joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583674
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
call sub.KERNEL32.DLL_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5836cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, esi
call fcn.0040a278
push eax
mov eax, ebx
call fcn.0040a278
push eax
call sub.KERNEL32.DLL_CopyFileW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5836d6
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_SetErrorMode
ret

Function at 0x58f758
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.00409124
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameW
test eax, eax
je 0x58f789
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.004092ac
add esp, 0x24
pop ebx
ret

Function at 0x5b0024
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov eax, 8
test byte [edx + 1], 0x80
setne bl
movzx esi, word [edx]
add esi, esi
movzx edi, cl
shr edi, 7
or si, di
mov word [edx], si
test bl, bl
je 0x5b004d
xor word [edx], 0x1021
add ecx, ecx
and cl, 0xff
dec eax
jne 0x5b002c
pop edi
pop esi
pop ebx
ret
Function at 0x5ce5fc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [0xa4679c]
test eax, eax
je 0x5ce621
mov edx, dword [0xa4679c]
mov edx, dword [edx + 4]
sub edx, dword [0xa4679c]
lea ecx, [ebx + 0xc]
cmp edx, ecx
jg 0x5ce64c
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov edx, dword [0xa4679c]
mov dword [eax], edx
mov dword [0xa4679c], eax
mov edx, eax
add edx, 0x1000
mov dword [eax + 4], edx
add ebx, 4
mov edx, dword [eax + 4]
sub edx, ebx
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
lea eax, [edx + 4]
mov dword [esi], eax
pop esi
pop ebx
ret

Function at 0x60c100
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, edx
mov ebx, eax
cmp edx, 4
jl 0x60c133
mov eax, dword [ebx]
imul eax, eax, 0x5bd1e995
mov esi, eax
shr esi, 0x18
xor eax, esi
imul eax, eax, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, eax
add ebx, 4
sub edx, 4
cmp edx, 4
jge 0x60c10b
dec edx
je 0x60c14e
dec edx
je 0x60c145
dec edx
jne 0x60c159
movzx eax, byte [ebx + 2]
shl eax, 0x10
xor ecx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [ebx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xd
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
and eax, 0x7fffffff
pop esi
pop ebx
ret
Function at 0x61b200
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x61b22e
mov eax, ebx
call fcn.0061bcbc
cmp dword [ebx + 0x40], 0
je 0x61b227
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x61b29f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x61b291
cmp dword [ebx + 8], 0
je 0x61b250
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x61b262
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x61b291
cmp dword [ebx + 8], 0
je 0x61b243
cmp eax, 3
je 0x61b275
dec eax
jne 0x61b243
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x61b243
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x61b243
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x61b2bd
cmp dword [ebx + 0x14], 0xcc
je 0x61b2bd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0061b2c8
pop ebx
ret
Function at 0x64b8c8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
test dl, dl
je 0x64b8db
add esp, 0xfffffff0
call fcn.00407a04
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x64b954
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00407440
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0x18], 0
lea edx, [ebp - 4]
mov eax, esi
call fcn.0064bc28
mov edx, dword [ebp - 4]
lea eax, [esi + 0xc]
call fcn.00409504
mov ecx, dword [esi + 0xc]
lea eax, [esi + 0x10]
mov edx, 0x64b984
call fcn.0040a4e4
mov ecx, esi
mov dl, 1
mov eax, dword [0x64addc]
call fcn.0064c1c8
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b95b
lea eax, [ebp - 4]
call fcn.00409124
ret

Function at 0x64bb14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor edx, edx
push ebp
push 0x64bbbf
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0064c1bc
mov ebx, eax
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00409504
lea edx, [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.00424e94
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00409504
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00409504
test edi, edi
je 0x64bb81
mov edx, edi
mov eax, ebx
call fcn.0064cd70
jmp 0x64bb8e
lea eax, [ebx + 0x14]
mov edx, 0x64bbe0
call fcn.00409504
test esi, esi
je 0x64bb9c
lea eax, [ebx + 0x10]
mov edx, esi
call fcn.00409504
lea eax, [ebx + 0x18]
mov edx, 0x64bc04
call fcn.00409504
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64bbc6
lea eax, [ebp - 0xc]
call fcn.00409124
ret
Function at 0x64c320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x64c328
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64c4dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x64c4f8
call fcn.0040a4e4
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0x1c]
call fcn.005aa1c8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x64c50c
call fcn.005637a0
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x64c3a3
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x64c3e4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
xor edx, edx
mov eax, dword [ebx + 0xc]
call fcn.005aa1c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x64c574
call fcn.005637a0
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040a48c
mov eax, esi
mov edx, 0x64c5a0
call fcn.0040a48c
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x64c3fc
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x64c46a
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x64c5b4
call fcn.005637a0
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040a48c
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x64c433
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x64c45e
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x64c5e4
call fcn.005637a0
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040a48c
mov eax, esi
mov edx, 0x64c5a0
call fcn.0040a48c
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x64c476
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x64c4a1
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x64c610
call fcn.005637a0
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040a48c
mov eax, esi
mov edx, 0x64c5a0
call fcn.0040a48c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64c4e4
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409184
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409184
lea eax, [ebp - 4]
call fcn.00409124
ret
Function at 0x67525c
Capabilities:
Encrypt data using rc4 prga
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], edx
xor ebx, ebx
mov eax, dword [esp]
test eax, eax
je 0x675274
sub eax, 4
mov eax, dword [eax]
mov edi, eax
test edi, edi
jle 0x67541d
mov dword [esp + 4], 1
mov eax, dword [esp]
mov edx, dword [esp + 4]
movzx eax, word [eax + edx*2 - 2]
cmp ax, 0xfa
jb 0x6752e1
sub al, 0xfa
mov ebx, eax
and bl, 1
xor bl, 1
movzx eax, al
shr eax, 1
movzx eax, byte [eax + 0x9da5ae]
mov byte [esp + 8], al
push 0
movzx eax, byte [esp + 0xc]
push eax
call sub.user32.dll_MapVirtualKeyW
mov ebp, eax
push 0
movzx eax, bl
mov eax, dword [eax*4 + 0x9da5b4]
push eax
mov eax, ebp
push eax
movzx eax, byte [esp + 0x14]
push eax
call sub.user32.dll_keybd_event
jmp 0x675406
xor esi, esi
cmp ax, 0xf0
jb 0x6752f9
movzx eax, ax
movzx eax, byte [eax + 0x9da4b4]
mov byte [esp + 8], al
jmp 0x675321
cmp ax, 0xe4
jb 0x675307
sub al, 0x74
mov byte [esp + 8], al
jmp 0x675321
cmp ax, 0x20
jae 0x675313
mov byte [esp + 8], al
jmp 0x675321
push eax
call sub.user32.dll_VkKeyScanW
mov esi, eax
mov eax, esi
mov byte [esp + 8], al
push 0
movzx eax, byte [esp + 0xc]
push eax
call sub.user32.dll_MapVirtualKeyW
mov ebp, eax
test bl, bl
jne 0x67534e
mov eax, esi
shr ax, 8
test ax, 1
jbe 0x67534e
push 0
push 0
push 0
push 0x10
call sub.user32.dll_keybd_event
test bl, bl
jne 0x67536c
mov eax, esi
shr ax, 8
test ax, 2
jbe 0x67536c
push 0
push 0
push 0
push 0x11
call sub.user32.dll_keybd_event
test bl, bl
jne 0x67538a
mov eax, esi
shr ax, 8
test ax, 4
jbe 0x67538a
push 0
push 0
push 0
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
mov eax, ebp
push eax
movzx eax, byte [esp + 0x14]
push eax
call sub.user32.dll_keybd_event
push 0
push 2
mov eax, ebp
push eax
movzx eax, byte [esp + 0x14]
push eax
call sub.user32.dll_keybd_event
test bl, bl
jne 0x6753cc
mov eax, esi
shr ax, 8
test ax, 4
jbe 0x6753cc
push 0
push 2
push 0
push 0x12
call sub.user32.dll_keybd_event
test bl, bl
jne 0x6753ea
mov eax, esi
shr ax, 8
test ax, 2
jbe 0x6753ea
push 0
push 2
push 0
push 0x11
call sub.user32.dll_keybd_event
test bl, bl
jne 0x675406
shr si, 8
test si, 1
jbe 0x675406
push 0
push 2
push 0
push 0x10
call sub.user32.dll_keybd_event
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
inc dword [esp + 4]
dec edi
jne 0x675286
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x684800
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov esi, eax
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
mov ecx, ebx
test ecx, ecx
je 0x68481f
sub ecx, 4
mov ecx, dword [ecx]
lea eax, [ecx + 2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
add edx, edx
add edx, edx
mov eax, dword [esp]
xor ecx, ecx
call fcn.00409d10
mov ecx, ebx
test ecx, ecx
je 0x684845
sub ecx, 4
mov ecx, dword [ecx]
lea eax, [ecx + 2]
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x68495c
mov ebx, 1
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0xc]
mov eax, edx
test eax, eax
je 0x684872
sub eax, 4
mov eax, dword [eax]
lea ecx, [ebx + ebx*2]
cmp eax, ecx
jge 0x68489c
mov eax, edx
test eax, eax
je 0x684884
sub eax, 4
mov eax, dword [eax]
mov edx, ebx
dec edx
lea edx, [edx + edx*2]
sub eax, edx
push eax
lea eax, [esi + edx]
lea edx, [esp + 8]
pop ecx
call fcn.00404b78
jmp 0x6848b3
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
lea edx, [esp + 4]
mov ecx, 3
call fcn.00404b78
movzx eax, byte [esp + 4]
mov edx, eax
and dl, 0xfc
movzx edx, dl
shr edx, 2
mov ecx, 0x684a18
movzx edx, byte [ecx + edx]
mov byte [esp + 7], dl
and al, 3
movzx ebp, al
shl ebp, 4
movzx edx, byte [esp + 5]
mov eax, edx
and al, 0xf0
movzx eax, al
shr eax, 4
or ebp, eax
mov eax, 0x684a18
movzx eax, byte [eax + ebp]
mov byte [esp + 8], al
and dl, 0xf
movzx eax, dl
add eax, eax
add eax, eax
movzx edx, byte [esp + 6]
and dl, 0xc0
movzx edx, dl
shr edx, 6
or eax, edx
mov edx, 0x684a18
movzx eax, byte [edx + eax]
mov byte [esp + 9], al
movzx eax, byte [esp + 6]
and al, 0x3f
movzx eax, al
mov edx, 0x684a18
movzx eax, byte [edx + eax]
mov byte [esp + 0xa], al
mov eax, dword [esp]
call fcn.004096f8
mov edx, ebx
dec edx
add edx, edx
add edx, edx
lea edx, [eax + edx]
lea eax, [esp + 7]
mov ecx, 4
call fcn.00404b78
inc ebx
dec edi
jne 0x68485f
mov dword [esp + 0xc], esi
mov ebx, dword [esp + 0xc]
mov ecx, ebx
test ecx, ecx
je 0x68496f
sub ecx, 4
mov ecx, dword [ecx]
mov eax, ecx
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x6849c4
mov eax, dword [esp]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x684992
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esp]
call fcn.004096f8
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [esp]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x6849b5
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esp]
call fcn.004096f8
mov byte [eax + ebx - 1], 0x3d
jmp 0x684a01
mov ecx, ebx
test ecx, ecx
je 0x6849cf
sub ecx, 4
mov ecx, dword [ecx]
mov eax, ecx
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x684a01
mov eax, dword [esp]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x6849f4
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esp]
call fcn.004096f8
mov byte [eax + ebx - 1], 0x3d
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6a1b8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a1ce5
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x6a1cca
mov eax, ebx
test eax, eax
je 0x6a1bc5
sub eax, 4
mov eax, dword [eax]
jmp 0x6a1bc7
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x6a1bd7
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x6a1bdb
mov ax, 2
cmp ax, 1
jne 0x6a1c5c
test ebx, ebx
je 0x6a1bef
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x6a1bf7
mov eax, dword [0xa4056c]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.0040d8c8
mov edi, eax
cmp edi, 0x100
jle 0x6a1c1f
mov eax, edi
add eax, eax
call fcn.004048f0
mov esi, eax
jmp 0x6a1c25
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x6a1c33
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x6a1c3c
mov edx, dword [0xa4056c]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x6a1c49
sub eax, 4
mov eax, dword [eax]
jmp 0x6a1c4b
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.0040d8c8
jmp 0x6a1c95
cmp edi, 0x100
jle 0x6a1c71
mov eax, edi
add eax, eax
call fcn.004048f0
mov esi, eax
jmp 0x6a1c77
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00422efc
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00404b78
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x6a1cb7
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x6a1ca1
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x6a1ccc
mov eax, esi
call fcn.0040490c
jmp 0x6a1ccc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a1cec
lea eax, [ebp - 0x204]
call fcn.00409124
ret

Function at 0x6b64d8
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 0x10], 2
jne 0x6b64fd
cmp dword [esp + 4], 5
jb 0x6b64fd
mov al, 1
jmp 0x6b64ff
xor eax, eax
add esp, 0x114
ret
Function at 0x745524
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
cmp dword [eax + 0xcc], 0
je 0x745687
xor ecx, ecx
mov cl, byte [edx]
cmp ecx, 0xc0
jb 0x74563b
test cl, 0x20
jne 0x74555e
and ecx, 0x1f
xor ebx, ebx
mov bl, byte [edx + 1]
shl ecx, 6
and ebx, 0x3f
or ecx, ebx
jmp 0x74563b
test cl, 0x10
jne 0x745585
and ecx, 0xf
shl ecx, 0xc
xor ebx, ebx
mov bl, byte [edx + 1]
and ebx, 0x3f
shl ebx, 6
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 0x3f
or ecx, ebx
jmp 0x74563b
test cl, 8
jne 0x7455b9
and ecx, 7
shl ecx, 0x12
xor ebx, ebx
mov bl, byte [edx + 1]
and ebx, 0x3f
shl ebx, 0xc
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 0x3f
shl ebx, 6
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 3]
and ebx, 0x3f
or ecx, ebx
jmp 0x74563b
test cl, 4
jne 0x7455f7
and ecx, 3
shl ecx, 0x18
xor ebx, ebx
mov bl, byte [edx + 1]
and ebx, 0x3f
shl ebx, 0x12
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 0x3f
shl ebx, 0xc
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 3]
and ebx, 0x3f
shl ebx, 6
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 4]
and ebx, 0x3f
or ecx, ebx
jmp 0x74563b
and ecx, 1
shl ecx, 0x1e
xor ebx, ebx
mov bl, byte [edx + 1]
and ebx, 0x3f
shl ebx, 0x18
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 2]
and ebx, 0x3f
shl ebx, 0x12
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 3]
and ebx, 0x3f
shl ebx, 0xc
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 4]
and ebx, 0x3f
shl ebx, 6
or ecx, ebx
xor ebx, ebx
mov bl, byte [edx + 5]
and ebx, 0x3f
or ecx, ebx
cmp ecx, 0x7f
ja 0x745649
mov ebx, dword [eax + 0x30]
movzx ebx, byte [ebx + ecx]
jmp 0x745692
mov ebx, ecx
mov esi, ebx
test esi, esi
jns 0x745654
add esi, 0x7f
sar esi, 7
movzx esi, byte [esi + 0x9ef858]
shl esi, 7
mov edi, ebx
and edi, 0x8000007f
jns 0x745670
dec edi
or edi, 0xffffff80
inc edi
add esi, edi
movzx esi, word [esi*2 + 0x9e2d58]
mov esi, dword [esi*8 + 0x9e19bc]
add esi, ebx
mov ebx, esi
jmp 0x745692
xor ecx, ecx
mov cl, byte [edx]
mov ebx, dword [eax + 0x30]
movzx ebx, byte [ebx + ecx]
xor ebx, ecx
cmp ecx, 0x7f
ja 0x7456a5
cmp ebx, 0x20
jne 0x7456a5
mov eax, 0x20
jmp 0x7456e5
mov esi, ebx
dec esi
test esi, ebx
je 0x7456b0
xor eax, eax
jmp 0x7456e5
cmp dword [eax + 0xcc], 0
je 0x7456e0
cmp ecx, 0x7f
jbe 0x7456e0
movzx edx, byte [edx]
and edx, 0x3f
xor eax, eax
mov al, byte [edx + 0x9e0068]
jmp 0x7456d2
dec eax
shr ebx, 6
test bl, 0x3f
je 0x7456ce
shl eax, 8
or ebx, eax
mov eax, ebx
jmp 0x7456e5
mov eax, ebx
or eax, 0
pop edi
pop esi
pop ebx
ret
Function at 0x76b6e8
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
push ebp
add esp, 0xfffffff8
mov edi, eax
cmp dword [ebx + 0x18], 0
mov esi, dword [edi]
jge 0x76b7c7
mov edx, dword [ebx + 0x10]
movzx eax, word [edx]
cmp eax, 0x80
je 0x76b713
cmp eax, 0x85
jne 0x76b78c
movzx ebp, word [edx + 6]
add ebp, ebp
push 0
push 0x102
push 0xfffffffffffffffc
mov ecx, 1
mov edx, 6
mov eax, esi
call fcn.00759fb8
push 0
push 0x102
push 0xfffffffffffffff8
mov ecx, 3
mov edx, 6
mov eax, esi
call fcn.00759fb8
mov eax, ebp
mov ecx, dword [edi + 0x14]
shl eax, 2
mov edx, 6
add ecx, eax
mov eax, esi
push ecx
push 1
push 0
mov ecx, 0x10b
call fcn.00759fb8
inc ebp
mov ecx, dword [edi + 0x14]
shl ebp, 2
mov edx, 6
add ecx, ebp
mov eax, esi
push ecx
push 3
push 0
mov ecx, 0x10b
call fcn.00759fb8
mov eax, esi
call fcn.0075c278
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0076d350
mov eax, edi
mov edx, dword [ebx + 0x1c]
shl edx, 2
mov ecx, 2
mov eax, dword [eax]
push 0
push 2
push 0
push 0x200
push edx
mov edx, 0x1b
call fcn.0075b6cc
jmp 0x76b897
push 0
push 0x10b
mov eax, dword [ebx + 0x14]
mov ecx, 2
push eax
mov eax, esi
mov edx, 6
call fcn.00759fb8
mov dword [esp], esi
lea ebp, [edi + 0xac]
mov edx, 0x17
mov eax, esi
call fcn.0075c304
mov dword [esp + 4], eax
mov edx, 8
mov eax, dword [esp]
call fcn.007587a0
test eax, eax
je 0x76b81c
mov ecx, dword [ebp]
mov dword [eax + 4], ecx
mov edx, dword [esp + 4]
mov dword [eax], edx
mov dword [ebp], eax
cmp dword [ebx + 0xc], 0
je 0x76b876
mov edx, 0x16
mov eax, esi
call fcn.0075c304
mov ebp, eax
mov eax, esi
call fcn.0075c278
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0076d350
mov eax, edi
mov edx, dword [ebx + 0x1c]
shl edx, 2
mov ecx, 2
mov eax, dword [eax]
push 0
push 2
push 0
push 0x200
push edx
mov edx, 0x1b
call fcn.0075b6cc
mov eax, esi
call fcn.0075c278
mov edx, eax
mov eax, ebp
call fcn.007586dc
mov ecx, dword [ebx + 0x14]
mov edx, 6
push ecx
push 0x102
mov edi, dword [ebx + 0x18]
mov ecx, 0x10b
shl edi, 2
mov eax, esi
push edi
call fcn.00759fb8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x792314
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov word [ebp - 2], ax
xor eax, eax
push ebp
push 0x792399
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x1004
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x10]
mov ecx, 6
call fcn.0040a334
mov eax, dword [ebp - 0x14]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00423db0
push 1
lea edx, [ebp - 4]
push edx
push 1
lea edx, [ebp - 2]
push edx
push 4
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7923a0
lea eax, [ebp - 0x14]
call fcn.00409124
ret

Function at 0x7976ac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x7976e8]
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x7976c4
or bx, 2
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x7976d4
or bx, 4
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x7976e4
or bx, 1
mov eax, ebx
pop ebx
ret

Function at 0x79d548
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, ecx
mov esi, edx
mov dword [esp], eax
mov eax, dword [esp]
call fcn.00409634
mov edx, eax
mov eax, ebp
xor ecx, ecx
call fcn.00409d10
mov eax, dword [esp]
call fcn.00409634
mov edi, eax
test edi, edi
jle 0x79d5af
mov ebx, 1
mov eax, ebp
call fcn.004096f8
mov edx, dword [esp]
movzx edx, byte [edx + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp]
movzx eax, byte [eax + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec edi
jne 0x79d57a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x79d628
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
call fcn.00409634
mov edx, eax
mov eax, dword [esp]
xor ecx, ecx
call fcn.00409d10
mov dword [esp + 4], edi
mov eax, dword [esp + 4]
call fcn.00409634
mov ebp, eax
test ebp, ebp
jle 0x79d697
mov ebx, 1
mov eax, dword [esp]
call fcn.004096f8
movzx edx, byte [edi + ebx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
mov byte [eax + ebx - 1], dl
movzx eax, byte [edi + ebx - 1]
add esi, eax
imul eax, esi, 0xce6d
add eax, 0x58bf
mov esi, eax
inc ebx
dec ebp
jne 0x79d667
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret