joyce8/EMBER2024-capa huggingface dataset:
Function at 0x644560
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x644659
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0
je 0x64462e
lea eax, [ebp - 4]
push eax
mov eax, 0x644674
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x64469c
call fcn.00428468
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040afa0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
call fcn.0063ae28
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x644627
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0063c1cc
test eax, eax
jle 0x644611
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0063c994
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 4]
call fcn.0040a6f0
lea ecx, [ebp - 0x1c]
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0063c994
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 8]
call fcn.0040a6f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64462e
mov eax, dword [ebp - 8]
call fcn.00408650
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644660
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a370
lea eax, [ebp - 0x14]
call fcn.0040a334
lea eax, [ebp - 4]
call fcn.0040a310
ret
Function at 0x6446fc
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x64486e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0xc], 0
je 0x644843
lea eax, [ebp - 4]
push eax
mov eax, 0x644888
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0x11
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x6448b0
call fcn.00428468
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.0040afa0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xc]
call fcn.0063ae28
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x64483c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0063c1cc
test eax, eax
jne 0x6447d5
lea eax, [ebp - 4]
push eax
mov eax, 0x644888
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 2
mov eax, 0x6448fc
call fcn.00428468
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 4]
mov ecx, 0xfde9
call fcn.0040afa0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx + 0xc]
call fcn.0063a328
jmp 0x644826
lea eax, [ebp - 4]
push eax
mov eax, 0x644888
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, dword [ebx + 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 2
mov eax, 0x644978
call fcn.00428468
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 4]
mov ecx, 0xfde9
call fcn.0040afa0
mov edx, dword [ebp - 0x34]
mov eax, dword [ebx + 0xc]
call fcn.0063a328
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644843
mov eax, dword [ebp - 8]
call fcn.00408650
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x644875
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.0040a3a0
lea eax, [ebp - 0x14]
call fcn.0040a334
lea eax, [ebp - 4]
call fcn.0040a310
ret
Function at 0x64755c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
cmp dword [0x9974b4], 0
je 0x64758d
mov eax, dword [0x9974b4]
cmp byte [eax + 0x3d], 0
je 0x647582
mov eax, dword [0x9974b4]
call fcn.00647618
mov eax, dword [0x9974b4]
mov dword [ebx + 0xd8], eax
cmp dword [ebx + 0x38], 0
je 0x647612
xor eax, eax
push ebp
push 0x647608
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xd0], eax
xor edx, edx
mov eax, ebx
call fcn.006474a4
mov byte [ebx + 0xb5], 0
mov dword [0x9974b4], ebx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x647a9c
push 7
call sub.user32.dll_SetWindowsHookExW
mov dword [0x9974ac], eax
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x64776c
push 2
call sub.user32.dll_SetWindowsHookExW
mov dword [0x9974a8], eax
mov dl, 1
mov eax, ebx
call fcn.006489cc
mov byte [ebx + 0x3d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x647612
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x64e5d8
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x64e606
mov eax, ebx
call fcn.0064f094
cmp dword [ebx + 0x40], 0
je 0x64e5ff
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x64e677
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x64e669
cmp dword [ebx + 8], 0
je 0x64e628
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x64e63a
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x64e669
cmp dword [ebx + 8], 0
je 0x64e61b
cmp eax, 3
je 0x64e64d
dec eax
jne 0x64e61b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x64e61b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x64e61b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x64e695
cmp dword [ebx + 0x14], 0xcc
je 0x64e695
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0064e6a0
pop ebx
ret

Function at 0x664810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x997974], 0
jne 0x664827
call fcn.006647cc
mov eax, edi
dec eax
test eax, eax
jl 0x66484f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x997574]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x664831
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x66750c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x6675a6.0
jmp dword [ecx*4 + 0x66753f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x667571
sub dl, 8
je 0x667580
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6671d8
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x66722c
jmp case.0x6675a6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x6675a6.0
movzx ecx, byte [ecx + 0x6675ad]
jmp dword [ecx*4 + 0x6675be]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6672cc
jmp case.0x6675a6.0
cmp dl, 3
jne 0x6675eb
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x667324
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6672e0
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x667368
jmp case.0x6675a6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x667616
sub dl, 8
je 0x667622
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x667394
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6673f8
jmp case.0x6675a6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x667641
sub dl, 8
je 0x66764d
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6674a8
jmp case.0x6675a6.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x6674d0
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x6676ef
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00666714
test eax, eax
je 0x6676ef
mov eax, ebx
call fcn.006676f8
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x667688
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x6676f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x667729
dec al
je 0x667764
dec al
je 0x6677a9
dec al
je 0x667812
jmp 0x66789c
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x66789c
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x667739
jmp 0x66789c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x66789c
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x667774
jmp 0x66789c
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x66789c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x6677d8
xor ebp, ebp
jmp 0x6677e8
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x6677f1
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x6677b9
jmp 0x66789c
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x66789c
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x66786b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00664858
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x667826
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6e8930
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x6e8a83
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x12]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.006e831c
lea ecx, [ebp - 0xc]
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.006e7648
mov eax, dword [edi + 0x60]
mov edx, esi
call fcn.006e7690
mov byte [ebp - 0x11], al
movzx eax, byte [ebp - 0x12]
mov byte [ebx + 0xc], al
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.0040a6f0
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 0x10]
call fcn.0040b4d0
movzx eax, byte [esi + 0x20]
mov byte [ebx + 0x30], al
mov eax, ebx
call fcn.007b2518
mov edx, dword [ebp - 0xc]
call fcn.0050d038
mov eax, ebx
call fcn.007b2518
movzx edx, byte [ebp - 0x11]
call fcn.0050d1ac
mov eax, ebx
call fcn.007b2518
movzx edx, byte [esi + 0x18]
call fcn.0050d0dc
mov eax, ebx
call fcn.007b2518
mov edx, dword [esi + 0x1c]
call fcn.0050cd10
mov eax, ebx
call fcn.007b2518
mov edx, dword [esi + 0x24]
call fcn.0050d0b0
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x3c]
call fcn.007baa70
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x40]
call fcn.007baa70
add eax, dword [ebx + 0x24]
mov dword [ebx + 0x2c], eax
cmp dword [esi + 0x44], 0xfffffc18
je 0x6e8a33
mov eax, dword [edi + 0x48]
mov edx, dword [esi + 0x44]
call fcn.007baa70
sub eax, dword [ebx + 0x24]
mov dword [ebx + 0x28], eax
jmp 0x6e8a38
xor eax, eax
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x3c], eax
cmp byte [esi + 0x2a], 0
je 0x6e8a50
movzx eax, byte [0x6e8a94]
not eax
and byte [ebx + 0x38], al
cmp byte [esi + 0x29], 0
je 0x6e8a60
movzx eax, byte [0x6e8a98]
or byte [ebx + 0x38], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e8a8a
lea eax, [ebp - 0x10]
call fcn.0040a358
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a370
ret
Function at 0x6fb700
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov ebx, edx
mov esi, eax
mov dword [ebx], 1
mov edx, esp
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x60]
push esi
lea esi, [esp + 4]
lea edi, [ebx + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov eax, dword [esi + 0x3b8]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x3bc]
sub dword [ebx + 0x14], eax
mov eax, esi
call fcn.006f6518
mov edx, eax
mov eax, dword [esi + 0x4a0]
mov eax, dword [eax + 0x8c]
call fcn.007b0944
mov edi, eax
mov edx, dword [edi + 0x20]
mov eax, dword [esi + 0x4a0]
call fcn.007ba73c
add dword [ebx + 0xc], eax
mov edx, dword [edi + 0x24]
mov eax, dword [esi + 0x4a0]
call fcn.007ba73c
sub dword [ebx + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esi + 0x4b8]
call fcn.006aaf38
mov eax, dword [esp + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 4]
jle 0x6fb79e
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 8]
jle 0x6fb7a9
mov dword [ebx + 8], eax
push 0
call sub.user32.dll_GetKeyboardLayout
and eax, 0xffff
cmp eax, 0x412
jne 0x6fb7db
mov dword [ebx], 2
mov eax, dword [ebx + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
push 1
push 0
lea eax, [ebx + 0xc]
push eax
call sub.user32.dll_OffsetRect
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x712a50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 4]
call fcn.00764ca8
test al, al
Function at 0x73bd1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef0
mov esi, eax
movzx ebx, word [0x73bdec]
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x18], 0x80
je 0x73bd43
or bx, 1
test byte [esp + 0x19], 0x80
je 0x73bd4e
or bx, 4
test byte [esp + 0x1a], 0x80
je 0x73bd59
or bx, 2
test byte [esp + 9], 0x80
je 0x73bd64
or bx, 8
test byte [esp + 0xa], 0x80
je 0x73bd6f
or bx, 0x10
test byte [esp + 0xc], 0x80
je 0x73bd7a
or bx, 0x20
push esp
call sub.user32.dll_GetCursorPos
lea ecx, [esp + 0x108]
mov edx, esp
mov eax, esi
call fcn.005fdd88
mov eax, dword [esp + 0x108]
mov dword [esp], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 4], eax
mov edi, dword [esp]
test edi, edi
jl 0x73bde1
mov eax, esi
call fcn.005fdb44
cmp edi, eax
jge 0x73bde1
cmp dword [esp + 4], 0
jl 0x73bde1
mov eax, esi
call fcn.005fdb84
cmp eax, dword [esp + 4]
jle 0x73bde1
mov eax, dword [esp + 4]
push eax
mov ecx, dword [esp + 4]
mov edx, ebx
mov eax, esi
mov si, 0xffd4
call fcn.0040899c
add esp, 0x110
pop edi
pop esi
pop ebx
ret
Function at 0x7ad424
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov byte [ebp - 6], dl
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x7ad5ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
test byte [eax - 0xc], 1
setne al
mov edx, dword [ebp + 8]
test byte [edx - 0xc], 2
setne bl
mov edx, dword [ebp + 8]
movzx ecx, byte [ebp - 5]
cmp cl, 0x2f
ja 0x7ad470
and ecx, 0x7f
bt word [edx - 0xe], cx
setb dl
mov byte [ebp - 7], dl
mov edx, dword [ebp + 8]
test byte [edx - 0xd], 0x80
setne dl
mov byte [ebp - 8], dl
mov edx, dword [ebp + 8]
movzx ecx, byte [ebp - 6]
cmp cl, 0x2f
ja 0x7ad497
and ecx, 0x7f
bt word [edx - 0xe], cx
setb dl
mov byte [ebp - 9], dl
or al, bl
jne 0x7ad4b9
cmp byte [ebp - 7], 0
jne 0x7ad4b9
cmp byte [ebp - 8], 0
jne 0x7ad4b9
mov eax, esi
call fcn.0040a334
jmp 0x7ad5d9
movzx eax, byte [ebp - 5]
sub al, 0x13
je 0x7ad4cf
dec al
je 0x7ad4de
dec al
je 0x7ad4ed
dec al
je 0x7ad4fc
jmp 0x7ad50b
lea eax, [ebp - 4]
mov edx, 0x7ad60c
call fcn.0040a7dc
jmp 0x7ad513
lea eax, [ebp - 4]
mov edx, 0x7ad620
call fcn.0040a7dc
jmp 0x7ad513
lea eax, [ebp - 4]
mov edx, 0x7ad630
call fcn.0040a7dc
jmp 0x7ad513
lea eax, [ebp - 4]
mov edx, 0x7ad644
call fcn.0040a7dc
jmp 0x7ad513
lea eax, [ebp - 4]
call fcn.0040a334
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x38]
test eax, eax
jne 0x7ad539
movzx eax, byte [ebp - 8]
push eax
push esi
movzx ecx, byte [ebp - 7]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.007ad114
jmp 0x7ad5d9
movzx edx, byte [ebp - 5]
sub dl, 0x13
je 0x7ad550
dec dl
je 0x7ad566
dec dl
je 0x7ad57c
dec dl
je 0x7ad592
jmp 0x7ad5a8
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 5]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0xc]
mov byte [ebp - 0xb], 0
jmp 0x7ad5b2
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 4]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 8]
mov byte [ebp - 0xb], 0
jmp 0x7ad5b2
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 6]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x10]
mov byte [ebp - 0xb], 1
jmp 0x7ad5b2
mov edx, dword [eax + 0x14]
movzx edx, byte [edx + 7]
mov byte [ebp - 0xa], dl
mov eax, dword [eax + 0x18]
mov edi, dword [eax + 0x14]
mov byte [ebp - 0xb], 1
jmp 0x7ad5b2
mov byte [ebp - 0xa], 0
xor edi, edi
mov byte [ebp - 0xb], 0
mov eax, dword [ebp + 8]
push eax
push edi
push ebx
movzx eax, byte [ebp - 7]
push eax
movzx eax, byte [ebp - 8]
push eax
movzx eax, byte [ebp - 9]
push eax
push esi
movzx ecx, byte [ebp - 0xb]
movzx edx, byte [ebp - 0xa]
mov eax, dword [ebp - 4]
call fcn.007ad210
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ad5f6
lea eax, [ebp - 4]
call fcn.0040a334
ret
Function at 0x7b1f90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xffffffec
push 0x7b1ff8
push 0x7b2018
mov word [esp + 8], 0x6f
mov word [esp + 0xa], 0x4f
mov word [esp + 0xc], 0
mov word [esp + 0xe], 0x25ef
mov word [esp + 0x10], 0x25e6
mov word [esp + 0x12], 0x25cb
mov word [esp + 0x14], 0x2b2d
mov word [esp + 0x16], 0x2b2f
mov word [esp + 0x18], 0x2b55
mov word [esp + 0x1a], 0x2b58
lea edx, [esp + 8]
mov ecx, 9
call fcn.007b1c0c
add esp, 0x14
ret
Function at 0x7e3558
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
push esi
call sub.user32.dll_IsIconic
test eax, eax
je 0x7e3571
push 9
push esi
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
jne 0x7e3581
mov bl, 1
jmp 0x7e366e
mov eax, dword [0x991350]
cmp dword [eax], 2
jne 0x7e3595
mov eax, dword [0x990814]
cmp dword [eax], 4
jg 0x7e35c9
mov eax, dword [0x991350]
cmp dword [eax], 1
jne 0x7e3658
mov eax, dword [0x990814]
cmp dword [eax], 4
jg 0x7e35c9
mov eax, dword [0x990814]
cmp dword [eax], 4
jne 0x7e3658
mov eax, dword [0x990efc]
cmp dword [eax], 0
jle 0x7e3658
xor ebx, ebx
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0
push esi
call sub.user32.dll_GetWindowThreadProcessId
mov ebp, eax
push 0xffffffffffffffff
push edi
push ebp
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x7e3610
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 0
push edi
push ebp
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
test bl, bl
jne 0x7e3664
push 0
lea eax, [esp + 4]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [esp + 4]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x7e3664
push esi
call sub.user32.dll_BringWindowToTop
push esi
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp esi, eax
sete bl
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x7e3750
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a3f4
xor eax, eax
push ebp
push 0x7e37ee
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00406978
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004279a0
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x7e3808
call fcn.0040b644
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00427598
test al, al
je 0x7e37d3
push 5
push 0x7e3828
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.007e3678
mov eax, dword [ebp - 0x14]
call fcn.0040b3d8
push eax
mov eax, dword [ebp - 8]
call fcn.0040b3d8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7e37f5
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040a370
ret