joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d910
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x1000d964
push 0
mov ecx, dword [ebp + 8]
call fcn.10009280
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x1000dad5
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x1000d98a
cmp dword [ebp - 0x2c], 0
ja 0x1000d98a
cmp dword [ebp - 0x30], 0x12c00000
jbe 0x1000d9a5
push 0
mov ecx, dword [ebp + 8]
call fcn.10009280
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x1000dad5
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10062e86
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000d9e3
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.1006cfe0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x1000d9ea
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.10006790
lea ecx, [ebp - 0x28]
call fcn.1000ade0
movzx eax, al
test eax, eax
jne 0x1000da28
push 0
mov ecx, dword [ebp + 8]
call fcn.10009280
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
call fcn.1000a260
mov eax, dword [ebp + 8]
jmp 0x1000dad5
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1000da6b
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000ad70
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x1000daad
cmp dword [ebp + 0x10], 0
je 0x1000da89
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.10009220
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
call fcn.1000a260
mov eax, dword [ebp + 8]
jmp 0x1000dad5
push 0
mov ecx, dword [ebp + 8]
call fcn.10009280
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x28]
call fcn.1000a260
mov eax, dword [ebp + 8]
jmp 0x1000dad5
mov esp, ebp
pop ebp
ret
Function at 0x1000f290
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000f2b4
xor eax, eax
jmp 0x1000f334
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000f2cb
xor eax, eax
jmp 0x1000f334
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x1000f317
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x1000f317
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000f2ee
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x1000f323
xor eax, eax
jmp 0x1000f334
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x1000f331
xor eax, eax
jmp 0x1000f334
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100258c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5648
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100ed294]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
call fcn.1000ad70
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10025902
xor eax, eax
jmp 0x10025a91
mov ecx, dword [ebp + 8]
call fcn.1000ad70
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x14]
call fcn.100087d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1000cb40
cmp eax, 1
jge 0x1002594c
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10009e40
mov eax, dword [ebp - 0x20]
jmp 0x10025a91
push 0
lea ecx, [ebp - 0x14]
call fcn.1001cf10
movzx eax, ax
push eax
call fcn.10073547
add esp, 4
mov word [ebp - 0x10], ax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
call fcn.10023130
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
call fcn.100228e0
push eax
lea ecx, [ebp - 0x1c]
call fcn.1001ced0
movzx ecx, al
test ecx, ecx
je 0x10025a5d
lea ecx, [ebp - 0x1c]
call fcn.1001cff0
add eax, 4
mov dword [ebp - 0x18], eax
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x58]
call fcn.10024290
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.10022950
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.100221f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.100241a0
add esp, 0x1c
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.10022950
push eax
lea ecx, [ebp - 0x28]
call fcn.1001ced0
movzx ecx, al
test ecx, ecx
je 0x10025a40
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10009e40
mov eax, dword [ebp - 0x2c]
jmp 0x10025a91
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10009e40
mov eax, dword [ebp - 0x30]
jmp 0x10025a91
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10009e40
mov eax, dword [ebp - 0x34]
jmp 0x10025a91
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10025ab0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a567b
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x454], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0xffffffff
jne 0x10025b00
xor eax, eax
jmp 0x10025bf6
mov dword [ebp - 0x44c], 0
push 0x22c
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x444], 0x22c
lea ecx, [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0x448]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10025be3
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1006cfe0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call fcn.1000d1a0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x450]
call fcn.100087d0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x450]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.100258c0
mov dword [ebp - 0x44c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.10009e40
cmp dword [ebp - 0x44c], 0
je 0x10025bc8
jmp 0x10025be3
lea eax, [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x448]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10025b45
mov edx, dword [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret 4
Function at 0x10027ee0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x654], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jne 0x10027f15
xor eax, eax
jmp 0x1002816a
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.1006cfe0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x634]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [ebp - 0x644], 0
lea eax, [ebp - 0x644]
push eax
push str.PP_dFrameClass
lea ecx, [ebp - 0x204]
push ecx
call fcn.1002b460
add esp, 0xc
cmp eax, 1
jne 0x10027f78
mov eax, 1
jmp 0x1002816a
mov dword [ebp - 0x628], 0
jmp 0x10027f93
mov edx, dword [ebp - 0x628]
add edx, 1
mov dword [ebp - 0x628], edx
cmp dword [ebp - 0x628], 3
jae 0x10028054
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax*4 + 0x100ec06c]
mov dword [ebp - 0x630], ecx
lea edx, [ebp - 0x204]
mov dword [ebp - 0x62c], edx
mov eax, dword [ebp - 0x62c]
mov cx, word [eax]
mov word [ebp - 0x636], cx
mov edx, dword [ebp - 0x630]
cmp cx, word [edx]
jne 0x10028025
cmp word [ebp - 0x636], 0
je 0x10028019
mov eax, dword [ebp - 0x62c]
mov cx, word [eax + 2]
mov word [ebp - 0x638], cx
mov edx, dword [ebp - 0x630]
cmp cx, word [edx + 2]
jne 0x10028025
add dword [ebp - 0x62c], 4
add dword [ebp - 0x630], 4
cmp word [ebp - 0x638], 0
jne 0x10027fbf
mov dword [ebp - 0x63c], 0
jmp 0x10028030
sbb eax, eax
or eax, 1
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x648], ecx
cmp dword [ebp - 0x648], 0
jne 0x1002804f
mov eax, 1
jmp 0x1002816a
jmp 0x10027f84
push 0x200
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.1006cfe0
add esp, 0xc
push 0xff
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.Microsoft_PowerPoint
lea edx, [ebp - 0x404]
push edx
call fcn.1000ec00
add esp, 8
test eax, eax
je 0x100280a5
mov eax, 1
jmp 0x1002816a
mov dword [ebp - 0x640], 0
lea eax, [ebp - 0x640]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x208
push 0
lea edx, [ebp - 0x60c]
push edx
call fcn.1006cfe0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x60c]
push eax
mov ecx, dword [ebp - 0x640]
push ecx
call fcn.1000ccf0
add esp, 0xc
lea edx, [ebp - 0x60c]
push edx
lea ecx, [ebp - 0x624]
call fcn.10008f30
lea ecx, [ebp - 0x624]
call fcn.100142a0
test eax, eax
jbe 0x1002814f
push str.wpp.exe
lea ecx, [ebp - 0x624]
call fcn.10011e80
push eax
call fcn.1006f4a7
add esp, 8
test eax, eax
jne 0x1002814f
mov dword [ebp - 0x64c], 1
lea ecx, [ebp - 0x624]
call fcn.1000a0e0
mov eax, dword [ebp - 0x64c]
jmp 0x1002816a
mov dword [ebp - 0x650], 0
lea ecx, [ebp - 0x624]
call fcn.1000a0e0
mov eax, dword [ebp - 0x650]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret
Function at 0x1002a450
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5be6
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x680], 0
push 0x208
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x688], 0
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.1006cfe0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1002a670
lea ecx, [ebp - 0x674]
call fcn.10008710
mov dword [ebp - 4], 0
push 0x100b6d04
lea eax, [ebp - 0x218]
push eax
push 0x104
lea ecx, [ebp - 0x674]
call fcn.1000c430
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
call fcn.1001ff10
lea ecx, [ebp - 0x670]
push ecx
lea ecx, [ebp - 0x674]
call fcn.1000ad70
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xffffffff
je 0x1002a65e
mov edx, dword [ebp - 0x670]
and edx, 0x10
je 0x1002a635
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x644]
cmp edx, 0x2e
jne 0x1002a5bd
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x644]
test ecx, ecx
je 0x1002a635
mov edx, 2
shl edx, 0
movzx eax, word [ebp + edx - 0x644]
cmp eax, 0x2e
jne 0x1002a5bd
mov ecx, 2
shl ecx, 1
movzx edx, word [ebp + ecx - 0x644]
test edx, edx
je 0x1002a635
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x678]
call fcn.100087d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x678]
push ecx
lea edx, [ebp - 0x218]
push edx
push str._s_smanifest.json
lea eax, [ebp - 0x674]
push eax
call fcn.10028180
add esp, 0x10
lea ecx, [ebp - 0x674]
call fcn.1000ad70
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1002a626
mov dword [ebp - 0x680], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.10009e40
jmp 0x1002a651
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.10009e40
lea ecx, [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1002a559
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.10009e40
mov eax, dword [ebp - 0x680]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret 8
Function at 0x1002a870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a5c2b
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x294], ecx
mov byte [ebp - 0x26d], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x1002a8c7
xor eax, eax
jmp 0x1002aacf
push 0x22c
push 0
lea eax, [ebp - 0x26c]
push eax
call fcn.1006cfe0
add esp, 0xc
mov dword [ebp - 0x26c], 0x22c
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x278]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1002aabb
mov dword [ebp - 0x274], 0
jmp 0x1002a91d
mov eax, dword [ebp - 0x274]
add eax, 1
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x1b
jae 0x1002aa93
mov ecx, dword [ebp - 0x274]
mov edx, dword [ecx*4 + section..data]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.1006f4a7
add esp, 8
test eax, eax
jne 0x1002aa8e
mov byte [ebp - 0x26d], 1
call fcn.10056330
mov dword [ebp - 0x27c], eax
push 1
mov ecx, dword [ebp - 0x27c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x27c]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x284], al
cmp byte [ebp - 0x284], 1
je 0x1002a98a
jmp 0x1002aa8c
mov dword [ebp - 0x288], 0xb0
push 0x100b5ea8
lea ecx, [ebp - 0x40]
call fcn.10008d80
mov dword [ebp - 4], 0
push 0x100b5f1c
lea ecx, [ebp - 0x28]
call fcn.10008d80
mov byte [ebp - 4], 1
call fcn.10056330
mov dword [ebp - 0x280], eax
push 0x100b5fb8
lea ecx, [ebp - 0x288]
push ecx
push 0x100b5f4c
push 0x100b5f50
push 0x100b5f3c
lea edx, [ebp - 0x248]
push edx
push 0x100b5f2c
push 0xaf
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x32c]
call fcn.10009410
mov dword [ebp - 0x28c], eax
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x290], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x290]
call fcn.10006880
mov ecx, eax
call fcn.10015590
mov ecx, eax
call fcn.10006880
mov ecx, eax
call fcn.10015590
mov ecx, eax
call fcn.10006880
mov ecx, eax
call fcn.10026be0
mov ecx, eax
call fcn.10006880
push eax
mov eax, dword [ebp - 0x280]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x280]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x32c]
call fcn.1000a370
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1000a090
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000a090
jmp 0x1002aa93
jmp 0x1002a90e
movzx ecx, byte [ebp - 0x26d]
test ecx, ecx
je 0x1002aaa0
jmp 0x1002aabb
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x278]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1002a902
mov ecx, dword [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x26d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret
Function at 0x1003b480
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.1006cfe0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x1003b4e4
cmp dword [ebp - 0x114], 6
jb 0x1003b4e4
mov dword [ebp - 0x11c], 1
jmp 0x1003b4ee
mov dword [ebp - 0x11c], 0
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret

Function at 0x1003c0e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.10039560
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0x40]
call edx
cmp dword [ebp - 0xc], 1
jne 0x1003c27d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x68], 0
je 0x1003c27d
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1003ce00
mov ecx, dword [ebp - 4]
call fcn.1003ac20
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [eax + 0xf4]
call ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003c175
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 0x84]
call edx
test eax, eax
je 0x1003c27d
mov dword [ebp - 0xc], 2
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
je 0x1003c195
mov dword [ebp - 0x14], 1
jmp 0x1003c19c
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x1003c1d5
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
jne 0x1003c1d5
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 0
push 1
push 0
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1003c880
jmp 0x1003c1fb
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x58], 0
je 0x1003c1fb
mov edx, dword [ebp - 4]
cmp dword [edx + 0x5c], 0
jne 0x1003c1fb
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1003c217
mov dword [ebp - 0x18], 1
jmp 0x1003c21e
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x1003c257
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
jne 0x1003c257
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], 0
push 1
push 1
push 0x3401
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1003c880
jmp 0x1003c27d
mov eax, dword [ebp - 4]
cmp dword [eax + 0x60], 0
je 0x1003c27d
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x5c], 0
jne 0x1003c27d
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x5c], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x1003ea80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a6ebb
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x100ed294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], ecx
mov ecx, dword [ebp + 0x10]
call fcn.100142c0
cmp eax, dword [ebp + 8]
jbe 0x1003ec28
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.10022150
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x228]
call fcn.10025e20
movzx ecx, al
test ecx, ecx
jne 0x1003ec28
lea ecx, [ebp - 0x23c]
call fcn.1001c3f0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x23c]
push edx
push 0x100bea4c
mov ecx, dword [ebp - 0x228]
call fcn.1000ad70
push eax
call fcn.1000e1d0
add esp, 0xc
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
call fcn.10026650
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x22c]
call fcn.100235b0
mov dword [ebp - 0x230], eax
jmp 0x1003eb5b
mov ecx, dword [ebp - 0x220]
add ecx, 4
mov dword [ebp - 0x220], ecx
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp - 0x230]
je 0x1003ec16
mov eax, dword [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.10008730
lea ecx, [ebp - 0x224]
call fcn.10025e20
movzx ecx, al
test ecx, ecx
jne 0x1003ec06
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.1006cfe0
add esp, 0xc
lea ecx, [ebp - 0x224]
call fcn.1000ad70
push eax
mov ecx, dword [ebp + 0xc]
call fcn.1000ad70
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1003ec06
mov byte [ebp - 0x219], 0
lea ecx, [ebp - 0x224]
call fcn.10009e40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.1001cba0
mov al, byte [ebp - 0x219]
jmp 0x1003ec2a
lea ecx, [ebp - 0x224]
call fcn.10009e40
jmp 0x1003eb4c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.1001cba0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100633f2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10040df0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10040e08
mov eax, 1
jmp 0x10040e4e
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 4]
add edx, 4
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x100412d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x10040e44
mov dword [ebp - 8], 1
jmp 0x10040e4b
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10048e00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov dword [ebp - 8], 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x10049640
push 0
push 0
call fcn.1007a6df
add esp, 0x18
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], eax
mov esp, ebp
pop ebp
ret