joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6f5814
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x6f58ae.0
jmp dword [ecx*4 + 0x6f5847]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6f5879
sub dl, 8
je 0x6f5888
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f54e0
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f5534
jmp case.0x6f58ae.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x6f58ae.0
movzx ecx, byte [ecx + 0x6f58b5]
jmp dword [ecx*4 + 0x6f58c6]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f55d4
jmp case.0x6f58ae.0
cmp dl, 3
jne 0x6f58f3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f562c
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f55e8
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f5670
jmp case.0x6f58ae.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6f591e
sub dl, 8
je 0x6f592a
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f569c
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f5700
jmp case.0x6f58ae.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x6f5949
sub dl, 8
je 0x6f5955
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f57b0
jmp case.0x6f58ae.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6f57d8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x6f59f7
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.006f4a1c
test eax, eax
je 0x6f59f7
mov eax, ebx
call fcn.006f5a00
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x6f5990
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6f5a00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x6f5a31
dec al
je 0x6f5a6c
dec al
je 0x6f5ab1
dec al
je 0x6f5b1a
jmp 0x6f5ba4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x6f5ba4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6f5a41
jmp 0x6f5ba4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6f5ba4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x6f5a7c
jmp 0x6f5ba4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6f5ba4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x6f5ae0
xor ebp, ebp
jmp 0x6f5af0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x6f5af9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6f5ac1
jmp 0x6f5ba4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x6f5ba4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x6f5b73
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.006f2b60
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6f5b2e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x7707c4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x770917
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x12]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.007701b0
lea ecx, [ebp - 0xc]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.0076f4dc
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.0076f524
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x12]
mov byte [ebx + 0xc], al
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040a6b8
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0x10]
call fcn.0040b498
movzx eax, byte [esi + 0x20]
mov byte [ebx + 0x30], al
mov eax, ebx
call fcn.0082af68
mov edx, dword [ebp - 0xc]
call fcn.0050d270
mov eax, ebx
call fcn.0082af68
movzx edx, byte [ebp - 0x11]
call fcn.0050d3e4
mov eax, ebx
call fcn.0082af68
movzx edx, byte [esi + 0x18]
call fcn.0050d314
mov eax, ebx
call fcn.0082af68
mov edx, dword [esi + 0x1c]
call fcn.0050cf48
mov eax, ebx
call fcn.0082af68
mov edx, dword [esi + 0x24]
call fcn.0050d2e8
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x3c]
call fcn.008334c0
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x40]
call fcn.008334c0
add eax, dword [ebx + 0x24]
mov dword [ebx + 0x2c], eax
cmp dword [esi + 0x44], 0xfffffc18
je 0x7708c7
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x44]
call fcn.008334c0
sub eax, dword [ebx + 0x24]
mov dword [ebx + 0x28], eax
jmp 0x7708cc
xor eax, eax
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x3c], eax
cmp byte [esi + 0x2a], 0
je 0x7708e4
movzx eax, byte [0x770928]
not eax
and byte [ebx + 0x38], al
cmp byte [esi + 0x29], 0
je 0x7708f4
movzx eax, byte [0x77092c]
or byte [ebx + 0x38], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x77091e
lea eax, [ebp - 0x10]
call fcn.0040a320
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a338
ret
Function at 0x783594
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
mov dword [ebx], 1
mov edx, esp
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x60]
push esi
lea esi, [esp + 4]
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [esi + 0x3b8]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x3bc]
sub dword [ebx + 0x14], eax
mov eax, esi
call fcn.0077e3ac
mov edx, eax
mov eax, dword [esi + 0x4a0]
mov eax, dword [eax + 0x8c]
call fcn.00829394
mov edi, eax
mov edx, dword [edi + 0x20]
mov eax, dword [esi + 0x4a0]
call fcn.0083318c
add dword [ebx + 0xc], eax
mov edx, dword [edi + 0x24]
mov eax, dword [esi + 0x4a0]
call fcn.0083318c
sub dword [ebx + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esi + 0x4b8]
call fcn.00737230
mov eax, dword [esp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 4]
jle 0x783632
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 8]
jle 0x78363d
mov dword [ebx + 8], eax
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
cmp eax, 0x412
jne 0x78366f
mov dword [ebx], 2
mov eax, dword [ebx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
push 1
push 0
lea eax, [ebx + 0xc]
push eax
call sub.user32.dll_OffsetRect
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x825e74
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov byte [ebp - 6], dl
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x82603f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
test byte [eax - 0xc], 1
setne al
mov edx, dword [ebp + 8]
test byte [edx - 0xc], 2
setne bl
mov edx, dword [ebp + 8]
movzx ecx, byte [ebp - 5]
cmp cl, 0x2f
ja 0x825ec0
and ecx, 0x7f
bt word [edx - 0xe], cx
setb dl
mov byte [ebp - 7], dl
mov edx, dword [ebp + 8]
test byte [edx - 0xd], 0x80
setne dl
mov byte [ebp - 8], dl
mov edx, dword [ebp + 8]
movzx ecx, byte [ebp - 6]
cmp cl, 0x2f
ja 0x825ee7
and ecx, 0x7f
bt word [edx - 0xe], cx
setb dl
mov byte [ebp - 9], dl
or al, bl
jne 0x825f09
cmp byte [ebp - 7], 0
jne 0x825f09
cmp byte [ebp - 8], 0
jne 0x825f09
mov eax, esi
call fcn.0040a2fc
jmp 0x826029
movzx eax, byte [ebp - 5]
sub al, 0x13
je 0x825f1f
dec al
je 0x825f2e
dec al
je 0x825f3d
dec al
je 0x825f4c
jmp 0x825f5b
lea eax, [ebp - 4]
mov edx, 0x82605c
call fcn.0040a7a4
jmp 0x825f63
lea eax, [ebp - 4]
mov edx, 0x826070
call fcn.0040a7a4
jmp 0x825f63
lea eax, [ebp - 4]
mov edx, 0x826080
call fcn.0040a7a4
jmp 0x825f63
lea eax, [ebp - 4]
mov edx, 0x826094
call fcn.0040a7a4
jmp 0x825f63
lea eax, [ebp - 4]
call fcn.0040a2fc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x38]
test eax, eax
jne 0x825f89
movzx eax, byte [ebp - 8]
push eax
push esi
movzx ecx, byte [ebp - 7]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00825b64
jmp 0x826029
movzx edx, byte [ebp - 5]
sub dl, 0x13
je 0x825fa0
dec dl
je 0x825fb6
dec dl
je 0x825fcc
dec dl
je 0x825fe2
jmp 0x825ff8
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 5]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0xc]
mov byte [ebp - 0xb], 0
jmp 0x826002
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 4]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 8]
mov byte [ebp - 0xb], 0
jmp 0x826002
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 6]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x10]
mov byte [ebp - 0xb], 1
jmp 0x826002
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 7]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x14]
mov byte [ebp - 0xb], 1
jmp 0x826002
mov byte [ebp - 0xa], 0
xor edi, edi
mov byte [ebp - 0xb], 0
mov eax, dword [ebp + 8]
push eax
push edi
push ebx
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
push esi
movzx ecx, byte [ebp - 0xb]
movzx edx, byte [ebp - 0xa]
mov eax, dword [ebp - 4]
call fcn.00825c60
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x826046
lea eax, [ebp - 4]
call fcn.0040a2fc
ret
Function at 0x82a9e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffffec
push 0x82aa48
push 0x82aa68
mov word [esp + 8], 0x6f
mov word [esp + 0xa], 0x4f
mov word [esp + 0xc], 0
mov word [esp + 0xe], 0x25ef
mov word [esp + 0x10], 0x25e6
mov word [esp + 0x12], 0x25cb
mov word [esp + 0x14], 0x2b2d
mov word [esp + 0x16], 0x2b2f
mov word [esp + 0x18], 0x2b55
mov word [esp + 0x1a], 0x2b58
lea edx, [esp + 8]
mov ecx, 9
call fcn.0082a65c
add esp, 0x14
ret
Function at 0x842750
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov esi, eax
movzx ebx, word [0x842820]
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x18], 0x80
je 0x842777
or bx, 1
test byte [esp + 0x19], 0x80
je 0x842782
or bx, 4
test byte [esp + 0x1a], 0x80
je 0x84278d
or bx, 2
test byte [esp + 9], 0x80
je 0x842798
or bx, 8
test byte [esp + 0xa], 0x80
je 0x8427a3
or bx, 0x10
test byte [esp + 0xc], 0x80
je 0x8427ae
or bx, 0x20
push esp
call sub.user32.dll_GetCursorPos
lea ecx, [esp + 0x108]
mov edx, esp
mov eax, esi
call fcn.00614cc4
mov eax, dword [esp + 0x108]
mov dword [esp], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 4], eax
mov edi, dword [esp]
test edi, edi
jl 0x842815
mov eax, esi
call fcn.00614a80
cmp edi, eax
jge 0x842815
cmp dword [esp + 4], 0
jl 0x842815
mov eax, esi
call fcn.00614ac0
cmp eax, dword [esp + 4]
jle 0x842815
mov eax, dword [esp + 4]
push eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov eax, esi
mov si, 0xffd4
call fcn.00408964
add esp, 0x110
pop edi
pop esi
pop ebx
ret
Function at 0x859750
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, edx
mov eax, ebx
mov edx, 0x8597c8
call fcn.0040a6b8
call sub.kernel32.dll_GetSystemDefaultUILanguage_1
and eax, 0xff
movzx eax, ax
sub eax, 1
jb 0x859782
sub eax, 6
je 0x85979e
sub eax, 2
je 0x859790
sub eax, 0x10
je 0x8597ac
jmp 0x8597b8
mov eax, ebx
mov edx, 0x8597c8
call fcn.0040a6b8
pop ebx
ret
mov eax, ebx
mov edx, 0x8597c8
call fcn.0040a6b8
pop ebx
ret
mov eax, ebx
mov edx, 0x8597e4
call fcn.0040a6b8
pop ebx
ret
mov eax, ebx
mov edx, 0x859800
call fcn.0040a6b8
pop ebx
ret

Function at 0x85c624
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.004075cc
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x85ccf0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffdfc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x85cd21
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.0040b45c
jmp 0x85cd28
mov eax, ebx
call fcn.0040a2d8
add esp, 0x204
pop ebx
ret

Function at 0x85ce90
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x85cf05
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040b534
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b3a0
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x85cee8
push ebx
mov ecx, dword [ebp - 8]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040b7dc
jmp 0x85ceef
mov eax, ebx
call fcn.0040a2d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85cf0c
lea eax, [ebp - 4]
call fcn.0040a2d8
ret
Function at 0x85eb0c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x85ec05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0
je 0x85ebda
lea eax, [ebp - 4]
push eax
mov eax, 0x85ec20
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x85ec48
call fcn.00428eb0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040af68
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
call fcn.00855468
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x85ebd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0085680c
test eax, eax
jle 0x85ebbd
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.00856fd4
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 4]
call fcn.0040a6b8
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00856fd4
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 8]
call fcn.0040a6b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85ebda
mov eax, dword [ebp - 8]
call fcn.00408618
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85ec0c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a338
lea eax, [ebp - 0x14]
call fcn.0040a2fc
lea eax, [ebp - 4]
call fcn.0040a2d8
ret
Function at 0x85eca8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x85ee1a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0
je 0x85edef
lea eax, [ebp - 4]
push eax
mov eax, 0x85ee34
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x85ee5c
call fcn.00428eb0
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040af68
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
call fcn.00855468
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x85ede8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0085680c
test eax, eax
jne 0x85ed81
lea eax, [ebp - 4]
push eax
mov eax, 0x85ee34
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 2
mov eax, 0x85eea8
call fcn.00428eb0
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 4]
mov ecx, 0xfde9
call fcn.0040af68
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx + 0xc]
call fcn.00854968
jmp 0x85edd2
lea eax, [ebp - 4]
push eax
mov eax, 0x85ee34
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 2
mov eax, 0x85ef24
call fcn.00428eb0
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 4]
mov ecx, 0xfde9
call fcn.0040af68
mov edx, dword [ebp - 0x34]
mov eax, dword [ebx + 0xc]
call fcn.00854968
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85edef
mov eax, dword [ebp - 8]
call fcn.00408618
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85ee21
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0040a368
lea eax, [ebp - 0x14]
call fcn.0040a2fc
lea eax, [ebp - 4]
call fcn.0040a2d8
ret
Function at 0x889564
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x88957d
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x88958d
mov bl, 1
jmp 0x88967a
mov eax, dword [0xa8f784]
cmp dword [eax], 2
jne 0x8895a1
mov eax, dword [0xa8eba8]
cmp dword [eax], 4
jg 0x8895d5
mov eax, dword [0xa8f784]
cmp dword [eax], 1
jne 0x889664
mov eax, dword [0xa8eba8]
cmp dword [eax], 4
jg 0x8895d5
mov eax, dword [0xa8eba8]
cmp dword [eax], 4
jne 0x889664
mov eax, dword [0xa8f2fc]
cmp dword [eax], 0
jle 0x889664
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x88961c
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x889670
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x889670
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x88975c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a3bc
xor eax, eax
push ebp
push 0x8897fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00406950
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00428404
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x889814
call fcn.0040b60c
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00427dcc
test al, al
je 0x8897df
push 5
push 0x889834
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00889684
mov eax, dword [ebp - 0x14]
call fcn.0040b3a0
push eax
mov eax, dword [ebp - 8]
call fcn.0040b3a0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x889801
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040a338
ret