joyce8/EMBER2024-capa huggingface dataset:
Function at 0x625c5d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
push edi
mov edi, dword [esp + 0x74]
mov ebx, ecx
mov dword [esp + 0x18], ebx
test edi, edi
je 0x625e80
fld1
fst dword [esp + 0x14]
fld qword [0x74f9b8]
fst qword [esp + 0x64]
fld qword [0x6fe928]
fstp qword [esp + 0x24]
fld qword [0x74f9e8]
fstp qword [esp + 0x2c]
fld qword [0x74f9f0]
fstp qword [esp + 0x34]
fldz
fstp dword [esp + 8]
fld qword [0x74f9f8]
fst qword [esp + 0x1c]
fld qword [0x74fa18]
fstp qword [esp + 0x4c]
fld qword [0x74f9c0]
fstp qword [esp + 0x54]
fld qword [0x74f9b0]
push ebp
mov ebp, dword [esp + 0x74]
fstp qword [esp + 0x60]
push esi
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x18], esi
lea eax, [esi + 1]
mov dword [ebx + 0xc], eax
cmp esi, 0x56220
jb 0x625cf2
xor ecx, ecx
jmp 0x625e68
fxch st(2)
fstp dword [esp + 0x7c]
cmp esi, 0x35d54
jae 0x625d43
mov dword [esp + 0x7c], esi
fstp st(1)
fild dword [esp + 0x7c]
test esi, esi
jns 0x625d14
fadd dword [0x6fefd8]
fstp dword [esp + 0x7c]
fmul dword [esp + 0x7c]
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
call fcn.006a5ea0
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
fld qword [esp + 0x2c]
fmul st(1), st(0)
fsubrp st(1)
fstp dword [esp + 0x7c]
fld qword [esp + 0x24]
jmp 0x625d45
fstp st(0)
fld dword [esp + 0x7c]
lea esi, [ebx + 0x54]
fst qword [esp + 0x4c]
fld st(0)
xor ebx, ebx
fmul qword [esp + 0x34]
fsubr qword [esp + 0x3c]
fstp dword [esp + 0x14]
fld dword [esp + 0x10]
fstp dword [esp + 0x7c]
jmp 0x625d6c
fxch st(1)
fld dword [ebx + 0x74f808]
fld dword [ebx + 0x74f7c0]
fsub st(1)
fmulp st(2)
faddp st(1)
fadd dword [esi]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fst dword [esi]
fst qword [esp + 0x44]
fmulp st(1)
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
call fcn.006a5ea0
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul dword [esp + 0x14]
fadd qword [esp + 0x44]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
call fcn.006a5ea0
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
add ebx, 4
fadd dword [esp + 0x7c]
add esi, 4
fstp dword [esp + 0x7c]
fld qword [esp + 0x4c]
fld qword [esp + 0x24]
cmp ebx, 0x48
jl 0x625d6a
mov esi, dword [esp + 0x18]
fstp st(1)
fstp st(0)
fld dword [esp + 0x7c]
fmul qword [esp + 0x54]
fstp dword [esp + 0x7c]
cmp esi, 0x2b11
jae 0x625e19
mov dword [esp + 0x78], esi
fild dword [esp + 0x78]
test esi, esi
jns 0x625e0b
fadd dword [0x6fefd8]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul qword [esp + 0x5c]
jmp 0x625e44
cmp esi, 0x40998
jbe 0x625e4c
mov eax, 0x56220
sub eax, esi
mov dword [esp + 0x78], eax
fild dword [esp + 0x78]
jns 0x625e38
fadd dword [0x6fefd8]
fstp dword [esp + 0x78]
fld dword [esp + 0x78]
fmul qword [esp + 0x64]
fmul dword [esp + 0x7c]
fstp dword [esp + 0x7c]
fld dword [esp + 0x7c]
call fcn.0068a210
fld dword [esp + 0x1c]
fld qword [esp + 0x6c]
fld qword [esp + 0x24]
mov ebx, dword [esp + 0x20]
movzx ecx, ax
mov word [ebp], cx
lea ebp, [ebp + 2]
sub edi, 1
jne 0x625cd6
fstp st(2)
fstp st(0)
pop esi
fstp st(0)
pop ebp
pop edi
pop ebx
add esp, 0x64
ret 8
Function at 0x6262e3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
cwde
push 0x27
mov dword [ebp - 4], eax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
movsx ebx, ax
jne 0x626357
test byte [ebp - 4], 1
je 0x62632a
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0062629b
test byte [ebp - 8], 1
je 0x62633b
push 0
push 1
mov ecx, edi
call fcn.0062629b
test byte [ebp - 0xc], 1
je 0x62634a
push 1
mov ecx, edi
call fcn.006266ad
test bl, 1
jne 0x626353
test ebx, ebx
jns 0x626357
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x626371
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x626371
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.00626080
pop edi
pop esi
pop ebx
leave
ret

Function at 0x6266ee
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6eaf07
call fcn.006899cc
push ecx
mov eax, dword [0x81d708]
test eax, eax
je 0x62670d
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x62675d
push ebx
push esi
mov ebx, 0x1c8
push ebx
call fcn.0068973d
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x62673f
push ebx
push 0
push esi
call fcn.0068ccc0
add esp, 0xc
mov ecx, esi
call fcn.00625813
mov esi, eax
jmp 0x626741
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0x1e
call fcn.005bcef9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x6274e9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
call fcn.00473a26
push dword [edi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [edi + 0x38], eax
mov eax, dword [edi + 0x48]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x4c]
mov dword [edi + 0x3c], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edx, dword [edi]
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push esi
call dword [edx + 0x24]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [edi + 0x104], 0
je 0x627580
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x62755a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [edi + 4]
jne 0x62755a
xor byte [edi + 0x122], 1
lea ecx, [edi + 0x10c]
call fcn.006262e3
mov eax, dword [edi + 0x124]
cmp eax, dword [edi + 0x108]
je 0x627580
mov ecx, edi
mov dword [edi + 0x108], eax
call fcn.006268ea
pop edi
pop esi
leave
ret 4
Function at 0x6275dc
Capabilities:
Hide graphical window

Disassembly:
jmp 0x6275e1
mov eax, 0x6d6a3f
call fcn.006899cc
push ecx
mov eax, dword [0x81db84]
test eax, eax
je 0x627600
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x627645
push 0x38
call fcn.0068973d
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x62761c
mov ecx, eax
call fcn.0062759b
jmp 0x62761e
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
push 0
push 0x183
mov dword [0x81db84], eax
call fcn.005bcef9
mov eax, dword [0x81db84]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x628c90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x628cbb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x628cb7
mov byte [ebp - 4], 1
test al, 0x10
jne 0x628cbb
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.005bcf4c
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.005bcf4c
pop esi
leave
ret 4

Function at 0x629642
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x6eb1f3
call fcn.006899cc
push ecx
push esi
push 0xe8
call fcn.0068973d
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x629675
push dword [ebp + 0xc]
mov ecx, eax
push dword [ebp + 8]
call fcn.006293c5
mov esi, eax
jmp 0x629677
xor esi, esi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
push 0
push 0xfd
call fcn.005bcef9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 8

Function at 0x629c91
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b8
call section..text
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov eax, dword [esi + 0xc]
cmp dword [eax + 8], 0xfffffffe
je 0x629cb4
cmp dword [eax + 8], 0xfffffffc
jne 0x629d03
add eax, 0xc
push 0x10b8
push eax
lea eax, [ebp - 0x10b8]
push eax
call fcn.0068b600
add esp, 0xc
push 0x5d4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [esi + 0xc]
cmp dword [ecx], eax
jne 0x629d03
cmp dword [ebp - 0x10b4], 0
jne 0x629d03
push 5
xor ecx, ecx
lea eax, [ebp - 0x1048]
push ecx
push ecx
push eax
push 0x6f657c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
leave
ret 4
Function at 0x62a60e
Capabilities:
Delete file

Disassembly:
mov eax, 0x6eb337
call fcn.006899cc
sub esp, 0xd0
push ebx
push esi
lea ecx, [ebp - 0xc4]
call fcn.0062a52f
push 1
xor ebx, ebx
push ebx
push 0x20
mov dword [ebp - 4], ebx
call fcn.005bb8f8
push eax
lea ecx, [ebp - 0xc4]
call fcn.005bd16d
cmp eax, 1
jne 0x62a7cb
cmp dword [ebp - 0x48], ebx
je 0x62a728
push 0x18
call fcn.0068973d
mov esi, eax
pop ecx
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x62a682
lea eax, [ebp - 0x74]
mov dword [esi], ebx
push eax
mov ecx, esi
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call fcn.00448193
jmp 0x62a684
mov esi, ebx
mov byte [ebp - 4], bl
test esi, esi
je 0x62a710
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
jb 0x62a69b
mov eax, dword [ebp - 0x58]
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x62a6a5
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push 0x62a9d3
push eax
push ebx
push ebx
push ecx
call fcn.004e281a
mov esi, eax
test esi, esi
je 0x62a710
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x58]
jb 0x62a6cd
mov ecx, dword [ebp - 0x58]
push ecx
lea eax, [ebp - 0xdc]
push eax
call fcn.0048fcb1
cmp dword [ebp - 0xc8], 0x10
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 2
jb 0x62a6f3
mov eax, dword [ebp - 0xdc]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00413860
mov ecx, esi
call fcn.0047f1f2
lea ecx, [ebp - 0xdc]
call fcn.0040fad0
cmp dword [ebp - 0x44], 8
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], ebx
jb 0x62a7f2
mov eax, dword [ebp - 0x58]
jmp 0x62a7f2
cmp dword [ebp - 0x30], ebx
je 0x62a76b
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
jb 0x62a739
mov eax, dword [ebp - 0x40]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.004b6a24
push ebx
push ebx
push 0x200
push eax
call fcn.004e281a
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
jb 0x62a7f2
mov eax, dword [ebp - 0x40]
jmp 0x62a7f2
cmp dword [ebp - 0x18], ebx
je 0x62a7a7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
jb 0x62a77c
mov eax, dword [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.004b6a24
push ebx
push ebx
push 0x10000
push eax
call fcn.004e281a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
jb 0x62a7f2
mov eax, dword [ebp - 0x28]
jmp 0x62a7f2
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
jb 0x62a7b3
mov eax, dword [ebp - 0x74]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push fcn.004b6a24
push ebx
push ebx
push ebx
push eax
call fcn.004e281a
jmp 0x62a7e3
cmp dword [ebp - 0x64], ebx
je 0x62a7f7
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
jb 0x62a7dc
mov eax, dword [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp - 0x60], 8
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], ebx
jb 0x62a7f2
mov eax, dword [ebp - 0x74]
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0xc4]
call fcn.0062a5ad
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x62c06e
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x210
push ebp
push edi
push dword [esp + 0x21c]
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
lea eax, [esp + 8]
push eax
push dword [esp + 0x220]
push edi
call fcn.005bb40c
mov ecx, dword [esp + 0x220]
test ecx, ecx
jne 0x62c0bd
push 0xfe
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x224]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
xor ebp, ebp
sub eax, dword [esp + 0xc]
push ebp
push dword [0x81bb0c]
push ebp
push edi
push eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
push eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x244]
push dword [esp + 0x24]
or eax, 0x50010000
push eax
push ecx
push 0x6f7d3c
push ebp
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
mov eax, dword [esp + 0x224]
test eax, eax
jne 0x62c11a
push ebp
push ebp
push 0x31
push dword [esp + 0x228]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebp
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, edi
pop edi
pop ebp
add esp, 0x210
ret 0x10

Function at 0x62d3d2
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [eax], ecx
je 0x62d3f0
push 5
push ecx
push ecx
add eax, 0x7c
push eax
push 0x6f657c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret 4
Function at 0x62eb58
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x38]
cmp eax, 1
je fcn.0062cf42
test eax, eax
jne 0x62eb69
inc eax
push 0
push 3
push eax
mov dword [ecx + 0x38], eax
call fcn.0062eb8e
ret 4

Function at 0x62fbf6
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x6eb77b
call fcn.006899cc
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00449a5e
push dword [ebp + 0xc]
xor edi, edi
lea ecx, [esi + 0x18]
mov dword [ebp - 4], edi
call fcn.00449a5e
push dword [ebp + 0x10]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.00449a5e
push 7
pop ecx
xor eax, eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], ecx
mov word [esi + 0x48], ax
mov dword [esi + 0x60], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], ecx
mov word [esi + 0x60], ax
mov dword [esi + 0x78], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x8c], ecx
mov word [esi + 0x78], ax
mov dword [esi + 0x90], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], ecx
mov word [esi + 0x90], ax
mov dword [esi + 0xa8], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], ecx
mov word [esi + 0xa8], ax
mov dword [esi + 0xc0], edi
mov dword [esi + 0xd0], edi
mov dword [esi + 0xd4], ecx
mov word [esi + 0xc0], ax
mov dword [esi + 0xd8], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xec], ecx
mov word [esi + 0xd8], ax
mov dword [esi + 0xf0], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], ecx
mov word [esi + 0xf0], ax
push edi
push edi
mov ecx, esi
mov byte [ebp - 4], 0xa
mov dword [esi + 0x114], edi
call fcn.006c9fa6
push edi
mov ecx, esi
call fcn.006c9f99
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x63095a
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push ebx
push ebx
or dword [esi], 0xffffffff
push 3
push ebx
push 3
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x630987
xor eax, eax
jmp 0x6309bb
push ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push 0xc
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x2d1080
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
je 0x6309ac
mov eax, dword [ebp - 8]
mov dword [esi], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x6337be
Capabilities:
Get process heap flags

Disassembly:
mov eax, 0x6d588e
call fcn.006899cc
push ecx
push esi
push dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00413860
push dword [ebp + 8]
xor eax, eax
lea ecx, [esi + 0x18]
mov dword [ebp - 4], eax
mov dword [ecx], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
call fcn.00448193
mov al, byte [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x30], al
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x63903d
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x460
push esi
push 0
push 2
mov dword [esp + 0x38], 0x22c
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x639138
push edi
lea eax, [esp + 0x34]
push eax
push esi
call sub.KERNEL32.DLL_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x639134
push ebp
mov ebp, dword [esp + 0x474]
add ebp, 0x208
push ebx
lea eax, [esp + 0x60]
push eax
call fcn.00639007
test eax, eax
jne 0x639113
push dword [esp + 0x44]
push eax
push 0x410
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x6390b3
push eax
call edi
jmp 0x639113
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x104
push eax
lea eax, [esp + 0x26c]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_QueryFullProcessImageNameW]
test eax, eax
lea eax, [esp + 0x268]
jne 0x6390e0
lea eax, [esp + 0x60]
push 0x104
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00449524
push 0x28
lea eax, [esp + 0x18]
push eax
push ebx
call sub.KERNEL32.DLL_K32GetProcessMemoryInfo
neg eax
push ebx
sbb eax, eax
and eax, dword [esp + 0x24]
mov dword [ebp], eax
call edi
add ebp, 0x20c
lea eax, [ebp + 4]
cmp eax, dword [esp + 0x474]
jae 0x639132
lea eax, [esp + 0x3c]
push eax
push esi
call sub.KERNEL32.DLL_Process32NextW
test eax, eax
jne 0x639089
pop ebx
pop ebp
push esi
call edi
pop edi
pop esi
add esp, 0x460
ret 8

Function at 0x63ab88
Capabilities:
Capture screenshot

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, 0x158
mov byte [esi + 0x85], 1
mov eax, dword [esi + 0x44]
sub eax, dword [esi + 0x40]
cdq
idiv edi
mov ecx, dword [esi + 0x4c]
dec eax
cmp ecx, eax
jae 0x63abc6
lea eax, [ecx + 1]
mov ecx, esi
mov dword [esi + 0x4c], eax
call fcn.0063a7d6
mov ecx, esi
call fcn.005bcfe2
pop edi
mov ecx, esi
pop esi
jmp fcn.0063b612
pop edi
pop esi
ret
Function at 0x63b612
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [esp + 0x20]
push edi
mov ebx, ecx
push eax
push dword [ebx + 0x50]
call esi
lea eax, [esp + 0x54]
push eax
push dword [ebx + 4]
call esi
lea eax, [esp + 0x54]
push eax
push dword [ebx + 0x50]
call fcn.005c1162
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
push dword [ebx + 0x50]
sub esi, dword [esp + 0x28]
sub edi, dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_GetDC]
cmp dword [ebx + 0x38], 0
mov ebp, eax
jne 0x63b66d
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0x38], eax
push dword [ebx + 0x3c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
push esi
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebx + 0x38]
mov dword [ebx + 0x3c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push ebp
push edi
push esi
xor ebp, ebp
mov dword [esp + 0x28], eax
push ebp
push ebp
push dword [ebx + 0x38]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebx + 0x44]
mov edi, 0x158
mov ecx, dword [ebx + 0x40]
sub eax, ecx
cdq
idiv edi
mov esi, dword [ebx + 0x4c]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebp
cmp eax, esi
jbe 0x63b713
imul eax, esi, 0x158
lea edi, [esp + 0x34]
lea esi, [ecx + 0x54]
add esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x34]
lea esi, [esp + 0x44]
mov eax, dword [esp + 0x3c]
lea edi, [esp + 0x14]
mov edx, dword [esp + 0x38]
sub eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x44], ecx
sub eax, edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x50], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fld dword [0x76684c]
lea esi, [esp + 0x14]
sub esp, 0x10
mov edi, esp
push ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
fstp dword [esp]
push dword [ebx + 0x3c]
push dword [ebx + 0x38]
call fcn.005bde31
push dword [esp + 0x10]
push dword [ebx + 0x38]
call dword [sym.imp.GDI32.dll_SelectObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
Function at 0x64a679
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push dword [esp + 0x14]
mov ebp, ecx
xor bl, bl
push dword [esp + 0x14]
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
jne 0x64a6a1
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor al, al
jmp 0x64a706
push edi
push esi
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
jne 0x64a6b6
xor al, al
jmp 0x64a705
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esp + 0x18], eax
test eax, eax
je 0x64a6fc
push esi
push dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
cmp dword [esp + 0x1c], 0
jne 0x64a6de
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
jmp 0x64a6fa
mov ecx, eax
mov eax, dword [esp + 0x20]
cmp dword [eax], ecx
jl 0x64a6fc
push dword [eax]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call fcn.0068b600
add esp, 0xc
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 0x10

Function at 0x64aa86
Capabilities:
Hide graphical window

Disassembly:
push 0x6b0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x64ab1f
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, ecx
mov eax, dword [edx + 8]
sub eax, 0x6b0
je 0x64ab96
sub eax, 1
je 0x64ab4d
dec eax
sub eax, 1
je 0x64ab4d
sub eax, 0x95
je 0x64ab71
sub eax, 1
je 0x64ab4d
sub eax, 1
je 0x64ab4d
sub eax, 1
jne 0x64abb9
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x64abb9
cmp dword [ecx + 8], 0x701
jne 0x64abb9
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov dword [esi + 0x60], eax
mov eax, dword [ecx + 0x18]
sub eax, dword [ecx + 0x10]
mov dword [esi + 0x64], eax
jmp 0x64abb9
mov eax, dword [edx + 0xc]
test eax, eax
je 0x64abb9
cmp dword [eax + 8], 0xfffffffe
jne 0x64abb9
push 5
xor ecx, ecx
add eax, 0x7c
push ecx
push ecx
push eax
push 0x6f657c
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x64abb9
mov eax, dword [edx + 0xc]
test eax, eax
je 0x64abb9
cmp dword [eax + 8], 0xfffffffe
jne 0x64abb9
xor ecx, ecx
mov dword [esi + 0x5c], 2
push ecx
push ecx
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
ret 4