joyce8/EMBER2024-capa huggingface dataset:
Function at 0x696ea8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2c1], 0
je 0x696f8e
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c0], 1
xor eax, eax
push ebp
push 0x696f68
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov dl, 5
call fcn.005fd338
push 5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
call fcn.0060753c
push eax
call fcn.0078e322
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c1], 0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2d0]
mov eax, dword [ebp - 4]
call fcn.005fd734
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 0x2b8]
call fcn.006fd504
test al, al
je 0x696f50
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.006fe3d4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.006027f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x696f6f
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c0], 0
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x6bdb1c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.006bdbe4
test eax, eax
je 0x6bdb6e
mov edi, dword [ebx + 8]
test edi, edi
je 0x6bdb4a
test edi, edi
je 0x6bdb4a
mov edx, esi
mov eax, edi
call fcn.005fe210
jmp 0x6bdb7c
push 0x100
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.006bdbe4
push eax
call fcn.0078e14e
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004a718c
jmp 0x6bdb7c
mov ecx, esi
mov edx, 0x6bdb9c
mov eax, ebx
call fcn.006bdaa4
lea eax, [ebx + 0x1c]
mov edx, dword [esi]
call fcn.004a73e4
add esp, 0x200
pop edi
pop esi
pop ebx
ret

Function at 0x6eb3e8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.004a7004
push 0
movzx eax, bl
push eax
call fcn.0078e1d2
shl eax, 0x10
mov ebx, eax
test ebx, ebx
je 0x6eb43a
push 0x100
lea eax, [esp + 4]
push eax
push ebx
call fcn.0078e076
test eax, eax
je 0x6eb433
mov eax, esi
mov edx, esp
mov ecx, 0x100
call fcn.004a7ef4
jmp 0x6eb43a
mov eax, esi
call fcn.004a7004
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x6f0fa8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6f1107
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x7a8c78], 0
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call fcn.0078e08e
mov dl, 1
mov eax, dword [0x5ce708]
call fcn.005cf854
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x6f10dd
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.005cf9ac
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.004a7ef4
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x6f1120
call fcn.004a80a4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.005cfc38
test al, al
je 0x6f10c7
lea ecx, [ebp - 4]
mov edx, 0x6f1194
mov eax, dword [ebp - 0xc]
call fcn.005d04c8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.004ca204
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6f10c7
xor edx, edx
push ebp
push 0x6f10c0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x6f11ac
mov eax, dword [ebp - 8]
push eax
call fcn.004b18f4
test eax, eax
je 0x6f10a9
mov ebx, eax
call ebx
mov ebx, eax
test ebx, ebx
je 0x6f10a9
call fcn.006f0f34
test eax, eax
je 0x6f1099
mov eax, dword [ebx + 0x50]
jmp 0x6f109c
mov eax, dword [ebx + 0x28]
and eax, 1
cmp eax, 1
sete byte [0x7a8c78]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f10c7
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6f10e4
mov eax, dword [ebp - 0xc]
call fcn.004a52a4
ret

Function at 0x6f1210
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x6f1257
push 0x10
call fcn.0078e07c
test ax, ax
jge 0x6f123a
add bx, 0x2000
push 0x11
call fcn.0078e07c
test ax, ax
jge 0x6f124b
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x6f1257
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x6fcc18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call fcn.0078e13c
mov edi, eax
test bl, bl
je 0x6fcc39
test edi, 0x40000
je 0x6fcc53
test bl, bl
jne 0x6fccd4
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x6fccd4
push esi
call fcn.0078e184
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call fcn.0078e19c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x6fcc86
push 0
push esi
call fcn.0078e322
test bl, bl
je 0x6fcc9b
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call fcn.0078e2ec
jmp 0x6fccaa
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call fcn.0078e2ec
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x6fccbb
cmp byte [esp + 2], 0
je 0x6fccd4
cmp byte [esp + 2], 0
je 0x6fcccc
push 6
push esi
call fcn.0078e322
jmp 0x6fccd4
push 5
push esi
call fcn.0078e322
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x6fcf78
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call fcn.0078e00a
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x6fcf9e
mov eax, esp
push eax
push 0x6fcf40
call fcn.0078dfec
jmp 0x6fcfb1
mov eax, esp
push eax
push 0x6fcf20
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
call fcn.0078dfe6
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x6fd074
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x6fd0c4]
test bl, 4
je 0x6fd088
or si, 1
test bl, 8
je 0x6fd091
or si, 4
test bl, 1
je 0x6fd09a
or si, 8
test bl, 2
je 0x6fd0a3
or si, 0x10
test bl, 0x10
je 0x6fd0ac
or si, 0x20
push 0x12
call fcn.0078e07c
test ax, ax
jge 0x6fd0bc
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x6fd0c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x6fd104]
push 0x10
call fcn.0078e07c
test ax, ax
jge 0x6fd0e3
or bx, 1
push 0x11
call fcn.0078e07c
test ax, ax
jge 0x6fd0f3
or bx, 4
test esi, 0x20000000
je 0x6fd0ff
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x706790
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x7067a2
add esp, 0xfffffff0
call fcn.004a592c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00567f68
mov eax, dword [0x7b7b20]
mov dword [eax + 4], ebx
mov dword [eax], 0x706c5c
mov eax, dword [0x7b7b24]
mov dword [eax + 4], ebx
mov dword [eax], 0x706c68
mov eax, ebx
call fcn.00706c74
push 0
call fcn.0078e082
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0x64], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0x68], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0x84], eax
push 0
call fcn.0078e040
mov esi, eax
push 0x5a
push esi
call fcn.0078dd2c
mov dword [ebx + 0x50], eax
push esi
push 0
call fcn.0078e256
mov eax, dword [ebx + 0x68]
push eax
mov eax, 0x70118c
push eax
push 0
push 0
call fcn.0078dfe0
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov dword [ebx + 0x94], eax
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov dword [ebx + 0x98], eax
mov eax, ebx
call fcn.00707250
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x707080
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x707080
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x707080
mov eax, dword [ebx + 0x94]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x707080
mov eax, dword [ebx + 0x98]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x707080
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x706922
call fcn.004a5984
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x706e20
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x706fcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x706fac
mov dl, 1
mov eax, dword [0x52e708]
call fcn.0055778c
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.004a7004
lea eax, [ebp - 0x114]
push eax
push 0x40
call fcn.0078e088
dec eax
test eax, eax
jl 0x706f9b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0060ddfc
test al, al
je 0x706f8e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x706fdc
lea eax, [ebp - 0x394]
call fcn.004c1918
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
test eax, eax
jne 0x706f8e
xor eax, eax
push ebp
push 0x706f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x70704c
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExW
test eax, eax
jne 0x706f70
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.004a7ef4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x706f70
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, 0x100
call fcn.004a7ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x706f8e
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x706e91
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.005576b4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x706fd2
lea eax, [ebp - 0x3a0]
call fcn.004a7004
ret

Function at 0x707bd8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x7c06bc]
cmp byte [eax + 0xc5], 0
jne 0x707c4a
cmp dword [0x7c06e0], 0
jne 0x707c0a
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x7a8c98]
push eax
push 3
call fcn.0078e30a
mov dword [0x7c06e0], eax
cmp dword [0x7c06dc], 0
jne 0x707c25
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x7c06dc], eax
cmp dword [0x7c06e4], 0
jne 0x707c4a
push esp
push 0
push 0
mov eax, dword [0x7a8da0]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x7c06e4], eax
pop edx
ret
Function at 0x70806c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x708083
add esp, 0xfffffff0
call fcn.004a592c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00567f68
mov eax, dword [0x7b7924]
cmp byte [eax], 0
jne 0x7080b0
push 0
call fcn.0078e3b4
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x7b7b28]
cmp word [eax + 2], 0
jne 0x7080ca
mov eax, dword [0x7b7b28]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0070a504
mov eax, dword [0x7b7b2c]
cmp word [eax + 2], 0
jne 0x7080e4
mov eax, dword [0x7b7b2c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0070a708
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x5da048]
call fcn.005e0578
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x70ac80
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x5dede4]
call fcn.005ea834
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x7082d4
mov eax, dword [0x7b7978]
mov eax, dword [eax]
push eax
call fcn.0078e1ba
mov edx, eax
mov eax, esi
call fcn.005ead50
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x70af68
mov dl, 1
mov eax, dword [0x52ad4c]
call fcn.004a5274
mov dword [ebx + 0xb0], eax
push 0x100
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x7b7978]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004c1718
test eax, eax
je 0x7081fe
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.004c1570
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004c16fc
test eax, eax
je 0x708216
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call fcn.0078deea
push eax
call fcn.0078dee4
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.004a7ef4
push ebx
push 0x709ee4
call fcn.006fd058
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x7b7924]
cmp byte [eax], 0
jne 0x708267
mov eax, ebx
call fcn.0070849c
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.0070b1a0
mov eax, ebx
call fcn.0070be28
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x7082cb
call fcn.004a5984
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7087c8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x70886a
cmp dword [ebx + 0xac], 0
jne 0x708864
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x708708
call fcn.0078dfec
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x708864
push 3
mov eax, dword [esp + 4]
push eax
call fcn.0078e12a
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call fcn.0078e13c
test al, 8
je 0x70882a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x708864
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.005527fc
push eax
call fcn.0078e2f8
dec esi
cmp esi, 0xffffffff
jne 0x708839
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x708b10
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x7c06bc]
cmp dword [eax + 0x188], 0
je 0x708c79
test bl, bl
jne 0x708bcc
cmp dword [esi + 0xb4], 0
jne 0x708bc1
mov eax, esi
call fcn.0070bc78
push eax
push 0x708a10
call fcn.0078dfec
cmp dword [esi + 0x58], 0
je 0x708b92
mov eax, dword [0x7c06bc]
cmp byte [eax + 0xeb], 0
je 0x708b92
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x708b73
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x708b92
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.0078e322
dec edi
cmp edi, 0xffffffff
jne 0x708b7b
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x708bc1
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.005527fc
push eax
call fcn.0078e316
dec edi
cmp edi, 0xffffffff
jne 0x708ba1
inc dword [esi + 0xb4]
jmp 0x708c79
cmp dword [esi + 0xb4], 0
jle 0x708c79
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x708c79
cmp dword [esi + 0x58], 0
je 0x708c2e
mov eax, dword [0x7c06bc]
cmp byte [eax + 0xeb], 0
je 0x708c2e
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x708c0f
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x708c2e
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call fcn.0078e322
dec edi
cmp edi, 0xffffffff
jne 0x708c17
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x708c5d
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.005527fc
push eax
call fcn.0078e316
dec edi
cmp edi, 0xffffffff
jne 0x708c3d
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x6f9588]
call fcn.004a97f4
pop edi
pop esi
pop ebx
ret
Function at 0x709a00
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x709a5d
cmp byte [ebx + 0xeb], 0
jne 0x709a5d
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call fcn.0078e14e
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004a718c
mov eax, dword [esi]
test eax, eax
je 0x709a4a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x709a6a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004a73e4
jmp 0x709a6a
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.004a73e4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x70b3b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x70b425
mov eax, esi
call fcn.00607910
test al, al
je 0x70b425
mov eax, dword [ebx + 0x98]
call fcn.0060753c
push eax
call fcn.0078e19c
test eax, eax
je 0x70b425
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x70b416
push 0
mov eax, dword [ebx + 0x98]
call fcn.0060753c
push eax
call fcn.0078e322
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.005fe114
jmp 0x70b425
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.0070b1c0
pop esi
pop ebx
ret
Function at 0x71b0f8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x71b22f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x71b157
lea edx, [ebp - 0x100c]
mov eax, dword [sym.a1runscanner.exe__Lbconst__sASNKeyBadKey]
call fcn.004ac908
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x4b8bd4]
call fcn.004c6fc4
call fcn.004a67d4
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x71b1af
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x71b184
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x71b1aa
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x71b197
inc esi
add ecx, esi
jmp 0x71b1b9
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x71b1ef
lea edx, [ebp - 0x1010]
mov eax, dword [sym.a1runscanner.exe__Lbconst__sASNKeyBadKey]
call fcn.004ac908
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x4b8bd4]
call fcn.004c6fc4
call fcn.004a67d4
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.004a3cf8
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.004a3cf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71b236
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.004a7064
ret

Function at 0x71cf98
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp + 0x11]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebp, ecx
lea eax, [esp + 4]
call fcn.0071c820
lea eax, [esp + 0x11]
call fcn.0071c820
mov ecx, ebp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0071c8f4
mov eax, ebp
xor ecx, ecx
mov edx, 1
call fcn.0071c9c4
mov ecx, esp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0071c8b0
mov edi, dword [esp]
test edi, edi
jle 0x71d028
mov esi, 1
lea eax, [esp + 4]
mov edx, esi
call fcn.0071c77c
mov ebx, eax
lea eax, [esp + 0x11]
mov edx, esi
call fcn.0071c77c
xor bl, al
mov eax, ebp
mov ecx, ebx
mov edx, esi
call fcn.0071c9c4
inc esi
dec edi
jne 0x71cfff
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x721264
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.004a4a64
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x7213e5
mov edi, 1
xor esi, esi
jmp 0x721326
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x7212aa
cmp edi, dword [esp + 8]
jg 0x7213cb
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x721381
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x7213c3
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + sym.a1runscanner.exe__Lbbytes_TLbBase64_Lb64Table]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x721281
add esp, 0x78
pop edi
pop esi
pop ebx
ret