mov eax, 0xffff8000
cmp ecx, eax
cmovl ecx, eax
mov ax, cx
mov esp, ebp
pop ebp
ret
Function at 0x100d31d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push esi
mov esi, dword [ebp + 0xc]
push 0x10
push 0x10144c34
push esi
mov dword [ebp - 8], 0
call fcn.100ba4f0
add esp, 0xc
test eax, eax
jne 0x100d3221
mov esi, dword [ebp + 8]
push esi
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.10089410
add esp, 0x14
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 0xf]
push edi
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 6]
push eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 4]
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi]
push eax
movzx eax, byte [esi + 1]
push eax
movzx eax, byte [esi + 2]
push eax
movzx eax, byte [esi + 3]
push eax
push str.SystemCurrentControlSetControlMediaCategories_02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0x88]
push 0x80
push eax
call fcn.100ba560
lea eax, [ebp - 0x88]
push eax
call fcn.100ba780
add esp, 0x50
inc eax
push eax
lea eax, [ebp - 0x88]
push eax
push str.UTF_8
push str.UTF_16LE
call fcn.10089410
add esp, 0x10
mov edi, eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push edi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
mov esi, eax
call fcn.10091350
add esp, 4
test esi, esi
jne 0x100d330f
lea eax, [ebp - 8]
push eax
push esi
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.Name
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100d3306
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.10091380
mov edi, eax
add esp, 4
test edi, edi
jne 0x100d3339
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
push esi
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.10089410
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0
push str.Name
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
test esi, esi
je 0x100d338b
call fcn.10091350
mov esi, dword [ebp + 8]
push esi
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.10089410
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
xor ecx, ecx
shr eax, 1
mov word [edi + eax*2], cx
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push edi
push str.UTF_16LE
push str.UTF_8
call fcn.10089410
push edi
mov esi, eax
call fcn.10091350
add esp, 0x18
test esi, esi
jne 0x100d33e8
mov esi, dword [ebp + 8]
push esi
call fcn.100bb0d0
lea eax, [eax*2 + 2]
push eax
push esi
push str.UTF_16LE
push str.UTF_8
call fcn.10089410
add esp, 0x14
mov esi, eax
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100d4e10
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x18c]
xor edi, edi
test eax, eax
je 0x100d4e2e
mov eax, dword [eax + 0xf0]
mov edi, dword [eax + 4]
mov ebx, dword [sym.imp.USER32.dll_OpenClipboard]
xor esi, esi
push edi
call ebx
test eax, eax
jne 0x100d4e54
push 0xa
call fcn.100c0d40
inc esi
add esp, 4
cmp esi, 3
jl 0x100d4e36
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x100d5050
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push ebx
push edi
push eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push dword [ebp + 0xc]
push dword [eax + 0x1a4]
mov eax, dword [eax + 0x19c]
call eax
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100d51ce
mov eax, dword [ebp - 4]
test eax, eax
je 0x100d51ce
push eax
push ecx
push str.UTF_8
push str.UTF_16LE
call fcn.10089410
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x100d50b7
push str.Couldnt_convert_text_from_UTF_8
call fcn.100638c0
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
movzx edx, word [edi]
xor eax, eax
xor ecx, ecx
push esi
test dx, dx
je 0x100d50e6
mov esi, edi
cmp dx, 0xa
jne 0x100d50d8
test ecx, ecx
je 0x100d50d7
cmp word [esi - 2], 0xd
je 0x100d50d8
inc eax
inc ecx
inc eax
movzx edx, word [edi + ecx*2]
lea esi, [edi + ecx*2]
test dx, dx
jne 0x100d50c6
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x100d51a4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
je 0x100d5176
movzx eax, word [edi]
xor esi, esi
mov edx, eax
mov dword [ebp + 8], edx
test ax, ax
je 0x100d516a
mov edx, edi
movzx ebx, ax
movzx eax, bx
mov dword [ebp + 8], eax
movzx eax, ax
cmp bx, 0xa
jne 0x100d5152
test esi, esi
je 0x100d5144
cmp word [edx - 2], 0xd
mov eax, dword [ebp + 8]
movzx eax, ax
je 0x100d5152
mov eax, 0xd
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
inc esi
mov word [ecx], ax
movzx eax, word [edi + esi*2]
lea edx, [edi + esi*2]
add ecx, 2
mov ebx, eax
test ax, ax
jne 0x100d5124
mov ebx, dword [ebp - 8]
xor eax, eax
push ebx
mov word [ecx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x100d51c2
push str.Couldnt_set_clipboard_data
call fcn.100d34b0
add esp, 4
mov ebx, eax
push edi
call fcn.10091350
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
call fcn.10063810
add esp, 4
mov ebx, eax
push edi
call fcn.10091350
add esp, 4
mov eax, ebx
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
xor ebx, ebx
call fcn.10091350
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d64a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0xf0]
mov eax, dword [edi + 4]
mov dword [ebp - 4], eax
call fcn.1008fd40
xor ebx, ebx
cmp eax, esi
sete bl
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
cmp eax, dword [ebp - 4]
sete cl
cmp ebx, ecx
je 0x100d66a9
cmp ecx, dword [ebp + 0xc]
jne 0x100d66a9
test ecx, ecx
je 0x100d663f
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
neg eax
push 1
sbb esi, esi
neg esi
call ebx
mov edx, 4
lea ecx, [edx - 3]
test ax, ax
je 0x100d651a
test esi, esi
mov eax, edx
cmove eax, ecx
or byte [edi + 0x44], al
push 2
call ebx
test ax, ax
je 0x100d6535
test esi, esi
mov eax, 1
mov ecx, 4
cmove eax, ecx
or byte [edi + 0x44], al
push 4
call ebx
test ax, ax
je 0x100d6542
or byte [edi + 0x44], 2
push 5
call ebx
test ax, ax
je 0x100d654f
or byte [edi + 0x44], 8
push 6
call ebx
test ax, ax
je 0x100d655c
or byte [edi + 0x44], 0x10
mov eax, dword [edi + 0xb0]
test eax, eax
mov ebx, dword [ebp + 8]
mov ecx, ebx
cmovne ecx, eax
push ecx
call fcn.100904f0
add esp, 4
call fcn.10092010
cmp dword [eax + 0x4c], 0
jne 0x100d65c3
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
cvtsi2ss xmm0, dword [ebp - 8]
sub esp, 8
movss dword [esp + 4], xmm0
cvtsi2ss xmm0, dword [ebp - 0xc]
movss dword [esp], xmm0
push 0
push 0
push ebx
call fcn.100d5980
push edx
push eax
call fcn.100931a0
add esp, 0x1c
push edi
call fcn.100d5980
push edx
push eax
call fcn.100d54b0
push ebx
call fcn.100e2d30
push dword [edi + 0xb4]
call fcn.100d4b40
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x14
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.100907b0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.100907b0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.100907b0
push 1
push dword [edi]
call fcn.100e30c0
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
mov dword [edi + 0x60], 1
call fcn.100904f0
add esp, 4
call fcn.10092010
cmp dword [eax + 0x4c], 0
je 0x100d6665
push 0
call fcn.10093460
add esp, 4
call fcn.100daf90
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x100d66a2
push 0x10
lea esi, [edi + 0x64]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.100ba4f0
add esp, 0xc
test eax, eax
jne 0x100d66a2
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [edi + 0x60], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d7e00
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov ecx, 0xff7f
shr edx, 0x10
movzx eax, dl
and ax, cx
movzx ecx, ax
test cx, cx
je 0x100d7e3a
test edx, 0x100
je 0x100d7e2e
or eax, 0xe000
movzx ecx, ax
jmp 0x100d7e5a
cmp ecx, 0x45
jne 0x100d7e5a
mov ecx, 0xe046
jmp 0x100d7e5a
movzx eax, word [ebp + 0xc]
push 4
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx ecx, ax
mov edx, 0xe11d
cmp cx, dx
mov eax, 0xe046
cmove ecx, eax
mov eax, ecx
movzx ecx, cl
shr eax, 8
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x80
or eax, ecx
mov eax, dword [eax*4 + 0x101452a8]
pop ebp
ret

Function at 0x100d99b0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, word [ebx + 0xec]
push 0
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
test esi, esi
jle 0x100d9a00
cmp dword [ebx + 0x78], esi
jge 0x100d9a00
mov eax, dword [ebx + 0x74]
test eax, eax
je 0x100d99ee
push eax
call fcn.10091350
add esp, 4
lea eax, [esi + 2]
push eax
call fcn.10091380
add esp, 4
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], esi
push dword [ebx + 0x78]
push dword [ebx + 0x74]
push dword [ebp + 0x10]
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov esi, eax
xor eax, eax
push eax
push eax
test esi, esi
push 0x80
cmovs esi, eax
push edi
shr esi, 1
call sub.IMM32.dll_ImmGetCompositionStringW
movzx edx, ax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x9c], edx
cmp eax, 0x404
je 0x100d9a41
cmp eax, 0x804
jne 0x100d9a7b
test edx, edx
je 0x100d9a7b
mov eax, dword [ebx + 0x78]
shr eax, 1
cmp edx, eax
jae 0x100d9a7b
mov eax, dword [ebx + 0x74]
mov ecx, 0x3000
movzx eax, word [eax]
cmp ax, cx
je 0x100d9a63
cmp eax, 0x20
jne 0x100d9a7b
inc edx
cmp edx, esi
jae 0x100d9a7a
mov eax, dword [ebx + 0x74]
lea ecx, [eax + edx*2]
inc edx
mov ax, word [ecx]
mov word [ecx - 2], ax
cmp edx, esi
jl 0x100d9a68
dec esi
mov eax, dword [ebx + 0x74]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [ebx + 0x9c], ecx
jne 0x100d9b04
test esi, esi
jle 0x100d9b04
xor esi, esi
push esi
push esi
push 0x10
push edi
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
test edi, edi
jle 0x100d9afe
lea ecx, [edi + 2]
push ecx
call fcn.10091380
add esp, 4
mov esi, eax
mov dword [ebp + 8], esi
push edi
push esi
push 0x10
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
xor ecx, ecx
mov al, byte [esi + ecx]
cmp al, 1
je 0x100d9ad1
cmp al, 3
je 0x100d9ad1
inc ecx
cmp ecx, edi
jl 0x100d9ac1
mov edx, dword [ebp + 8]
mov esi, ecx
cmp ecx, edi
jge 0x100d9af2
lea ebx, [ebx]
mov al, byte [edx + esi]
cmp al, 1
je 0x100d9aeb
cmp al, 3
jne 0x100d9af5
inc esi
cmp esi, edi
jl 0x100d9ae0
cmp ecx, edi
cmove esi, edi
push edx
call fcn.10091350
add esp, 4
mov dword [ebx + 0x9c], esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100da660
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0
movzx edi, word [esi + 0xec]
and edi, 0x3ff
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [esi + 0xec]
cmp eax, ecx
je 0x100da6b8
movzx edx, ax
mov ecx, edx
mov dword [esi + 0xec], eax
and ecx, 0x3ff
cmp ecx, 0x12
je 0x100da6ae
mov ecx, 0x804
cmp dx, cx
je 0x100da6ae
mov ecx, 1
jmp 0x100da6b0
xor ecx, ecx
mov dword [esi + 0xbc], ecx
mov ecx, eax
cmp dword [esi + 0x10c], 0
jne 0x100da6d2
xor eax, eax
cmp ecx, 0xe0060404
setne al
mov dword [esi + 0xb8], eax
push esi
call fcn.100da7f0
movzx eax, word [esi + 0xec]
add esp, 4
and eax, 0x3ff
cmp edi, eax
je 0x100da6f4
push esi
call fcn.100d9720
add esp, 4
pop edi
pop esi
pop ebp
ret