joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a414c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6a43ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x6a41af
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.006a3c14
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.00410088
cmp al, 1
jne 0x6a41af
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.006a3f2c
test al, al
je 0x6a433b
cmp dword [ebp - 8], 0
jge 0x6a41cd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.006a3c14
mov eax, dword [ebp - 0x210]
call fcn.00404dfc
cmp ebx, eax
jge 0x6a4217
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.006a3c14
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x8aa374]
and eax, 0xff
bt dword [edx], eax
jae 0x6a4217
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x6a422b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.006a4128
cmp ebx, dword [ebp - 8]
je 0x6a432d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x6a4257
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f24
and eax, 0x7f
movzx eax, word [eax*2 + 0x8a702c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x6a431a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f24
and eax, 0x7f
movzx eax, word [eax*2 + 0x8a702c]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00455b24
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403f24
and eax, 0x7f
movzx eax, word [eax*2 + 0x8a702c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00455b24
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a4321
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x6a438e
cmp dword [ebp - 8], 0
jge 0x6a4346
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.006a3c14
mov eax, dword [ebp - 0x218]
call fcn.00404dfc
cmp eax, dword [ebp - 8]
jg 0x6a4380
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.006a3c14
mov eax, dword [ebp - 0x21c]
call fcn.00404dfc
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006a4128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a43b3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404b58
ret
Function at 0x6f2dc0
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x6f2e5e
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x8a71a8]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x8a71a8]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x8a71a8]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x8a71a8]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x6f2ddf
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x6f2e74
dec edx
je 0x6f2ea9
jmp 0x6f2efa
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x8a71a8]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x8a71a8]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x6f2efa
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x8a71a8]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x8a71a8]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x8a71a8]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6f3cc4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x6f3ce4
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x6f3cd2
pop edi
pop esi
pop ebx
ret
Function at 0x7641ec
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7642bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x7642ad
push 0
push 0x7642d0
push 0
push 0
push 0x7642e0
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jne 0x76423e
mov byte [ebp - 5], 0
jmp 0x7642b1
xor eax, eax
push ebp
push 0x764296
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowRect
lea eax, [ebp - 0x25]
push eax
push ebx
call sub.user32.dll_GetWindowRect
call fcn.008771b0
test al, al
je 0x764279
mov edx, dword [ebp - 0x21]
mov eax, dword [ebp - 0x25]
call fcn.00763f38
jmp 0x76428c
lea eax, [ebp - 0x25]
push eax
lea eax, [ebp - 0x15]
push eax
push 3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DrawAnimatedRects
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7642a0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x7642b1
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7642c5
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x7642f0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7643c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x7643b6
push 0
push 0x7643d8
push 0
push 0
push 0x7643e8
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jne 0x764342
mov byte [ebp - 5], 0
jmp 0x7643ba
xor eax, eax
push ebp
push 0x76439f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x15]
mov eax, dword [ebp - 4]
call fcn.00878a70
lea eax, [ebp - 0x25]
push eax
push ebx
call sub.user32.dll_GetWindowRect
call fcn.008771b0
test al, al
je 0x764382
mov eax, dword [ebp - 0x11]
push eax
mov ecx, dword [ebp - 0x15]
mov edx, dword [ebp - 0x21]
mov eax, dword [ebp - 0x25]
call fcn.007640b0
jmp 0x764395
lea eax, [ebp - 0x15]
push eax
lea eax, [ebp - 0x25]
push eax
push 3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_DrawAnimatedRects
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7643a9
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x7643ba
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7643ce
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x764c50
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404b34
mov dword [ebp - 0x10], 0x400
xor eax, eax
push ebp
push 0x764d13
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00877210
test al, al
je 0x764c8c
mov dword [ebp - 0x10], 0x1400
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov ebx, eax
test ebx, ebx
jle 0x764d09
cmp ebx, 0x400
jge 0x764d09
mov eax, ebx
call fcn.00402a70
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x764d02
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test ebx, ebx
jle 0x764cec
cmp ebx, 0x400
jge 0x764cec
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404d34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x764d09
mov eax, dword [ebp - 0xc]
call fcn.00402a90
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x764d25
xor eax, eax
push ebp
push 0x764dda
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x764dd0
cmp dword [ebp - 0x10], 0x1400
jne 0x764dd0
mov dword [ebp - 0x10], 0x400
push 0
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
mov ebx, eax
test ebx, ebx
jle 0x764dd0
cmp ebx, 0x400
jge 0x764dd0
mov eax, ebx
call fcn.00402a70
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x764dc9
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test ebx, ebx
jle 0x764db3
cmp ebx, 0x400
jge 0x764db3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.00404d34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x764dd0
mov eax, dword [ebp - 0xc]
call fcn.00402a90
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x764dec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x76ec9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x76eca4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x76ee4e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x76ee14
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x8a9794]
mov eax, dword [eax]
call fcn.004b04c4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0047bdec
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0x76ee60
call fcn.00405544
mov eax, dword [0x8b3e6c]
cmp dword [eax + 0x15cc], 1
jle 0x76ed60
lea edx, [ebp - 0x18]
mov eax, dword [0x8a9794]
mov eax, dword [eax]
call fcn.004b04c4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0047bdec
push dword [ebp - 0x14]
push 0x76ee88
lea ecx, [ebp - 0x20]
mov eax, dword [0x8b3e6c]
mov eax, dword [eax + 0x15cc]
mov edx, 2
call fcn.00877524
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040544c
push dword [ebp - 0x1c]
push 0x76eec0
lea eax, [ebp - 8]
mov edx, 4
call fcn.004055a8
jmp 0x76ed68
lea eax, [ebp - 8]
call fcn.00405268
mov eax, dword [0x8b3e6c]
cmp dword [eax + 0x15cc], 0xb
jne 0x76edc7
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004055f0
je 0x76edc7
mov eax, dword [ebp - 8]
call fcn.008765c8
test al, al
je 0x76edc7
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0047bfc8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.004052c8
push 3
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
push 0x76eecc
mov eax, ebx
call fcn.00455b24
push eax
call sub.shell32.dll_ShellExecuteW
jmp 0x76ee0a
mov eax, dword [ebp - 4]
call fcn.008765c8
test al, al
je 0x76ee0a
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0047bfc8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.004052c8
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004054c8
push eax
push 0x76eecc
mov eax, ebx
call fcn.00455b24
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x76ee1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76ee55
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00405280
lea eax, [ebp - 0x20]
call fcn.00404b34
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405280
ret
Function at 0x79fbe0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x79fe7b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 0xa
jne 0x79fc38
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598a1c
test al, al
je 0x79fc2c
mov dword [ebp - 4], 0x15
jmp 0x79fe71
mov dword [ebp - 4], 1
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 8
jne 0x79fccd
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00599000
test al, al
je 0x79fc6a
mov dword [ebp - 4], 0x10
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598fbc
test al, al
je 0x79fc87
mov dword [ebp - 4], 0xf
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598ef4
test al, al
je 0x79fca4
mov dword [ebp - 4], 0xe
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057fbcc
test al, al
je 0x79fcc1
mov dword [ebp - 4], 0xa
jmp 0x79fe71
mov dword [ebp - 4], 2
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 1
jne 0x79fd45
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598994
test eax, eax
jg 0x79fcfb
mov dword [ebp - 4], 3
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598994
cmp eax, 0x64
jne 0x79fd19
mov dword [ebp - 4], 0x14
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598994
cmp eax, 0xc8
jne 0x79fd39
mov dword [ebp - 4], 0x17
jmp 0x79fe71
mov dword [ebp - 4], 0x13
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 2
jne 0x79fdba
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057fbcc
test al, al
je 0x79fd91
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598de8
cmp eax, 0x64
jne 0x79fd85
mov dword [ebp - 4], 0x18
jmp 0x79fe71
mov dword [ebp - 4], 8
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057fb8c
cmp al, 1
jne 0x79fdae
mov dword [ebp - 4], 4
jmp 0x79fe71
mov dword [ebp - 4], 5
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 3
jne 0x79fe0b
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598d1c
test al, al
je 0x79fde8
mov dword [ebp - 4], 0x16
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057fb8c
cmp al, 1
jne 0x79fe02
mov dword [ebp - 4], 6
jmp 0x79fe71
mov dword [ebp - 4], 7
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.0057f3ec
cmp al, 5
jne 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598664
test al, al
je 0x79fe36
mov dword [ebp - 4], 0xd
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.005986a8
test al, al
je 0x79fe50
mov dword [ebp - 4], 0x12
jmp 0x79fe71
mov eax, dword [ebx + 0x2f0]
mov edx, esi
call fcn.00598840
test al, al
je 0x79fe6a
mov dword [ebp - 4], 0x11
jmp 0x79fe71
mov dword [ebp - 4], 9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x79fe85
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x7fae5c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x334], 0
jne 0x7fae82
cmp dword [eax + 0x330], 0
jae 0x7fae88
jmp 0x7fb03b
jl 0x7fb03b
xor eax, eax
push ebp
push 0x7fb031
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x325], 0
je 0x7faebe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
cmp dword [eax + 0xc], 0
je 0x7faebe
mov eax, dword [ebp - 4]
call fcn.0046ddb0
jmp 0x7fb027
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov byte [eax + 0x324], 1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x31c], 0
jne 0x7faf0f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
call fcn.004aa8c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x300]
mov edx, dword [eax]
call dword [edx + 0x80]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x328], 0
jl 0x7fb027
call sub.kernel32.dll_GetTickCount
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x325], 0
jne 0x7faf8f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x334]
mov eax, dword [eax + 0x330]
cmp edx, dword [ebp - 0xc]
jne 0x7faf53
cmp eax, dword [ebp - 0x10]
ja 0x7faf8f
jmp 0x7faf55
jg 0x7faf8f
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x334]
mov eax, dword [eax + 0x330]
add eax, 0x3a98
adc edx, 0
cmp edx, dword [ebp - 0xc]
jne 0x7faf78
cmp eax, dword [ebp - 0x10]
jae 0x7faf7a
jmp 0x7faf8f
jl 0x7faf8f
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
call fcn.004714e0
jmp 0x7faf1f
xor eax, eax
push ebp
push 0x7fafc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x325], 0
jne 0x7fafba
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
push eax
call sub.kernel32.dll_TerminateThread
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7fafce
mov eax, dword [ebp - 4]
mov byte [eax + 0x325], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x328], 0xffffffff
xor eax, eax
push ebp
push 0x7fb01d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x7fb013
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7fb027
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7fb03b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8110c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x81121a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
mov byte [eax + 0x30], 0
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edx, dword [eax]
call dword [edx + 0xc]
lea ebx, [eax + eax*2]
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edx, dword [eax]
call dword [edx + 8]
shl eax, 2
cmp ebx, eax
jle 0x81119d
push 0xffffffffffffffff
push 0xd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov edx, dword [eax]
call dword [edx + 0x110]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
pop edx
pop ecx
call fcn.005ef174
jmp 0x8111ea
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov edx, dword [eax]
call dword [edx + 0x114]
push eax
push 0xd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f0]
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
or ecx, 0xffffffff
pop edx
call fcn.005ef174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x811221
mov eax, dword [0x8a9dac]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0xcc8]
mov eax, dword [eax + 0x254]
call fcn.00637aa0
mov byte [eax + 0x30], 1
ret

Function at 0x81440c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x81445d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x814444
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x814434
jmp 0x81445d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x814445
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x82d97c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x82da0e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x82da20
push 0
mov eax, dword [ebx + 0xccc]
call fcn.00455b24
push eax
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x82da04
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x82da04
xor eax, eax
push ebp
push 0x82d9e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x82d9f0
push 5
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_UpdateWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x82da18
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x83ca74
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
call fcn.00405880
xor eax, eax
push ebp
push 0x83cbf6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
cmp byte [eax + 0x2db], 0
je 0x83cbdb
xor eax, eax
push ebp
push 0x83cbd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x8aa338]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.0046f580
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2e0]
xor edx, edx
call fcn.004055f0
je 0x83cbb8
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004055f0
je 0x83cbb8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
mov eax, dword [eax + 0x800]
mov eax, dword [eax + 0x2e0]
call fcn.008765c8
test al, al
je 0x83cbb8
mov eax, dword [ebp - 4]
call fcn.008765c8
test al, al
je 0x83cbb8
lea eax, [ebp - 8]
mov edx, dword [0x8a9588]
mov edx, dword [edx]
mov edx, dword [edx + 0x800]
mov edx, dword [edx + 0x2e0]
call fcn.004052c8
push 0x83cc08
push dword [ebp - 4]
push 0x83cc08
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004055a8
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004052c8
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x84c], edx
mov eax, dword [0x8a9588]
mov eax, dword [eax]
xor edx, edx
mov dword [eax + 0x850], edx
push 1
push 0
mov eax, dword [ebp - 0x10]
call fcn.004054c8
push eax
mov eax, dword [ebp - 8]
call fcn.004054c8
push eax
push 0x83cc0c
mov eax, dword [0x8a9c8c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83cbdb
mov eax, dword [0x8aa338]
mov eax, dword [eax]
xor edx, edx
call fcn.0046f580
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83cbfd
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00405280
ret