joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9436cc
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409208
xor eax, eax
push ebp
push 0x9438c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00424624
test al, al
jne 0x943711
mov eax, edi
mov edx, 0x9438e0
call fcn.00409504
jmp 0x9438ad
push 0
push 0
push 0
push 0x943908
call sub.gdi32.dll_CreateDCW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
push 0x4f
call sub.user32.dll_GetSystemMetrics
push eax
push 0x4e
call sub.user32.dll_GetSystemMetrics
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dl, 1
mov eax, dword [0x47ac7c]
call fcn.00483d3c
mov dword [ebp - 0x14], eax
push 0x4e
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0x4f
call sub.user32.dll_GetSystemMetrics
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x40cc0020
push 0x4d
call sub.user32.dll_GetSystemMetrics
push eax
push 0x4c
call sub.user32.dll_GetSystemMetrics
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0048465c
call fcn.0047ed34
push eax
call sub.gdi32.dll_BitBlt
mov eax, edi
mov edx, 0x943924
call fcn.00409504
xor eax, eax
push ebp
push 0x943883
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0xa40a94]
mov eax, dword [eax]
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x16], ax
mov eax, dword [0xa40a94]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00545d2c
mov eax, dword [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.0093f380
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xac], ebx
mov dword [eax + 0xa8], 0x9434e8
mov dl, 1
mov eax, dword [0x4798ac]
call fcn.0048121c
mov esi, eax
mov eax, esi
call fcn.00481324
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebx + 0x38]
mov edx, esi
call fcn.00940b84
mov eax, dword [ebx + 0x38]
mov dl, 1
call fcn.0093f04c
mov edx, edi
mov eax, dword [ebx + 0x38]
call fcn.0093fde0
mov eax, esi
call fcn.00407470
mov eax, dword [0xa40a94]
mov eax, dword [eax]
movzx edx, word [ebp - 0x16]
call fcn.00545d2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x94388a
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x9438ca
lea eax, [ebp - 4]
call fcn.00409124
ret
Function at 0x943a18
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
call fcn.00409208
xor eax, eax
push ebp
push 0x943c27
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [ebp + 0xc]
call fcn.00424624
test al, al
jne 0x943a60
mov eax, edi
mov edx, 0x943c44
call fcn.00409504
jmp 0x943c11
mov eax, dword [0xa40a94]
mov eax, dword [eax]
movzx eax, word [eax + 0x4c]
mov word [ebp - 0x16], ax
mov eax, dword [0xa40a94]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.00545d2c
push 0
push 0
push 0
push 0x943c6c
call sub.gdi32.dll_CreateDCW
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
push 0x4f
call sub.user32.dll_GetSystemMetrics
push eax
push 0x4e
call sub.user32.dll_GetSystemMetrics
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov dl, 1
mov eax, dword [0x47ac7c]
call fcn.00483d3c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0044cc54
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
sub edx, esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 0x38]
push 0x40cc0020
mov eax, dword [ebp - 0x24]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.0048465c
call fcn.0047ed34
push eax
call sub.gdi32.dll_BitBlt
mov eax, edi
mov edx, 0x943c88
call fcn.00409504
xor eax, eax
push ebp
push 0x943bd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x38]
mov edx, dword [ebp + 0xc]
call fcn.0093f380
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xac], ebx
mov dword [eax + 0xa8], 0x9434e8
mov dl, 1
mov eax, dword [0x4798ac]
call fcn.0048121c
mov esi, eax
movzx eax, word [ebx + 0x48]
push eax
push dword [ebx + 0x44]
push dword [ebx + 0x40]
mov eax, esi
call fcn.00481324
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.00943480
mov eax, dword [ebx + 0x38]
mov edx, esi
call fcn.00940b84
mov eax, dword [ebx + 0x38]
mov dl, 1
call fcn.0093f04c
mov edx, edi
mov eax, dword [ebx + 0x38]
call fcn.0093fde0
mov eax, esi
call fcn.00407470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x943bde
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x943c2e
lea eax, [ebp + 0xc]
call fcn.00409124
ret
Function at 0x94ae44
Capabilities:
Check for time delay via gettickcount
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov byte [ebp - 5], cl
mov word [ebp - 2], dx
mov word [ebp - 4], ax
mov esi, 3
mov edi, 0xa3f67c
movzx eax, byte [edi]
cmp al, 7
ja 0x94ae73
and eax, 0x7f
movzx edx, byte [ebp - 2]
bt edx, eax
jae 0x94ae8f
push 0
push 0
push 0
movzx ebx, byte [edi + 1]
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
push eax
push ebx
call sub.user32.dll_keybd_event
add edi, 2
dec esi
jne 0x94ae62
cmp byte [ebp - 5], 0
je 0x94aea4
mov dword [ebp - 0xc], 1
jmp 0x94aea9
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
movzx eax, word [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyW
push eax
movzx eax, byte [ebp - 4]
push eax
call sub.user32.dll_keybd_event
cmp dword [ebp + 0xc], 0
jle 0x94af62
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x10], eax
jmp 0x94af32
xor eax, eax
push ebp
push 0x94aefe
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x94af08
cmp byte [ebp + 8], 0
je 0x94af2b
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
movzx eax, word [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyW
push eax
movzx eax, byte [ebp - 4]
push eax
call sub.user32.dll_keybd_event
push 1
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, dword [ebp + 0xc]
cdq
cmp edx, dword [esp + 4]
jne 0x94af51
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x94af62
jmp 0x94af55
pop edx
pop eax
jle 0x94af62
cmp byte [0xa4a778], 0
je 0x94aeda
or dword [ebp - 0xc], 2
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0
movzx eax, word [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyW
push eax
movzx eax, byte [ebp - 4]
push eax
call sub.user32.dll_keybd_event
mov esi, 0xfffffffd
mov edi, 0xa3f680
movzx eax, byte [edi]
cmp al, 7
ja 0x94af9e
and eax, 0x7f
movzx edx, byte [ebp - 2]
bt edx, eax
jae 0x94afba
push 0
push 2
push 0
movzx ebx, byte [edi + 1]
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyW
push eax
push ebx
call sub.user32.dll_keybd_event
sub edi, 2
inc esi
jne 0x94af8d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x94b8b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov eax, ebx
call fcn.0040a278
mov ebx, eax
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004057e8
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
jne 0x94b921
mov dword [ebp - 4], 0xffffffff
call sub.KERNEL32.DLL_GetLastError
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
jmp 0x94b961
cmp byte [ebp + 0x10], 0
je 0x94b934
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.user32.dll_WaitForInputIdle
jmp 0x94b942
cmp byte [ebp + 8], 0
je 0x94b942
mov eax, dword [ebp - 0x58]
call fcn.0094b844
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x94f4a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x94f66e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0xa4a778], 0
jne 0x94f64b
cmp dword [0xa4a630], 0x14
jg 0x94f64b
inc dword [0xa4a630]
lea eax, [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040954c
lea eax, [ebp - 4]
mov edx, dword [ebx + 0xc]
call fcn.0040954c
mov dl, 1
mov eax, dword [0x4446a4]
call fcn.004531b0
mov dword [ebp - 0x14], eax
push 0x94f67c
push 0x94f67c
push 0x94f67c
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x20]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov eax, dword [ebx + 0x68]
push eax
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [0xa4a62c]
call fcn.0097977c
mov eax, dword [ebx + 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x94f615
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 0x94f67c
push 0x94f680
push 0x94f67c
mov eax, dword [ebx + 0x50]
push eax
push 0
mov eax, dword [ebx + 0x28]
push eax
mov eax, dword [ebx + 0x1c]
push eax
mov eax, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x38]
push eax
push dword [ebx + 0x44]
push dword [ebx + 0x40]
push 0
push 0
push 0
mov eax, dword [ebx + 0x24]
push eax
mov eax, dword [ebx + 0x20]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov eax, dword [ebx + 0x68]
push eax
push 1
mov eax, dword [ebx + 0x60]
mov eax, dword [eax]
push eax
mov eax, dword [ebx + 0x14]
push eax
mov eax, dword [ebx + 0x58]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [0xa4a62c]
call fcn.0097977c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x94f61f
mov eax, dword [ebp - 0x14]
call fcn.00407470
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x38]
mov ecx, dword [ebp - 0x1c]
mov dword [edx], ecx
mov edx, dword [eax + 0x28]
cmp dword [edx], 1
jne 0x94f645
mov ebx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x44]
call dword [ebx + 0x40]
dec dword [0xa4a630]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x94f675
lea eax, [ebp - 0x20]
call fcn.00409124
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x9558e4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x955994
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00409124
push 0x9559a4
call sub.user32.dll_RegisterClipboardFormatW
mov ebx, eax
mov eax, dword [0xa403fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x955986
movzx edi, bx
push edi
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x955981
push edi
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x955981
xor eax, eax
push ebp
push 0x95597a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.0040a2b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x955981
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x95599b
ret
Function at 0x955e48
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x9560ae
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
call fcn.0042c770
xor edx, edx
push ebp
push 0x956079
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.00955b68
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0xfde9
call fcn.00409d88
lea eax, [ebp - 0x1c]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00409d88
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
call fcn.0040a350
push 0x9560bc
call sub.user32.dll_RegisterClipboardFormatW
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xd
call sub.user32.dll_EmptyClipboard
call fcn.0042c770
cmp dword [ebp - 4], 0
je 0x955f9c
mov esi, dword [ebp - 4]
mov eax, esi
test eax, eax
je 0x955eec
sub eax, 4
mov eax, dword [eax]
inc eax
add eax, eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x955f68
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
setne al
neg al
sbb eax, eax
call fcn.0042c770
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
test ebx, ebx
setne al
neg al
sbb eax, eax
call fcn.0042c770
test esi, esi
je 0x955f3d
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebp - 4]
call fcn.0040a278
inc esi
mov ecx, esi
add ecx, ecx
mov edx, ebx
call fcn.00404b78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x955f6f
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
cmp dword [ebp - 8], 0
je 0x956061
mov esi, dword [ebp - 8]
mov eax, esi
test eax, eax
je 0x955fb4
sub eax, 4
mov eax, dword [eax]
inc eax
add eax, eax
push eax
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x95602d
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0xc], 0
setne al
neg al
sbb eax, eax
call fcn.0042c770
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
test ebx, ebx
setne al
neg al
sbb eax, eax
call fcn.0042c770
mov eax, esi
test eax, eax
je 0x956007
sub eax, 4
mov eax, dword [eax]
inc eax
mov ecx, eax
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.00404b78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x956034
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GlobalUnlock
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x956080
call sub.user32.dll_CloseClipboard
call fcn.0042c770
ret
Function at 0x95e694
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x26
push 0
push 0
dec ecx
jne 0x95e69d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp + 0x18]
xor eax, eax
push ebp
push 0x95f4a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409124
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
jle 0x95f466
mov dword [ebp - 0x5c], eax
mov ebx, 1

Function at 0x95f9a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x95fa3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00425904
mov ebx, eax
lea eax, [ebp - 8]
push eax
push esi
mov eax, dword [0xa403fc]
mov eax, dword [eax]
mov eax, dword [eax + 0x178]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
push ebx
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x95fa03
mov eax, edi
mov edx, ebx
call fcn.0040a2e0
lea eax, [ebp - 4]
call fcn.0040d1b4
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov eax, ebx
call fcn.00425954
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x95fa42
lea eax, [ebp - 4]
call fcn.0040d1b4
ret

Function at 0x96aed8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x96afb8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x47c], 0
je 0x96af9d
call sub.KERNEL32.DLL_GetCommandLineW
mov edx, eax
lea eax, [ebp - 4]
call fcn.0040a2e0
mov edx, dword [ebp - 4]
mov eax, 0x96afd4
call fcn.0040a860
test eax, eax
jg 0x96af41
lea eax, [ebp - 8]
mov edx, dword [0xa4a7b4]
call fcn.0040a350
mov edx, dword [ebp - 8]
mov eax, 0x96afd4
call fcn.0040a860
test eax, eax
jle 0x96af94
movzx eax, word [0x96aff4]
push eax
push 0
push 0x96b004
push dword [esi]
push 0x96b038
push 0x96b048
push 0x96b058
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.0040a56c
mov edx, dword [ebp - 0xc]
mov cl, 2
mov eax, ebx
call fcn.0099a0d4
cmp eax, 6
jne 0x96af94
mov byte [0xa4a778], 1
jmp 0x96af9d
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
cmp byte [ebx + 0x47c], 0
jne 0x96af88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x96afbf
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00409184
ret
Function at 0x97c078
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x97c15e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0xa4a794], ecx
movzx eax, byte [esi + 0x470]
mov byte [0xa4a798], al
mov eax, dword [esi + 0x474]
mov dword [0xa4a79c], eax
mov eax, dword [esi + 0x478]
mov dword [0xa4a7a0], eax
mov dl, 1
mov eax, dword [0x4446a4]
call fcn.004531b0
mov dword [ebp - 4], eax
mov edx, edi
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
push eax
push 0x97be08
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, 2
jle 0x97c136
xor eax, eax
push ebp
push 0x97c128
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 2
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0098ff4c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x97c138
xor ebx, ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebp - 4]
call fcn.00407470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x97c165
lea eax, [ebp - 8]
call fcn.00409124
ret
Function at 0x97d268
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
test esi, esi
jbe 0x97d344
mov eax, 0x3c
call fcn.004048f0
mov ebx, eax
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
cmp byte [ebp + 0x10], 0
je 0x97d2ae
mov eax, 0x97d350
mov dword [ebx + 0xc], eax
mov eax, esi
call fcn.0040a278
mov dword [ebx + 0x10], eax
test edi, edi
jbe 0x97d2c8
mov eax, edi
call fcn.0040a278
mov dword [ebx + 0x14], eax
jmp 0x97d2cd
xor eax, eax
mov dword [ebx + 0x14], eax
cmp dword [ebp + 0x14], 0
jbe 0x97d2e0
mov eax, dword [ebp + 0x14]
call fcn.0040a278
mov dword [ebx + 0x18], eax
jmp 0x97d2e5
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x20], eax
push ebx
call sub.shell32.dll_ShellExecuteExW
cmp byte [ebp + 8], 0
je 0x97d338
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
lea eax, [ebp - 8]
push eax
mov eax, dword [ebx + 0x38]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
cmp dword [ebp - 8], 0x103
jne 0x97d338
mov eax, dword [0xa403fc]
mov eax, dword [eax]
cmp byte [eax + 0xa8], 0
jne 0x97d338
cmp byte [0xa4a778], 0
je 0x97d2fd
mov edx, 0x3c
mov eax, ebx
call fcn.0040490c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 0x10

Function at 0x97d35c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
jmp 0x97d3aa
xor eax, eax
push ebp
push 0x97d399
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0xa403fc]
mov eax, dword [eax]
call fcn.00548840
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x97d3a3
push 1
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
cdq
cmp edx, dword [esp + 4]
jne 0x97d3c9
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x97d3e4
jmp 0x97d3cd
pop edx
pop eax
jle 0x97d3e4
cmp byte [0xa4a778], 0
jne 0x97d3e4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp byte [eax + 0x230], 0
je 0x97d375
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x982a64
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x982b35
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
movzx eax, bx
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x982b50
call fcn.00425ad0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 0x494], 0
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyW
push eax
push 0x12
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 4]
test eax, eax
je 0x982acc
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x982afd
mov esi, 1
push 0
push 0
mov eax, dword [ebp - 4]
movzx eax, word [eax + esi*2 - 2]
add ax, 0x60
sub ax, 0x30
xor ecx, ecx
movzx edx, word [0x982b5c]
call fcn.0094ae44
inc esi
dec ebx
jne 0x982ad7
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyW
push eax
push 0x12
call sub.user32.dll_keybd_event
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 0x494], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x982b3c
lea eax, [ebp - 4]
call fcn.00409124
ret