joyce8/EMBER2024-capa huggingface dataset:
Function at 0x697f58
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00462958
test al, al
je 0x6980f8
mov eax, dword [ebp - 4]
mov byte [eax + 0x255], 1
mov eax, dword [ebp - 4]
call fcn.00462654
push eax
call sub.user32.dll_HideCaret
xor eax, eax
push ebp
push 0x6980e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00462654
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6980c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x69809d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
inc eax
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x69807f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
mov ebx, eax
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x14
mov eax, dword [ebp - 4]
call fcn.00462654
push eax
call sub.user32.dll_SendMessageA
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0xf
mov eax, dword [ebp - 4]
call fcn.00462654
push eax
call sub.user32.dll_SendMessageA
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_BitBlt
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x698086
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6a1c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x60]
sub edx, dword [eax + 0x48]
mov dword [esp], edx
call sub.KERNEL32.DLL_GetTickCount
mov edx, dword [ebx + 0x38]
sub eax, dword [edx + 4]
cmp eax, 0x320
jbe 0x6a1cee
call sub.KERNEL32.DLL_GetTickCount
mov esi, dword [ebx + 0x38]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 0x40]
sub eax, dword [esi + 0x20]
sar eax, 1
jns 0x6a1c56
adc eax, 0
mov dword [esp + 4], eax
inc dword [esi + 0x14]
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x14]
mov ecx, dword [eax + 0x10]
dec ecx
cmp edx, ecx
jle 0x6a1c70
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x278]
mov edx, dword [ebx + 0x10]
call fcn.00433cd4
mov ebp, eax
dec ebp
test ebp, ebp
jl 0x6a1cee
inc ebp
xor edi, edi
mov eax, dword [ebx + 0x38]
mov esi, dword [eax + 0x1c]
mov eax, esi
imul edi
add eax, esi
cmp eax, dword [esp]
jle 0x6a1cea
mov eax, dword [esp + 4]
push eax
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov eax, dword [esp + 0x14]
inc eax
imul ecx, eax
mov eax, esi
imul dword [esp + 0x14]
xor edx, edx
call fcn.0041ce0c
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x1c]
imul ecx, edi
mov eax, dword [ebx + 0x38]
mov eax, dword [eax + 0xc]
mov edx, dword [ebx + 0x28]
call fcn.005a49d4
inc edi
dec ebp
jne 0x6a1c95
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6a9ec4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x6a9f1e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.006a9eb8
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.006a7e58
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.006a7a34
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a9f25
lea eax, [ebp - 4]
call fcn.00404e30
ret
Function at 0x6b03fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, dword [0x70f918]
xor eax, eax
push ebp
push 0x6b0530
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x70f510]
mov eax, dword [eax]
cmp byte [eax + 0x31abc], 0
jne 0x6b0508
lea eax, [ebp - 0xc]
push eax
add ebx, 0x64
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x6b0548
call fcn.0040b918
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x50]
lea eax, [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 4]
call fcn.0040a7b4
test al, al
je 0x6b0508
mov ebx, 0xb
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
mov edx, 0x6b0558
call fcn.004b6540
dec ebx
jne 0x6b047e
lea edx, [ebp - 0x18]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x6b0558
call fcn.0040514c
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x1c]
call fcn.00405300
push eax
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
mov eax, dword [ebp - 8]
call fcn.00405300
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push esi
push 0x6b0568
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x2710
mov eax, dword [esi + 0x4de8]
call fcn.004b3f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b0537
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404e54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e54
ret
Function at 0x6b61ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
mov edi, dword [0x70f918]
xor eax, eax
push ebp
push 0x6b6360
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x70f510]
mov eax, dword [eax]
cmp byte [eax + 0x31ac0], 0
jne 0x6b632a
lea ecx, [ebp - 0x109]
mov edx, ebx
mov eax, dword [esi + 0x4a4]
call fcn.004e7a7c
test al, al
je 0x6b632a
mov al, byte [ebp - 0xc2]
push eax
mov al, byte [ebp - 0xbe]
push eax
mov eax, dword [0x70efb8]
mov eax, dword [eax]
mov cl, byte [ebp - 0xe3]
mov dl, byte [ebp - 0xe4]
call fcn.004c5ea4
mov ebx, eax
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x118], ebx
mov byte [ebp - 0x114], 0
lea edx, [ebp - 0x118]
xor ecx, ecx
mov eax, 0x6b6378
call fcn.0040b918
mov ecx, dword [ebp - 0x110]
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x54]
lea eax, [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 4]
call fcn.0040a7b4
test al, al
je 0x6b632a
mov ebx, 0x29
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
mov edx, 0x6b638c
call fcn.004b6540
dec ebx
jne 0x6b6294
lea edx, [ebp - 0x11c]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 8]
mov ecx, 0x6b638c
call fcn.0040514c
push 1
lea edx, [ebp - 0x120]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x120]
call fcn.00405300
push eax
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
mov eax, dword [ebp - 8]
call fcn.00405300
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push esi
push 0x6b0568
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x2710
mov eax, dword [esi + 0x4de8]
call fcn.004b3f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b6367
lea eax, [ebp - 0x120]
mov edx, 2
call fcn.00404e54
lea eax, [ebp - 0x110]
call fcn.00404e30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x6b639c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, dword [0x70f918]
xor eax, eax
push ebp
push 0x6b64cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x70f510]
mov eax, dword [eax]
cmp byte [eax + 0x31ac1], 0
jne 0x6b64a5
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x6b64e4
call fcn.0040b918
mov ecx, dword [ebp - 0xc]
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x54]
lea eax, [ebp - 4]
call fcn.0040514c
mov eax, dword [ebp - 4]
call fcn.0040a7b4
test al, al
je 0x6b64a5
mov ebx, 0x29
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
mov edx, 0x6b64fc
call fcn.004b6540
dec ebx
jne 0x6b641b
lea edx, [ebp - 0x18]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x6b64fc
call fcn.0040514c
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x1c]
call fcn.00405300
push eax
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
mov eax, dword [ebp - 8]
call fcn.00405300
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push esi
push 0x6b0568
push 0
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, 0x2710
mov eax, dword [esi + 0x4de8]
call fcn.004b3f04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b64d4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404e54
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404e54
ret
Function at 0x6b673c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
xor eax, eax
push ebp
push 0x6b6936
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
xor edx, edx
call fcn.0040a34c
mov ebx, eax
cmp ebx, 1
jl 0x6b690b
cmp ebx, 0x63
jg 0x6b690b
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6b694c
call fcn.0040b918
mov eax, ebx
sub eax, 4
je 0x6b67c3
sub eax, 2
jne 0x6b6812
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31974]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x6b6968
call fcn.0040b918
jmp 0x6b68d1
cmp ebx, 0xd
jne 0x6b6857
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31970]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6b6990
call fcn.0040b918
jmp 0x6b68d1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31974]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x80]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov eax, dword [eax]
call fcn.004b5608
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
movzx eax, word [eax + 0xa4]
add ebx, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], 0
lea edx, [ebp - 0x54]
mov ecx, 3
mov eax, 0x6b69b4
call fcn.0040b918
push 1
lea edx, [ebp - 0x58]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x58]
call fcn.00405300
push eax
mov eax, dword [ebp - 8]
call fcn.00405300
push eax
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b693d
lea eax, [ebp - 0x58]
call fcn.00404e30
lea eax, [ebp - 0x1c]
call fcn.00404e30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x6b9f84
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 8
call fcn.004035f8
mov eax, edi
call fcn.0040a7b4
test al, al
je 0x6ba091
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.00405300
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x6ba091
mov eax, esi
call fcn.00402bf8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6ba08a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6ba02f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, edi
call fcn.00405300
push eax
call sub.version.dll_GetFileVersionInfoA
call fcn.00410470
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x6ba098
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
call fcn.00410470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ba045
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebx], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 8]
mov word [ebx + 2], ax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebx + 4], ax
mov eax, dword [ebp - 0xc]
mov ax, word [eax + 0xc]
mov word [ebx + 6], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ba091
mov eax, dword [ebp - 8]
call fcn.00402c28
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x6bad10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x6bad48]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6bad26
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6bad35
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x6bad44
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x6c2510
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
xor eax, eax
push ebp
push 0x6c270a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edx
xor edx, edx
call fcn.0040a34c
mov ebx, eax
cmp ebx, 1
jl 0x6c26df
cmp ebx, 0x63
jg 0x6c26df
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6c2720
call fcn.0040b918
mov eax, ebx
sub eax, 4
je 0x6c2597
sub eax, 2
jne 0x6c25e6
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31974]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x6c273c
call fcn.0040b918
jmp 0x6c26a5
cmp ebx, 0xd
jne 0x6c262b
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31970]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x18]
mov ecx, 1
mov eax, 0x6c2764
call fcn.0040b918
jmp 0x6c26a5
lea eax, [ebp - 8]
push eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x3196c]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov eax, dword [eax + 0x31974]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x80]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov eax, dword [eax]
call fcn.004b5608
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [0x70f510]
mov eax, dword [eax]
movzx eax, word [eax + 0xa4]
add ebx, eax
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x38], 0
lea edx, [ebp - 0x54]
mov ecx, 3
mov eax, 0x6c2788
call fcn.0040b918
push 1
lea edx, [ebp - 0x58]
mov eax, dword [0x70f918]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c]
mov eax, dword [eax]
call fcn.004b4860
mov eax, dword [ebp - 0x58]
call fcn.00405300
push eax
mov eax, dword [ebp - 8]
call fcn.00405300
push eax
mov eax, dword [ebp - 4]
call fcn.00405300
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c2711
lea eax, [ebp - 0x58]
call fcn.00404e30
lea eax, [ebp - 0x1c]
call fcn.00404e30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404e54
ret
Function at 0x6f3554
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [0x70f510]
mov eax, dword [eax]
cmp byte [eax + 0x31abe], 0
jne 0x6f35e1
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebx + 0x44]
cmp eax, 0xbb8
jb 0x6f35e1
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebx + 0x44], eax
mov eax, dword [0x70f63c]
mov eax, dword [eax]
mov ebx, dword [eax + 0x44]
mov esi, 5
mov edx, dword [ebx + 0x44]
sub edx, 5
mov eax, ebx
call fcn.0045b46c
push 0x14
call sub.KERNEL32.DLL_Sleep_1
mov edx, dword [ebx + 0x40]
sub edx, 5
mov eax, ebx
call fcn.0045b448
push 0x14
call sub.KERNEL32.DLL_Sleep_1
mov edx, dword [ebx + 0x44]
add edx, 5
mov eax, ebx
call fcn.0045b46c
push 0x14
call sub.KERNEL32.DLL_Sleep_1
mov edx, dword [ebx + 0x40]
add edx, 5
mov eax, ebx
call fcn.0045b448
push 0x14
call sub.KERNEL32.DLL_Sleep_1
dec esi
jne 0x6f358e
pop esi
pop ebx
ret
Function at 0x6f44fc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, eax
mov eax, dword [esi + 0x30]
call fcn.006ef494
mov ebx, eax
cmp dword [ebx + 0x48c], 0
je 0x6f4586
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esi + 0x48]
cmp eax, 0xea60
jb 0x6f4586
call sub.KERNEL32.DLL_GetTickCount
mov dword [esi + 0x48], eax
cmp byte [esi + 0x40], 0
jne 0x6f455b
mov ecx, esp
mov eax, dword [0x70f510]
mov eax, dword [eax]
mov edx, dword [eax + 0x3196c]
mov eax, dword [ebx + 0x4a4]
call fcn.004e7e88
test al, al
je 0x6f455b
mov al, byte [esp + 0x45]
mov byte [esi + 0x40], al
mov eax, dword [ebx + 0x4e00]
call fcn.006d2b5c
mov eax, dword [ebx + 0x4a0]
call fcn.00535864
mov eax, dword [0x70f63c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, dword [ebx + 0x48c]
call fcn.006c2af4
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x1014e694
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x10156924]
add ebx, 0xffffe881
mov dword [0x10156928], ebx
mov dword [0x1015692c], 0
mov dword [0x10156930], 0
mov dword [0x1015693c], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1014e810
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x10156924], 0x1751
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1015692c], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10156930], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10156934], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10156934]
mov edx, dword [0x10156930]
mov byte [edi + edx], cl
mov edx, dword [0x1015692c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10156930]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x10156928], 0x26fd
and ebx, 0xff
mov dword [0x1015693c], ebx
mov dword [0x10156924], 0x267e
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x10156941]
mov byte [0x10156940], dl
mov byte [0x10156941], ch
mov byte [0x10156942], cl
mov dword [0x10156928], 0x1b66
xor ch, cl
mov dword [0x10156924], 0x1174
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x1014e810
mov eax, dword [0x1015692c]
mov ecx, dword [0x10156930]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x1014e6ff
mov dword [0x10156928], 0x13b3
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret