joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f627c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5f6328
cmp dword [ebx + 0xa8], 0
jne 0x5f6322
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5f61b4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa4]
cmp dword [eax + 8], 0
je 0x5f6322
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5f62e8
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa4]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5f6322
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa4]
call fcn.00503e38
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5f62f7
inc dword [ebx + 0xa8]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5f6548
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x76f5f4]
cmp dword [eax + 0x188], 0
je 0x5f66ad
test bl, bl
jne 0x5f65fb
cmp dword [esi + 0xb0], 0
jne 0x5f65f0
mov eax, esi
call fcn.005f9420
push eax
push 0x5f6454
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5f65c1
mov eax, dword [0x76f5f4]
cmp byte [eax + 0xe7], 0
je 0x5f65c1
mov eax, dword [esi + 0xec]
call fcn.0040bc90
mov edi, eax
cmp edi, 0
jl 0x5f65c1
push 0
mov eax, dword [esi + 0xec]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f65aa
mov eax, dword [esi + 0xac]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f65f0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xac]
call fcn.00503e38
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f65d0
inc dword [esi + 0xb0]
jmp 0x5f66ad
cmp dword [esi + 0xb0], 0
jle 0x5f66ad
dec dword [esi + 0xb0]
cmp dword [esi + 0xb0], 0
jne 0x5f66ad
cmp dword [esi + 0x58], 0
je 0x5f6658
mov eax, dword [0x76f5f4]
cmp byte [eax + 0xe7], 0
je 0x5f6658
mov eax, dword [esi + 0xec]
call fcn.0040bc90
mov edi, eax
cmp edi, 0
jl 0x5f6658
push 5
mov eax, dword [esi + 0xec]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5f6641
mov eax, dword [esi + 0xac]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5f6687
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xac]
call fcn.00503e38
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5f6667
mov eax, dword [esi + 0xac]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xec]
mov ecx, 1
mov edx, dword [0x5e80a0]
call fcn.0040bea4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5f72cc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc0], 0
je 0x5f7329
cmp byte [ebx + 0xe7], 0
jne 0x5f7329
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409a9c
mov eax, dword [esi]
test eax, eax
je 0x5f7316
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5f7336
mov eax, esi
mov edx, dword [ebx + 0xa0]
call fcn.00409cf4
jmp 0x5f7336
mov eax, esi
mov edx, dword [ebx + 0xa0]
call fcn.00409cf4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5f8b64
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5f8bd5
mov eax, esi
call fcn.0056a9f8
test al, al
je 0x5f8bd5
mov eax, dword [ebx + 0x98]
call fcn.0056a620
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f8bd5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5f8bc6
push 0
mov eax, dword [ebx + 0x98]
call fcn.0056a620
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x98]
call fcn.00561670
jmp 0x5f8bd5
mov cl, 1
mov edx, dword [ebx + 0x88]
mov eax, ebx
call fcn.005f8998
pop esi
pop ebx
ret
Function at 0x6024f4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test byte [eax + 8], 1
je 0x60251b
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6026ad
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x60269a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
test byte [eax + 8], 2
je 0x60256a
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_SaveDC
mov esi, eax
test edi, edi
je 0x602560
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov eax, ebx
call edi
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_RestoreDC
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.user32.dll_GetWindowRect
xor eax, eax
mov dword [ebp - 0x14], eax
inc ebp
in al, dx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x602a2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
push ebp
push 0x602ae3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x190
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x602af4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x602acd
mov dword [ebp - 0xc], 0x40
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x602b20
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov esi, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp esi, 2
je 0x602acd
test esi, esi
jne 0x602aa4
cmp dword [ebp - 8], 1
je 0x602aa8
xor ebx, ebx
jmp 0x602acd
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x50]
mov ecx, 0x20
call fcn.0040aa00
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x10]
call fcn.004071fc
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x602acd
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x602aea
lea eax, [ebp - 0x54]
call fcn.00409914
ret
Function at 0x603144
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x6032e8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClientRect
test eax, eax
je 0x6032e8
lea eax, [ebp - 0x20]
call fcn.0040f4ac
test al, al
jne 0x6032e8
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ValidateRect
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x6032e8
xor ecx, ecx
push ebp
push 0x6032e1
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_GetClipBox
test eax, eax
je 0x6032a8
lea ecx, [ebp - 0x30]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x40]
call fcn.0040f3ac
test al, al
je 0x6032a8
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6032a8
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x6032a8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SaveDC
mov ebx, eax
push 0
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SetWindowOrgEx
push 0
mov esi, dword [ebp - 0xc]
push esi
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push 0
push esi
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_RestoreDC
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
sub ecx, eax
push ecx
push edx
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
call fcn.00409094
jmp 0x6032f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6032e8
cmp dword [ebp - 0xc], 0
je 0x6032c4
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x6032d3
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
push 0xffffffffffffffff
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_InvalidateRect
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x603b48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x603c32
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x768a38]
cmp dword [eax], 5
jl 0x603b78
mov eax, dword [0x768fc0]
cmp dword [eax], 2
je 0x603b81
mov byte [ebp - 5], 1
jmp 0x603c1c
mov byte [ebp - 5], 0
push 0x603c50
push ebx
push 0x603ca0
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040ac38
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040a944
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x603c1c
xor edx, edx
push ebp
push 0x603c15
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x603bf3
cmp word [ebp - 0x14], 0
jne 0x603bfa
cmp eax, 0xea
jne 0x603bfe
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603c1c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x603c39
lea eax, [ebp - 4]
call fcn.00409914
ret

Function at 0x604aa4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, eax
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyW
mov ebx, eax
shl ebx, 0x10
test ebx, ebx
je 0x604ae4
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetKeyNameTextW
test eax, eax
jle 0x604ae4
mov eax, esi
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040aa00
jmp 0x604af0
mov eax, esi
mov edx, 0x604b08
call fcn.00409cf4
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x616308
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0056a9f8
test al, al
je 0x61645f
lea edx, [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0056a620
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetUpdateRect
test eax, eax
je 0x616370
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x30]
call fcn.0040f340
test al, al
je 0x616370
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00613364
jmp 0x61645f
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ValidateRect
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x616458
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0
push 0
push 0x85
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push 0
mov ebx, dword [ebp - 0xc]
push ebx
push 0x14
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push 0
push ebx
push 0xf
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61645f
cmp dword [ebp - 0xc], 0
je 0x61643b
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_DeleteDC
cmp dword [ebp - 0x10], 0
je 0x61644a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ReleaseDC
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6611c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
movzx ebx, word [0x6611fc]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6611d8
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6611e8
or bx, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6611f8
or bx, 2
mov eax, ebx
pop ebx
ret
Function at 0x69e48c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x69e5c8
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x69e5a8
push dword fs:[edx]
mov dword fs:[edx], esp
test byte [esi + 0x32f], 0x10
je 0x69e4d2
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, esi
call fcn.006aa1ac
test byte [esi + 0x32f], 1
je 0x69e53b
call fcn.0069c570
call fcn.0058fe68
movzx edx, word [0x76f768]
call fcn.0058fe30
mov ebx, eax
test bl, bl
je 0x69e53d
call fcn.0058fe68
mov edx, dword [eax]
call dword [edx + 0x18]
mov eax, dword [0x76f768]
push eax
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
call sub.kernel32.dll_GlobalSize
mov dword [ebp - 0x18], eax
push edi
call sub.kernel32.dll_GlobalLock
cmp dword [ebp - 0x18], 1
jb 0x69e529
cmp byte [eax], 2
sete bl
push edi
call sub.kernel32.dll_GlobalUnlock
call fcn.0058fe68
mov edx, dword [eax]
call dword [edx + 0x14]
jmp 0x69e53d
xor ebx, ebx
call fcn.0058fe68
mov dx, 1
call fcn.0058fe30
test al, al
je 0x69e584
mov byte [esi + 0x4c1], 1
call fcn.0058fe68
lea edx, [ebp - 4]
call fcn.0058f958
test bl, bl
je 0x69e573
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0069ead0
jmp 0x69e57d
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0069f268
mov byte [esi + 0x4c1], 1
test byte [esi + 0x32f], 0x10
je 0x69e59e
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.006aa0b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x69e5b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x69e5cf
lea eax, [ebp - 4]
call fcn.00409914
ret
Function at 0x6a34d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
movzx ebx, byte [eax + 0x436]
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x6a34fb
mov eax, dword [0x768cec]
mov eax, dword [eax]
call fcn.005f79a4
call sub.kernel32.dll_GetTickCount_1
cmp edi, eax
jle 0x6a3512
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp bl, byte [eax + 0x436]
je 0x6a34ef
mov eax, dword [0x768cec]
mov eax, dword [eax]
call fcn.005f79a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp bl, byte [eax + 0x436]
jne 0x6a36f9
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x438]
cmp eax, 7
ja case.0x6a3541.0
jmp dword [eax*4 + 0x6a3548]
mov esi, 0x190
jmp 0x6a359b
mov esi, 0x12c
jmp 0x6a359b
mov esi, 0xc8
jmp 0x6a359b
mov esi, 0x82
jmp 0x6a359b
mov esi, 0x4e
jmp 0x6a359b
mov esi, 0x30
jmp 0x6a359b
mov esi, 0x1e
jmp 0x6a359b
xor esi, esi
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
add edi, esi
mov esi, dword [0x76f76c]
mov eax, dword [0x76f770]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
movzx eax, byte [eax + 0x436]
dec al
je 0x6a35df
dec al
je 0x6a3603
dec al
je 0x6a3632
dec al
je 0x6a3661
jmp 0x6a36b3
mov word [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x438]
neg eax
lea eax, [eax + eax*2]
mov dword [ebp - 4], eax
jmp 0x6a36b3
mov word [ebp - 0x10], 1
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0056107c
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x438]
lea edx, [edx + edx*2]
add eax, edx
mov dword [ebp - 4], eax
jmp 0x6a36b3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x2c0], 0
jle 0x6a364e
mov word [ebp - 0x10], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x438]
neg eax
lea esi, [eax + eax*2]
jmp 0x6a36b3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0056103c
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x53c]
sub edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp edx, dword [eax + 0x2c0]
jle 0x6a3695
mov word [ebp - 0x10], 1
mov dword [ebp - 0xc], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0056103c
mov esi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x438]
lea eax, [eax + eax*2]
add esi, eax
mov eax, dword [ebp - 0xc]
sub eax, 1
jb 0x6a36bf
je 0x6a36cf
jmp 0x6a36dd
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.006a747c
jmp 0x6a36dd
lea edx, [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.006a76f8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
movzx edx, word [0x6a3714]
mov si, 0xffd3
call fcn.00407eb8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp bl, byte [eax + 0x436]
je 0x6a34fb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b1c9c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x6b1d36
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x6b1cbb
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x6b1d4c
dec edx
je 0x6b1d81
jmp 0x6b1dd2
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x6b1dd2
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6b1e40
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x6b1e5f
add edx, 3
sar edx, 2
test edx, edx
jle 0x6b1f6d
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x6b1e94
je 0x6b1ed7
sub ecx, 0x2b
je 0x6b1ecd
sub ecx, 4
je 0x6b1ed2
dec ecx
sub ecx, 0xa
jb 0x6b1ebf
jmp 0x6b1eda
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x6b1ea6
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x6b1eb1
jmp 0x6b1eda
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x6b1eda
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x6b1eda
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x6b1eda
mov byte [eax], 0x3e
jmp 0x6b1eda
mov byte [eax], 0x3f
jmp 0x6b1eda
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x6b1e77
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x6b1f2b
cmp byte [esp + 7], 0xff
jne 0x6b1f2b
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x6b1f62
cmp dl, 0xff
je 0x6b1f62
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x6b1e6e
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x6b2b3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp word [eax + 0x7a], 0
je 0x6b2b6f
mov eax, dword [ebp + 8]
mov ebx, dword [eax - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea ecx, [eax + 0x84]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, dword [ebx + 0x7c]
call dword [ebx + 0x78]
test al, al
je 0x6b2b9c
push 1
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x84]
call fcn.0040a944
push eax
push 0
mov eax, dword [0x768cec]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.shell32.dll_ShellExecuteW
pop ebx
pop ebp
ret