joyce8/EMBER2024-capa huggingface dataset:
Function at 0x698050
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x11c
mov eax, 0x7b536e
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
call fcn.00697f20
test al, al
je 0x69822f
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], 8
push eax
push esi
lea eax, [ebp - 0xf4]
push eax
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x698156
push str.Cant_read_value_of_key__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x90]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x128]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0x128]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0xb0]
call fcn.00408e36
lea ecx, [ebp - 0x30]
jmp 0x69822a
push 4
pop esi
cmp dword [ebp - 0xf4], esi
jb 0x69817a
cmp dword [ebp - 0xf4], 5
jbe 0x698173
cmp dword [ebp - 0xf4], 0xb
jne 0x69817a
mov al, 1
jmp 0x698231
push str.Registry_value___s__is_not_numeric__but_of_type__s_
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], esi
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0xf0]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 6
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x114]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 7
mov eax, esp
mov dword [ebp - 0xfc], esp
push dword [ebp - 0xf4]
push eax
call fcn.00697b84
sub esp, 0x18
mov byte [ebp - 4], 8
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
mov byte [ebp - 4], 7
lea eax, [ebp - 0x114]
push eax
call fcn.006967e9
add esp, 0x44
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x114]
call fcn.00661721
lea ecx, [ebp - 0xf0]
call fcn.00408e36
lea ecx, [ebp - 0xd0]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8
Function at 0x69852e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x11c
mov eax, 0x7b52e9
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
call fcn.00697f20
test al, al
je 0x69863e
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0xf8]
push eax
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x698698
cmp dword [ebp - 0xf8], 3
je 0x698648
push str.Registry_value___s__is_not_binary__but_of_type__s_
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x128]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov eax, esp
mov dword [ebp - 0x100], esp
push dword [ebp - 0xf8]
push eax
call fcn.00697b84
sub esp, 0x18
mov byte [ebp - 4], 4
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x128]
push eax
call fcn.006967e9
add esp, 0x44
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x128]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8
cmp dword [ebp - 0xf4], 0
mov ecx, esi
je 0x698691
push dword [ebp - 0xf4]
call fcn.0067e3b6
lea ecx, [ebp - 0xf4]
push ecx
push eax
lea eax, [ebp - 0xf8]
push eax
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xf4]
mov ecx, esi
mov dword [edi + 0x30], eax
call fcn.0067e449
jmp 0x698698
push 0
call fcn.0067e43a
cmp dword [edi + 0x30], 0
je 0x698755
push str.Cant_read_value_of_key__s
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 5
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0xf0]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 7
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x114]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 8
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0x114]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0xb0]
call fcn.00408e36
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 7
call fcn.00661721
lea ecx, [ebp - 0xf0]
call fcn.00408e36
lea ecx, [ebp - 0xd0]
call fcn.00408e36
lea ecx, [ebp - 0x50]
jmp 0x698639
mov al, 1
jmp 0x698640
Function at 0x69875c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x11c
mov eax, 0x7b536e
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
call fcn.00697f20
test al, al
je 0x698862
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], 4
push eax
push esi
lea eax, [ebp - 0xf4]
push eax
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [edi + 0x30], eax
test eax, eax
je 0x69886c
push str.Cant_read_value_of_key__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0xb0]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x90]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x128]
push eax
call fcn.0066154b
push 1
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call fcn.00697877
sub esp, 0xc
mov ecx, eax
push esp
call fcn.004474bf
lea eax, [ebp - 0x128]
push eax
push dword [edi + 0x30]
call fcn.00689bdf
add esp, 0x14
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 2
call fcn.00661721
lea ecx, [ebp - 0x90]
call fcn.00408e36
lea ecx, [ebp - 0xb0]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8
push 4
pop esi
cmp dword [ebp - 0xf4], esi
je 0x69893d
cmp dword [ebp - 0xf4], 5
je 0x69893d
push str.Registry_value___s__is_not_numeric__but_of_type__s_
lea ecx, [ebp - 0x50]
call fcn.00408c6d
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], esi
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0xf0]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 6
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x114]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 7
mov eax, esp
mov dword [ebp - 0xfc], esp
push dword [ebp - 0xf4]
push eax
call fcn.00697b84
sub esp, 0x18
mov byte [ebp - 4], 8
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
mov byte [ebp - 4], 7
lea eax, [ebp - 0x114]
push eax
call fcn.006967e9
add esp, 0x44
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x114]
call fcn.00661721
lea ecx, [ebp - 0xf0]
call fcn.00408e36
lea ecx, [ebp - 0xd0]
call fcn.00408e36
lea ecx, [ebp - 0x50]
jmp 0x69885d
mov al, 1
jmp 0x698864
Function at 0x698f21
Capabilities:
Set registry value

Disassembly:
push 0x7c
mov eax, 0x7b036c
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
push 1
call fcn.00697f20
test al, al
je 0x698f65
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x698f65
mov al, 1
jmp 0x698ff5
push str.Cant_set_value_of__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push dword [edi + 0x30]
call fcn.0067829d
add esp, 0x28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 0xc

Function at 0x698ffd
Capabilities:
Set registry value

Disassembly:
push 0x7c
mov eax, 0x7b036c
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 1
call fcn.00697f20
test al, al
je 0x699055
mov ecx, esi
call fcn.0068c166
mov ecx, esi
lea eax, [eax*2 + 2]
push eax
call fcn.00669d63
push eax
push 1
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x699055
mov al, 1
jmp 0x6990e5
push str.Cant_set_value_of__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push dword [edi + 0x30]
call fcn.0067829d
add esp, 0x28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8
Function at 0x6990ed
Capabilities:
Set registry value

Disassembly:
push 0x7c
mov eax, 0x7b036c
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 1
call fcn.00697f20
test al, al
je 0x69913e
mov ecx, esi
call fcn.0068b5e2
push eax
mov ecx, esi
call fcn.0040a03c
push eax
push 3
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x69913e
mov al, 1
jmp 0x6991ce
push str.Cant_set_value_of__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push dword [edi + 0x30]
call fcn.0067829d
add esp, 0x28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8

Function at 0x6991d6
Capabilities:
Set registry value

Disassembly:
push 0x7c
mov eax, 0x7b036c
call fcn.00645f96
mov edi, ecx
mov ebx, dword [ebp + 8]
push 1
call fcn.00697f20
test al, al
je 0x69921a
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push ebx
call fcn.00698944
pop ecx
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x69921a
mov al, 1
jmp 0x6992aa
push str.Cant_set_value_of__s
lea ecx, [ebp - 0x30]
call fcn.00408c6d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00408cc0
mov esi, eax
lea ecx, [ebp - 0x70]
call fcn.00408cc0
push esi
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 2
push eax
call fcn.00669628
add esp, 0xc
lea ecx, [ebp - 0x88]
push eax
call fcn.0066154b
sub esp, 0x20
mov byte [ebp - 4], 3
mov eax, esp
push ebx
push edi
push eax
call fcn.006977de
add esp, 0xc
lea eax, [ebp - 0x88]
push eax
push dword [edi + 0x30]
call fcn.0067829d
add esp, 0x28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
call fcn.00661721
lea ecx, [ebp - 0x70]
call fcn.00408e36
lea ecx, [ebp - 0x50]
call fcn.00408e36
lea ecx, [ebp - 0x30]
call fcn.00408e36
xor al, al
call fcn.00645f45
ret 8
Function at 0x69a127
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
je 0x69a21f
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
mov edx, dword [ebp + 8]
mov edi, ecx
cmp ebx, 3
jb 0x69a1bc
add edi, 4
test edx, edx
je 0x69a1af
cmp edi, dword [ebp + 0xc]
ja 0x69a21f
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x7e2a08]
mov byte [edx], al
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
mov al, byte [ecx + 0x7e2a08]
mov byte [edx + 1], al
movzx ecx, byte [esi + 1]
movzx eax, byte [esi + 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
mov al, byte [ecx + 0x7e2a08]
mov byte [edx + 2], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + 0x7e2a08]
mov byte [edx + 3], al
add edx, 4
sub ebx, 3
add esi, 3
cmp ebx, 3
jae 0x69a147
xor ecx, ecx
test ebx, ebx
je 0x69a21b
add edi, 4
test edx, edx
je 0x69a21b
cmp edi, dword [ebp + 0xc]
ja 0x69a21f
cmp ebx, 2
jne 0x69a1d4
mov cl, byte [esi + 1]
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x7e2a08]
mov byte [edx], al
movzx eax, cl
movzx ecx, byte [esi]
mov esi, eax
and ecx, 3
mov dword [ebp + 0x10], eax
shr eax, 4
shl ecx, 4
or ecx, eax
mov al, byte [ecx + 0x7e2a08]
mov byte [edx + 1], al
cmp ebx, 2
jne 0x69a212
and esi, 0xf
mov al, byte [esi*4 + 0x7e2a08]
jmp 0x69a214
mov al, 0x3d
mov byte [edx + 2], al
mov byte [edx + 3], 0x3d
mov eax, edi
jmp 0x69a222
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x69ef64
Capabilities:
Manipulate console buffer

Disassembly:
push 0x68
mov eax, 0x7b5ffd
call fcn.00645f96
mov edi, ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x69f10b
test esi, esi
je 0x69f10b
push str.kernel32.dll
lea ecx, [ebp - 0x48]
call fcn.0042aa63
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push 2
lea eax, [edi + 4]
push ecx
mov ecx, eax
call fcn.00669467
mov bl, al
lea ecx, [ebp - 0x48]
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
call fcn.00408e36
inc bl
jne 0x69f10b
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x69f10b
push str.GetConsoleCommandHistory
lea ecx, [ebp - 0x48]
mov dword [edi + 8], esi
call fcn.00408c6d
lea eax, [ebp - 0x48]
mov dword [ebp - 4], 1
push eax
lea ecx, [edi + 4]
call fcn.0067ec0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
mov dword [edi + 0x20], eax
call fcn.00408e36
cmp dword [edi + 0x20], 0
je 0x69f10b
push str.GetConsoleCommandHistoryLength
lea ecx, [ebp - 0x68]
call fcn.00408c6d
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 2
push eax
lea ecx, [edi + 4]
call fcn.0067ec0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [edi + 0x24], eax
call fcn.00408e36
cmp dword [edi + 0x24], 0
je 0x69f10b
lea esi, [edi + 0xc]
mov ecx, edi
push esi
call fcn.0069f24a
mov ecx, esi
mov dword [edi + 0x10], eax
call fcn.0040a03c
test eax, eax
je 0x69f10b
lea eax, [ebp - 0x28]
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x69f10b
mov esi, dword [ebp - 0x22]
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
inc esi
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x70]
dec si
push eax
mov word [ebp - 0x6a], si
lea eax, [ebp - 0x74]
push dword [ebp - 0x6c]
push 4
push eax
push dword [edi + 8]
call ebx
test eax, eax
je 0x69f10b
push 4
lea eax, [ebp - 0x74]
push eax
push 0x7e53a0
call fcn.0069fb16
add esp, 0xc
test eax, eax
jne 0x69f08f
movsx ecx, word [ebp - 0x22]
movsx edx, word [ebp - 0x16]
movsx eax, si
sub ecx, eax
movsx eax, word [ebp - 0x24]
imul edx, ecx
mov dword [edi + 0x1c], ecx
add edx, eax
mov dword [edi + 0x18], edx
test edx, edx
jle 0x69f107
push edx
lea ecx, [edi + 0x14]
call fcn.0066db0b
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x6c]
lea ecx, [edi + 0x14]
push dword [edi + 0x18]
call fcn.0066385d
push eax
push dword [edi + 8]
call ebx
test eax, eax
je 0x69f10b
mov al, 1
jmp 0x69f10d
xor al, al
call fcn.00645f45
ret
Function at 0x6a74b1
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x84
mov eax, 0x7b6832
call fcn.00645f63
mov edi, ecx
mov dword [ebp - 0x18], edi
and byte [edi + 0x144], 0xfe
call fcn.006addfa
xor ebx, ebx
test al, al
push 4
pop ecx
cmovne ebx, ecx
call fcn.006add9b
test al, al
je 0x6a74e7
or ebx, 8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
mov ecx, 0x8000
test cx, ax
je 0x6a74fe
or ebx, 1
push 4
call esi
mov ecx, 0x8000
test cx, ax
je 0x6a750f
or ebx, 0x10
push 2
call esi
mov ecx, 0x8000
test cx, ax
je 0x6a7520
or ebx, 2
lea eax, [ebp - 0x14]
push eax
call fcn.006ad8ec
pop ecx
mov ecx, edi
call fcn.004093a0
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0069b954
mov esi, eax
lea edi, [ebp - 0x28]
pop ecx
pop ecx
mov ecx, 0x9dd5b0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x10], eax
call fcn.006a5d1e
lea ecx, [ebp - 0x90]
push dword [eax]
call fcn.006b866b
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x90]
and dword [ebp - 4], 0
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push eax
call fcn.006a9adb
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x90]
push eax
call fcn.006a3215
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.006a5c15
call fcn.00645f31
ret
Function at 0x6ad18b
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor eax, eax
movzx ecx, dx
cmp dword [eax*8 + 0x7e5c90], ecx
je 0x6ad32f
inc eax
cmp eax, 0x4d
jb 0x6ad196
push esi
cmp ecx, 0x27
jg 0x6ad255
je 0x6ad249
push 0xd
mov eax, ecx
pop esi
sub eax, esi
je 0x6ad232
sub eax, 0x14
je 0x6ad216
dec eax
je 0x6ad20a
dec eax
je 0x6ad1fe
dec eax
je 0x6ad1f2
dec eax
je 0x6ad1e6
dec eax
jne 0x6ad309
push 0x13b
push 0x179
jmp 0x6ad220
push 0x13a
push 0x178
jmp 0x6ad220
push 0x139
push 0x177
jmp 0x6ad220
push 0x138
push 0x17e
jmp 0x6ad220
push 0x16f
push 0x17d
jmp 0x6ad220
push 0x16e
push 0x17c
push dword [ebp + 0xc]
call fcn.006a6071
add esp, 0xc
mov ecx, eax
jmp 0x6ad32a
mov eax, dword [ebp + 0xc]
mov ecx, esi
shr eax, 0x10
test eax, 0x100
mov eax, 0x172
cmovne ecx, eax
jmp 0x6ad28e
push 0x13c
push 0x17a
jmp 0x6ad220
cmp ecx, 0xc0
jg 0x6ad2bf
cmp ecx, 0xba
jge 0x6ad2d7
mov eax, ecx
sub eax, 0x28
je 0x6ad2b0
sub eax, 5
je 0x6ad2a1
dec eax
jne 0x6ad309
push 0x7f
pop esi
push esi
push 0x181
push dword [ebp + 0xc]
call fcn.006a6071
add esp, 0xc
mov ecx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6ad32a
mov word [eax], si
jmp 0x6ad32a
push 0x142
push 0x180
jmp 0x6ad220
push 0x13d
push 0x17b
jmp 0x6ad220
cmp ecx, 0xdb
jl 0x6ad309
cmp ecx, 0xdf
jle 0x6ad2d7
cmp ecx, 0xe2
jne 0x6ad309
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, eax
mov edx, 0x8000
shr eax, 0x10
test dx, ax
push 0
pop eax
cmovne ecx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6ad2fd
mov word [eax], cx
cmp ecx, 0xff
jle 0x6ad32a
xor ecx, ecx
jmp 0x6ad32a
cmp dx, 0x30
jb 0x6ad315
cmp dx, 0x39
jbe 0x6ad320
lea eax, [edx - 0x41]
cmp ax, 0x19
jbe 0x6ad320
xor ecx, ecx
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x6ad32a
mov word [eax], dx
mov eax, ecx
pop esi
pop ebp
ret
mov eax, dword [eax*8 + 0x7e5c94]
cmp eax, 0x12c
jge 0x6ad347
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x6ad347
mov word [ecx], ax
pop ebp
ret
Function at 0x6ad377
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ebx
cmp dword [eax*8 + 0x7e5c94], esi
je 0x6ad442
inc eax
cmp eax, 0x4d
jb 0x6ad383
mov eax, 0x177
cmp esi, eax
jg 0x6ad414
je 0x6ad3cf
add eax, 0xffffffc5
cmp esi, eax
jg 0x6ad3e5
je 0x6ad3df
mov eax, esi
sub eax, 0x7f
je 0x6ad3d9
sub eax, 0xb9
je 0x6ad3d3
dec eax
je 0x6ad3cd
dec eax
je 0x6ad3c7
dec eax
jne case.0x6ad41f.383
mov bl, 1
push 0x26
jmp 0x6ad405
mov bl, 1
push 0x25
jmp 0x6ad405
mov bl, 1
push 0x24
jmp 0x6ad405
mov bl, 1
push 0x23
jmp 0x6ad405
mov bl, 1
push 0x2e
jmp 0x6ad405
mov bl, 1
push 0x27
jmp 0x6ad405
mov eax, esi
sub eax, 0x13d
je 0x6ad40e
sub eax, 5
je 0x6ad408
sub eax, 0x2c
je 0x6ad401
dec eax
jne case.0x6ad41f.383
mov bl, 1
push 0x22
jmp 0x6ad405
mov bl, 1
push 0x21
pop eax
jmp 0x6ad437
mov bl, 1
push 0x2d
jmp 0x6ad405
mov bl, 1
push 0x28
jmp 0x6ad405
lea eax, [esi - 0x178]
cmp eax, 9
ja case.0x6ad41f.383
jmp dword [eax*4 + 0x6ad457]
push esi
call dword [sym.imp.USER32.dll_VkKeyScanW]
cmp al, 0xff
movzx eax, al
jne 0x6ad437
movzx eax, si
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x6ad453
mov byte [ecx], bl
jmp 0x6ad453
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x6ad44b
mov byte [ecx], bl
mov ax, word [eax*8 + 0x7e5c90]
pop esi
pop ebx
pop ebp
ret

Function at 0x6adda4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
inc edi
cmp si, di
je 0x6addba
cmp si, 2
jne 0x6addd1
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x6addd1
xor eax, eax
cmp si, di
sete al
lea esi, [eax + 1]
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x6adf70
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x6adf96
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x6ade03
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x9dc8c8], eax
pop ebp
ret
mov eax, dword [0x9dc8c8]
test eax, eax
je 0x6adfa6
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop ebp
ret
Function at 0x7334c8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
mov eax, dword [0x9d8c80]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x2b8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0x2b4
push 0
push eax
call fcn.00646d30
mov eax, dword [ebp + 0x14]
add esp, 0xc
or eax, 0x1010
mov ecx, esi
push eax
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0x10
call fcn.00669d63
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
jne 0x73353b
push 0x9dc5a0
mov ecx, edi
call fcn.006a4fde
jmp 0x733552
push ebx
push dword [ebp - 0x2b4]
lea eax, [ebp - 0x2ac]
push eax
push edi
call fcn.00733565
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00645ebf
mov esp, ebp
pop ebp
ret
Function at 0x740b20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x1505
add eax, esi
mov ecx, eax
sub ecx, esi
push edi
xor edi, edi
cmp esi, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x740b69
mov al, byte [esi]
push eax
call fcn.0074e970
movsx ecx, al
lea esi, [esi + 1]
mov eax, ebx
inc edi
shl eax, 5
add esp, 4
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp edi, dword [ebp + 8]
jb 0x740b47
pop edi
pop esi
movzx eax, bl
pop ebx
pop ebp
ret