joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d31c0
Capabilities:
Delete registry key

Disassembly:
push ecx
mov edx, 0x5c4e30
mov ecx, str.date
call fcn.004d2dc0
test eax, eax
je 0x4d32fc
mov edx, 2
mov ecx, 0x5c4e30
call fcn.00480210
mov edx, 0x5c4e30
mov ecx, str.DateUsed
call fcn.004d2d50
lea eax, [esp]
push eax
push 0x5aa8d8
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4d322a
mov ecx, dword [esp]
push str.date
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x5c4e30
mov ecx, str.name
call fcn.004d2dc0
test eax, eax
je 0x4d32a4
mov edx, 0x5c5218
mov ecx, str.code
call fcn.004d2dc0
test eax, eax
je 0x4d3290
mov edx, 2
mov ecx, 0x5c5218
call fcn.00480210
mov edx, 0x5c5218
mov ecx, 0x5c4e30
call fcn.004d3080
test eax, eax
je 0x4d3290
mov edx, 0x5c4e30
mov ecx, str.UserName
call fcn.004d2d50
mov edx, 0x5c5218
mov ecx, str.License
call fcn.004d2d50
mov ecx, str.name
call fcn.004d2e30
mov ecx, str.code
call fcn.004d2e30
mov edx, 0x5c4e30
mov ecx, str.lock
call fcn.004d2dc0
test eax, eax
je 0x4d32d0
mov edx, 0x5c4e30
mov ecx, str.LockOptions
call fcn.004d2d50
mov ecx, str.lock
call fcn.004d2e30
mov edx, 0x5c4e30
mov ecx, str.channels
call fcn.004d2dc0
test eax, eax
je 0x4d32fc
mov ecx, str.channels
call fcn.004d2e30
mov edx, 0x5c4e30
mov ecx, str.Channels
call fcn.004d2d50
pop ecx
ret

Function at 0x4d3490
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5ee6c8]
mov ecx, dword [0x5ee6c4]
push eax
push ecx
push str._ld__ld
push 0x5c4e30
mov dword [0x5ee6bc], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5c4e30
mov ecx, str.LastRun
jmp fcn.004d2d50
Function at 0x4d4fd0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push edi
mov edi, ecx
cmp byte [edi], 0
mov ebx, edx
jne 0x4d4fe0
pop edi
xor eax, eax
pop ebx
ret
push esi
push 0x5b
push edi
call fcn.005912e0
mov esi, eax
add esp, 8
test esi, esi
je 0x4d503f
inc esi
push 0x5d
push esi
call fcn.005912e0
add esp, 8
test eax, eax
je 0x4d503f
mov byte [eax], 0
cmp byte [esi], 0
je 0x4d503f
push 0x2e
push esi
call fcn.005912e0
add esp, 8
test eax, eax
je 0x4d503f
push esi
call fcn.0059164b
add esp, 4
test eax, eax
jg 0x4d50b7
cmp byte [edi], 9
mov eax, edi
jne 0x4d503a
mov cl, byte [eax + 1]
inc eax
cmp cl, 9
je 0x4d5031
cmp byte [eax], 0x2a
je 0x4d50b7
cmp byte [edi], 9
mov esi, edi
jne 0x4d504e
mov al, byte [esi + 1]
inc esi
cmp al, 9
je 0x4d5046
cmp byte [esi], 0x2a
jne 0x4d50a5
mov eax, dword [0x5c9d44]
push eax
xor edx, edx
mov ecx, 0xe11
call fcn.0041f1a0
mov ecx, dword [ebx]
mov edx, eax
call fcn.00514ad0
pop esi
pop edi
xor eax, eax
pop ebx
ret
push str.__.server__s
push 0x5eef00
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebx]
add esp, 0xc
push ebx
push 0
push 0
push 0
push 0
mov edx, 0x5eef00
call fcn.00440db0
pop esi
pop edi
mov eax, 1
pop ebx
ret
push 0x20
push esi
call fcn.005912e0
add esp, 8
test eax, eax
je 0x4d506e
mov byte [eax], 0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
push esi
jns 0x4d5074
push str.__.server__m__s
jmp 0x4d5079
Function at 0x4d5350
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x34
test eax, eax
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x4d536a
push 8
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebp
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, edi
dec eax
je 0x4d548f
dec eax
je 0x4d53e3
mov ecx, esi
call fcn.004d5300
mov ebx, eax
test ebx, ebx
jle 0x4d553f
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cdq
idiv ebx
mov ebp, 2
mov dword [esp + 0x10], eax
lea esp, [esp]
lea edx, [esp + 0x24]
push edx
push ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
push 0x101a
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
call dword [sym.imp.USER32.dll_SendMessageA]
dec ebx
jns 0x4d53b0
jmp 0x4d553f
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp + 0x10], eax
mov ebp, 2
mov dword [esp + 0x24], ebp
fild dword [esp + 0x10]
fmul qword [0x5aa948]
call fcn.00590ed4
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x101a
push esi
mov dword [esp + 0x3c], eax
call ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ebp
fild dword [esp + 0x10]
fmul qword [0x5aa948]
call fcn.00590ed4
sub edi, eax
sub edi, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
push 1
push 0x101a
push esi
mov dword [esp + 0x3c], edi
call ebx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
jmp 0x4d552a
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
sub ecx, ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 0x55555556
imul ecx
lea ecx, [esp + 0x24]
push ecx
mov eax, edx
push 0
shr eax, 0x1f
push 0x101a
add edx, eax
mov ebp, 2
push esi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], edx
call ebx
xor eax, eax
mov ecx, 8
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov edx, ecx
sub edx, edi
mov eax, 0x55555556
imul edx
mov eax, edx
shr eax, 0x1f
add edx, eax
sub ecx, edx
sub ecx, edi
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x24]
push ecx
push 1
push 0x101a
push esi
mov dword [esp + 0x34], ebp
call ebx
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x24]
rep stosd dword es:[edi], eax
push edx
push ebp
push 0x101a
push esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], ebp
call ebx
mov eax, dword [esp + 0x48]
test eax, eax
pop ebp
pop ebx
je 0x4d5552
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x34
ret 4
Function at 0x4d5f20
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x5ee6d8]
mov ecx, dword [0x5ee6d4]
push ebx
push eax
push ecx
push str._lu__d
push 0x5c5218
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, 0x5c5218
mov ecx, str.LockOptions
call fcn.004d2d50
mov ebx, dword [0x5ee6dc]
test ebx, ebx
mov byte [0x5c5218], 0
je 0x4d5ff2
push ebp
mov bp, word [0x5a4f30]
push esi
push edi
nop
mov eax, 0x5c5218
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d5f78
sub eax, edx
mov edx, eax
mov eax, dword [ebx]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d5f88
sub eax, esi
add eax, edx
cmp eax, 0x3b5
ja 0x4d5fef
mov al, byte [0x5c5218]
test al, al
je 0x4d5fbb
mov edi, 0x5c5218
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d5fb0
mov word [edi], bp
mov eax, dword [ebx]
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d5fc0
mov edi, 0x5c5218
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d5fd0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x40]
test ebx, ebx
jne 0x4d5f70
pop edi
pop esi
pop ebp
mov edx, 0x5c5218
mov ecx, str.Channels
pop ebx
jmp fcn.004d2d50
Function at 0x4d6830
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, edx
mov ebx, ecx
call fcn.005612a0
test eax, eax
je 0x4d68d4
mov eax, dword [ebx + 0x6b4]
cmp eax, 0xffffffff
je 0x4d685b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx + 0x6b0]
test eax, eax
mov dword [ebx + 0x6b4], 0xffffffff
jne 0x4d688c
lea ecx, [ebx + 0x4a0]
mov edx, 1
call fcn.00421f20
neg eax
sbb eax, eax
add eax, 2
mov dword [ebx + 0x6b0], eax
mov eax, dword [0x5ee720]
test eax, eax
je 0x4d68a0
lea ecx, [ebx + 0x4a0]
call fcn.004d65f0
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [ebx + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebx + 0x6b4], eax
jne 0x4d68df
mov dword [ebx + 0x6b0], 0
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x4d6a33
mov dl, byte [0x5a4bea]
mov cx, word [0x5a4be8]
lea eax, [esp + 0xc]
mov byte [esp + 0xe], dl
mov word [esp + 0xc], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d6911
sub eax, edx
push 0
mov esi, eax
call fcn.00591e16
add esp, 4
mov ecx, eax
call fcn.0053fc10
push eax
xor edx, edx
mov ecx, 0xe75
call fcn.0041f1a0
push eax
lea eax, [esp + esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x18]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d6950
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
sub eax, edx
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [ebx + 0x6b4]
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
lea edx, [esp + 0x10]
mov ecx, 0xe7d
call fcn.0041f1a0
cmp dword [ebx + 0x71c], 2
jne 0x4d69b6
mov eax, dword [ebx + 0x720]
cmp eax, 3
je 0x4d699d
cmp eax, 4
jne 0x4d69b6
lea esi, [ebx + 8]
push 0x20
push esi
call fcn.005912e0
add esp, 8
test eax, eax
jne 0x4d69b3
mov eax, esi
jmp 0x4d69b9
inc eax
jmp 0x4d69b9
lea eax, [ebx + 8]
mov edx, eax
jmp 0x4d69c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d69c0
push edi
lea edi, [esp + 0x14]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d69d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4d69f0
mov cx, word [0x5a4be8]
mov dl, byte [0x5a4bea]
mov word [edi], cx
mov byte [edi + 2], dl
lea eax, [esp + 0x14]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d6a13
push 0
sub eax, edx
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [ebx + 0x6b4]
lea edx, [esp + 0x1c]
push edx
push eax
call ebp
pop ebp
mov eax, dword [0x5ee708]
mov esi, 1
cmp eax, esi
jne 0x4d6a58
mov ecx, dword [ebx + 0x6b4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b4], 0xffffffff
mov dword [ebx + 0x6a8], esi
mov eax, esi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x4d6a70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x110
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.005612a0
test eax, eax
je 0x4d6bb7
cmp dword [esi + 0x6b4], 0xffffffff
mov dword [esi + 0x6a8], 0
jne 0x4d6ad7
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [esi + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6b4], eax
je 0x4d6bb7
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x4d6b33
push 0
call fcn.00591e16
add esp, 4
mov ecx, eax
call fcn.0053fc10
push eax
xor edx, edx
mov ecx, 0xe76
call fcn.0041f1a0
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x20]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d6b10
mov ecx, dword [esi + 0x6b4]
sub eax, edx
push 0
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x6b4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x6b0]
mov eax, 2
cmp ecx, eax
mov dword [esi + 0x6b4], 0xffffffff
jne 0x4d6bb7
cmp dword [esi + 0x71c], eax
jne 0x4d6bb7
cmp dword [esi + 0x720], 1
jne 0x4d6bb7
lea eax, [esp + 8]
push eax
push esi
lea edi, [esi + 0x4a0]
push 3
mov edx, 0x32
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.004d44e0
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4d6bae
mov eax, dword [esp + 8]
test eax, eax
jne 0x4d6bae
push edi
call fcn.00593f0c
add esp, 4
pop edi
pop esi
add esp, 0x110
ret
lea ecx, [esp + 0xc]
call fcn.004d3d60
pop edi
pop esi
add esp, 0x110
ret
Function at 0x4d7cc0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x528
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x14b
mov esi, ecx
push 0x6d
push esi
call edi
mov eax, dword [0x5f14f0]
test eax, eax
mov byte [esp + 0x148], 0
je 0x4d7d11
lea ecx, [esp + 0x148]
push ecx
push 0x180
push 0xd
push 0x198
push eax
call edi
mov al, byte [esp + 0x148]
test al, al
jne 0x4d7d32
xor eax, eax
jmp 0x4d7d20
mov cl, byte [eax + 0x5ee730]
mov byte [esp + eax + 0x148], cl
inc eax
test cl, cl
jne 0x4d7d20
push ebp
lea edx, [esp + 0x14c]
push edx
push str._s.
push 0x5f14f8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6d
push esi
call edi
lea eax, [esp + 0xc]
push eax
push 0x5f14f8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4d7deb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
test byte [esp + 0x10], 0x10
je 0x4d7dd7
cmp byte [esp + 0x3c], 0x2e
je 0x4d7dd7
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [eax + 0x5f14f8], cl
inc eax
test cl, cl
jne 0x4d7d90
push 0x5f14f8
push 0
push 0x158
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
jne 0x4d7dd0
push 0x5f14f8
push 0
push 0x143
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
je 0x4d7de3
cmp eax, 0xfffffffe
je 0x4d7de3
lea ecx, [esp + 0x10]
push ecx
jmp 0x4d7ddc
lea edx, [esp + 0x10]
push edx
push ebp
call ebx
test eax, eax
jne 0x4d7d80
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push 0
push 0
push 0x146
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
pop ebp
jne 0x4d7e01
xor eax, eax
mov ecx, dword [0x5ee838]
test ecx, ecx
jl 0x4d7e0f
cmp ecx, eax
jle 0x4d7e17
xor ecx, ecx
mov dword [0x5ee838], ecx
push 0
push ecx
push 0x14e
push 0x6d
push esi
call edi
pop edi
pop esi
add esp, 0x528
ret
Function at 0x4d8170
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x5ee850]
push ebx
push esi
mov dword [esp + 8], edx
xor edx, edx
test eax, eax
push edi
mov esi, ecx
je 0x4d823f
mov ecx, 0xe89
call fcn.0041f1a0
push eax
push 0
push 0xc
push 0x68
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x6d
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 0
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x6e
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x6f
push esi
call edi
push eax
call ebx
push 0
push 1
push esi
call edi
push eax
call ebx
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
mov ecx, 0xe88
call fcn.0041f1a0
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
push 0
push 0xc
push 0x68
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 5
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x6d
push esi
call edi
push eax
call ebx
push 1
push 0x65
push esi
call edi
push eax
call ebx
push 1
push 0x66
push esi
call edi
push eax
call ebx
push 1
push 0x6e
push esi
call edi
push eax
call ebx
push 1
push 0x67
push esi
call edi
push eax
call ebx
push 1
push 0x6f
push esi
call edi
push eax
call ebx
push 1
push 1
push esi
call edi
push eax
call ebx
push 0
push 0
push 0x190
push 0x67
push esi
call ebp
cmp eax, 0xffffffff
pop ebp
je 0x4d837c
test eax, eax
jne 0x4d82f7
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
jmp 0x4d835c
cmp eax, 1
jne 0x4d8346
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 1
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4d837c
push 0
push 0x6a
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 1
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4d837c
xor ecx, ecx
call fcn.0041f0a0
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4dacc0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret

Function at 0x4dae70
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x58
mov eax, edx
xor edx, edx
mov dword [0x5ee970], edx
mov dword [0x5ee974], edx
mov dword [0x5ee978], edx
mov dword [0x5ee97c], edx
mov dword [esp + 4], edx
mov dword [esp], edx
mov edx, ecx
push eax
lea ecx, [esp + 4]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.004dacf0
mov edx, 0x5ee970
lea ecx, [esp]
call fcn.004dadd0
mov eax, 0x5ee970
add esp, 0x58
ret

Function at 0x4e2800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [edx + 0x200c]
push esi
call fcn.00561000
mov esi, eax
test esi, esi
je 0x4e29dc
push edi
mov edi, dword [esi + 0xbe8]
mov ecx, edi
call fcn.004f0af0
test eax, eax
je 0x4e29db
cmp ebx, 0x1b58
jne 0x4e287d
mov eax, dword [esi + 0x88c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push eax
call ebx
cmp eax, 0xffffffff
je 0x4e2922
mov ecx, dword [esi + 0x88c]
push 0x5ef2e8
push eax
push 0x189
push ecx
call ebx
mov edx, edi
mov ecx, 0x5ef2e8
call fcn.004d4fd0
jmp 0x4e291a
cmp ebx, 0x1b59
jne 0x4e292c
mov edx, dword [esi + 0x88c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push edx
call edi
cmp eax, 0xffffffff
je 0x4e2922
push 0x5eef00
push eax
mov eax, dword [esi + 0x88c]
push 0x189
push eax
call edi
mov al, byte [0x5eef00]
test al, al
je 0x4e29db
cmp al, 9
mov ecx, 0x5eef00
jne 0x4e28d8
mov al, byte [ecx + 1]
inc ecx
cmp al, 9
je 0x4e28d0
mov eax, ecx
lea edi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4e28e0
sub eax, edi
inc eax
push eax
push ecx
push 0x5eef00
call fcn.00592290
push 0x20
push 0x5eef00
call fcn.005912e0
add esp, 0x14
test eax, eax
je 0x4e290c
mov byte [eax], 0
push 0
mov edx, 0x5eef00
mov ecx, esi
call fcn.0041fad0
test eax, eax
jne 0x4e29db
pop edi
pop esi
xor ecx, ecx
pop ebx
jmp fcn.0041f0a0
cmp ebx, 0x1b5a
jne 0x4e2963
mov ecx, dword [esi + 0x88c]
push 0
push 0
push 0x184
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [edi]
push edi
push 0
push 0
push 0
push 0
mov edx, str.__.links
call fcn.00440db0
pop edi
pop esi
pop ebx
ret
cmp ebx, 0x1b5b
jne 0x4e29db
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x5ee048
push str._slinks.ini
push 0x5f5cd0
call edi
add esp, 0xc
push 5
push 0
xor edx, edx
mov ecx, 0x13ef
call fcn.0041f1a0
mov ecx, dword [esi]
push eax
mov edx, 3
call fcn.0052b920
test eax, eax
je 0x4e29db
push 0x5f5e50
push 0x5f5cd0
push 0x5a49b4
push 0x5ef2e8
call edi
mov ecx, dword [esi + 0x6cc]
add esp, 0x10
push 0x5ef2e8
push 0
push 0x5a4dfc
mov edx, str.links
call fcn.004bd180
pop edi
pop esi
pop ebx
ret
Function at 0x4e29e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x7d4
push esi
push 0
push 0x104
lea eax, [esp + 0x3f8]
push eax
mov esi, edx
push esi
push ecx
call dword [sym.imp.USER32.dll_GetMenuStringA]
test eax, eax
jg 0x4e2a10
xor eax, eax
pop esi
add esp, 0x7d4
ret 4
cmp esi, 0x64
jne 0x4e2a84
mov eax, dword [0x5f14f0]
test eax, eax
jne 0x4e2a9c
call fcn.005288c0
mov ecx, dword [0x5f56e0]
push 0
mov edx, 1
call fcn.00531820
xor ecx, ecx
mov dword [0x5f56e0], eax
call fcn.00528a30
push 0x5ee150
push 0
mov edx, str.host
mov ecx, 0x5a5458
call fcn.004bc990
mov edx, str._recent_
mov ecx, 0x5f5560
call fcn.004bd4d0
mov edx, str._success_
mov ecx, 0x5f5560
call fcn.004bd4d0
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
cmp esi, 0x1b57
jne 0x4e2ab2
mov ecx, dword [esp + 0x7dc]
call fcn.004f3170
test eax, eax
jne 0x4e2aa3
xor ecx, ecx
call fcn.0041f0a0
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
push ebx
push edi
call fcn.005288c0
push 0
push 0
mov edx, str._recent_
mov ecx, 0x5f5560
call fcn.004bd210
mov edx, 0x3e7
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
xor edi, edi
mov esi, eax
call fcn.00420e60
mov bl, 0x2e
test esi, esi
je 0x4e2b90
lea esp, [esp]
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4e2af6
lea ecx, [esp + 0x10]
push 0x5a745c
push ecx
call fcn.00591d90
add esp, 8
test eax, eax
je 0x4e2b72
lea edx, [esp + 0x10]
push 0x3a
push edx
mov byte [eax], 0
call fcn.005912e0
add esp, 8
test eax, eax
je 0x4e2b46
lea esp, [esp]
mov byte [eax], 0x2c
lea eax, [esp + 0x10]
push 0x3a
push eax
call fcn.005912e0
add esp, 8
test eax, eax
jne 0x4e2b30
cmp byte [esp + 0x10], bl
lea eax, [esp + 0x10]
jne 0x4e2b58
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
je 0x4e2b50
cmp byte [eax], 0
je 0x4e2b72
lea ecx, [esp + 0x3f8]
push ecx
push eax
call fcn.005a299c
add esp, 8
test eax, eax
je 0x4e2b7f
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4e2af0
jmp 0x4e2b90
mov edx, dword [esi]
push edx
mov edx, 0x3e7
lea ecx, [esp + 0x14]
call fcn.00420d70
lea ecx, [esp + 0xc]
call fcn.004d3d60
test esi, esi
jne 0x4e2bbf
test edi, edi
jne 0x4e2bb1
mov esi, dword [0x5f56e0]
mov edi, 1
jmp 0x4e2ae4
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x7d4
ret 4
mov esi, dword [esp + 0x7e4]
mov ecx, esi
call fcn.004f0af0
test eax, eax
je 0x4e2bea
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x4e2c02
mov ecx, esi
call fcn.004f3170
mov esi, eax
test esi, esi
jne 0x4e2c02
xor ecx, ecx
call fcn.0041f0a0
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.004d3d60
push 0
lea edx, [esp + 0x14]
xor ecx, ecx
call fcn.004d38f0
mov edx, esi
lea ecx, [esp + 0x10]
mov dword [edi], eax
call fcn.00529f10
mov ecx, esi
mov dword [esi + 0x14], 0xc
call fcn.00459b60
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
Function at 0x4e7000
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, edx
xor edx, edx
push esi
mov dword [esp + 0x14], ecx
xor ebp, ebp
xor eax, eax
xor ecx, ecx
xor esi, esi
cmp ebx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
jl 0x4e70c0
push edi
mov edi, dword [esp + 0x20]
jmp 0x4e7031
mov ebx, dword [esp + 0x10]
test edx, edx
jne 0x4e7043
cmp ebp, ebx
jge 0x4e7043
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx + ebp]
inc ebp
jmp 0x4e7053
xor bl, bl
inc ebp
test ecx, ecx
mov edx, 1
mov dword [esp + 0x14], ecx
je 0x4e705e
movzx ebx, bl
shl esi, 8
add ecx, 8
or esi, ebx
cmp ecx, 6
jl 0x4e708f
sub ecx, 6
mov ebx, esi
shr ebx, cl
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi], bl
inc eax
cmp eax, 0x3c
jge 0x4e70bb
cmp eax, dword [esp + 0x24]
jge 0x4e70a5
test edx, edx
jne 0x4e708d
cmp ecx, 6
jge 0x4e7063
jmp 0x4e708f
xor ecx, ecx
cmp ebp, dword [esp + 0x10]
jle 0x4e702d
mov ecx, dword [esp + 0x14]
cmp ecx, 2
jne 0x4e70ad
mov byte [eax + edi], 0x3d
inc eax
jmp 0x4e70b2
or eax, 0xffffffff
or ebp, 0xffffffff
jmp 0x4e70bf
cmp ecx, 4
jne 0x4e70b7
mov byte [eax + edi], 0x3d
inc eax
test eax, eax
je 0x4e70bf
mov byte [eax + edi], 0
pop edi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop esi
mov dword [ecx], ebp
pop ebp
mov dword [edx], eax
pop ebx
add esp, 0xc
ret 0x10