joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adcb4
Capabilities:
Set file attributes

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x8000080
push 2
push 0
push 1
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
cmp eax, 0xffffffff
jne 0x4adcf7
push 0x80
push ebx
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x8000080
push 2
push 0
push 1
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
pop ebx
ret

Function at 0x4ae058
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov esi, eax
cmp byte [0x4c8151], 0
jne 0x4ae09e
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x4ae093
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4ae093
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp esi, eax
ja 0x4ae071
add esp, 0x1c
pop esi
pop ebx
ret

Function at 0x4ae768
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, eax
xor ebx, ebx
cmp byte [0x4c6da3], 0
je 0x4ae7a5
mov eax, 0x4c6da3
call fcn.004b1914
test al, al
je 0x4ae7a5
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x4ae7a5
mov edx, 0x4c6da3
mov eax, esi
call fcn.004b81b0
mov bl, 1
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x4ae81b
push esp
push 0x4ae8bc
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4ae7e7
mov dword [esp + 4], 0xff
lea eax, [esp + 4]
push eax
push esi
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4ae81b
mov bl, 1
jmp 0x4ae81b
push esp
push 0x4ae8e8
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4ae81b
mov dword [esp + 4], 0xff
lea eax, [esp + 4]
push eax
push esi
push 0
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x4ae81b
mov bl, 1
test bl, bl
jne 0x4ae8b1
cmp byte [0x4c6710], 0
je 0x4ae841
mov eax, 0x4ae914
mov edx, 0x14
call fcn.004b12a8
test al, al
je 0x4ae8b1
jmp 0x4ae854
mov eax, 0x4ae980
mov edx, 0x14
call fcn.004b12a8
test al, al
je 0x4ae8b1
mov eax, 0xa
call fcn.004ae058
mov edx, 0x4ced10
lea eax, [esp + 8]
call fcn.004b81b0
mov edx, 0x4aea08
mov eax, 0x4ced10
call fcn.004b81b0
mov al, 0xe
call fcn.00421294
test al, al
je 0x4ae8a3
mov edx, 0x4ced10
mov eax, 0x4c6da3
call fcn.004b81b0
mov edx, 0x4ced10
mov eax, esi
call fcn.004b81b0
mov bl, 1
lea edx, [esp + 8]
mov eax, 0x4ced10
call fcn.004b81b0
mov eax, ebx
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x4af51c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov ebx, 0x4cf288
lea eax, [ebp - 4]
push eax
push ecx
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
mov eax, ebx
mov edx, esi
call fcn.004b81b0
mov eax, ebx
call fcn.004b8144
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x104]
mov edx, esi
call fcn.004b81b0
push 0x4af6ac
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
push 0x4af6b4
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
cmp byte [ebp + 8], 0
jne 0x4af5cc
xor eax, eax
call fcn.004af490
jmp 0x4af5e3
mov edx, 0x4c5384
mov eax, ebx
call fcn.004b81b0
push 0x4af6c0
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, ebx
call fcn.004b8144
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push esi
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
mov eax, ebx
mov edx, edi
call fcn.004b81b0
mov eax, ebx
call fcn.004b8144
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
lea eax, [ebp - 0x104]
mov edx, esi
call fcn.004b81b0
push 0x4af6c8
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyA
xor eax, eax
call fcn.004af490
mov eax, ebx
call fcn.004b8144
mov byte [ebx + eax - 5], 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, ebx
call fcn.004b8144
inc eax
push eax
push ebx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b0054
Capabilities:
Get disk size

Disassembly:
add esp, 0xffffffec
cmp byte [0x4c81a5], 0
jne 0x4b00b6
mov eax, 0x4b00c4
call fcn.004b1c50
mov edx, eax
lea eax, [esp + 0x10]
mov cx, 3
call fcn.004b81d8
mov dword [esp + 8], 1
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
cmp dword [esp + 8], 0
jne 0x4b00af
mov byte [0x4c81a5], 1
jmp 0x4b00b6
mov byte [0x4c81a5], 2
cmp byte [0x4c81a5], 1
sete al
add esp, 0x14
ret

Function at 0x4b00c8
Capabilities:
Set registry value

Disassembly:
push ebx
push ecx
cmp byte [0x4c811d], 0
jne 0x4b026b
fild dword [0x4c65f0]
add esp, 0xfffffff8
fistp qword [esp]
wait
push 0
push 4
call fcn.004af060
cmp eax, 3
jne 0x4b0139
mov ax, 0xc5
call fcn.004aa600
cmp byte [eax], 0x50
je 0x4b0139
mov ax, 0xc5
call fcn.004aa600
cmp byte [eax], 0x4d
je 0x4b0139
cmp word [0x4c66f2], 5
jle 0x4b0139
movsx eax, word [0x4c66f2]
mov ecx, 3
cdq
idiv ecx
mov edx, eax
mov eax, 1
call fcn.004aa578
mov word [0x4c66f2], ax
mov al, byte [0x4c8179]
mov byte [0x4c673a], al
cmp dword [0x4cf280], 0
je 0x4b0166
mov eax, 0x4c4f84
mov edx, dword [0x4cf280]
call fcn.004b81b0
mov eax, dword [0x4cf280]
call fcn.004b8480
push esp
mov eax, dword [0x4be88c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyA
mov eax, 0x4b0270
call fcn.004b1c50
mov eax, 0x4cf288
call fcn.004aeddc
mov eax, 0x4cf288
call fcn.004ade4c
mov eax, 0x4cf288
call fcn.004b8144
inc eax
push eax
push 0x4cf288
push 1
push 0
push 0x4b0274
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp byte [0x4c8177], 0
je 0x4b0200
push 0x2460
push 0x4c4e84
push 3
push 0
mov eax, dword [0x4bdd90]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4b026b
mov ax, 0x119
call fcn.004aa600
mov edx, eax
mov ax, 0x1a
call fcn.004acdac
jmp 0x4b026b
push 0
mov eax, dword [0x4cf224]
push eax
call sub.kernel32.dll__lcreat
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b022e
call fcn.004b0054
test al, al
jne 0x4b026b
mov edx, dword [0x4cf224]
mov ax, 3
call fcn.004acdac
jmp 0x4b026b
push 0x20
push 0x4be288
push ebx
call sub.kernel32.dll__hwrite
push 0x2460
push 0x4c4e84
push ebx
call sub.kernel32.dll__hwrite
cdq
cmp edx, 0
jne 0x4b0265
cmp eax, 0xffffffff
jne 0x4b0265
mov edx, dword [0x4cf224]
mov ax, 3
call fcn.004acdac
push ebx
call sub.kernel32.dll_CloseHandle_1
pop edx
pop ebx
ret
Function at 0x4b0380
Capabilities:
Get file size
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov edi, 0x4c4e84
mov ebx, 0x4c81f2
mov eax, dword [0x4bdd94]
call fcn.004b1c50
call fcn.004b1914
mov byte [0x4c8177], al
cmp byte [0x4c8177], 0
je 0x4b03f0
lea eax, [esp + 4]
push eax
mov eax, dword [0x4be88c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4b03f0
mov dword [esp], 0x2460
push esp
push edi
push 0
push 0
mov eax, dword [0x4bdd90]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b03f5
call fcn.004b0300
jmp 0x4b03f5
call fcn.004b0300
mov al, byte [edi + 0x18b6]
mov byte [0x4c8179], al
xor eax, eax
mov al, byte [0x4c8196]
cmp word [edi + eax*2 + 0x180e], 0
jne 0x4b042b
xor edx, edx
mov dl, byte [0x4c8199]
add edx, edx
add dx, word [0x4be284]
mov word [edi + eax*2 + 0x180e], dx
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
mov ax, word [esp + 0x14]
sub ax, word [esp + 0xc]
mov word [ebx], ax
mov ax, word [esp + 0x10]
sub ax, word [esp + 8]
mov word [0x4c81f4], ax
cmp word [ebx], 0x258
je 0x4b0474
cmp word [ebx], 0x300
je 0x4b0474
cmp word [ebx], 0x360
je 0x4b0474
cmp word [ebx], 0x400
jne 0x4b0478
sub word [ebx], 2
xor eax, eax
mov al, byte [0x4c8196]
cmp word [edi + eax*2 + 0x1802], 0
jne 0x4b0495
mov dx, word [ebx]
mov word [edi + eax*2 + 0x1802], dx
xor esi, esi
mov ebx, 0x4bde20
mov eax, ebx
call fcn.004b1c50
call fcn.004b1914
test al, al
je 0x4b04b6
mov eax, esi
mov byte [edi + 0x188c], al
jmp 0x4b04bf
inc esi
add ebx, 0xb
cmp esi, 6
jne 0x4b049c
push 4
push 0x1000
xor eax, eax
mov al, byte [edi + 0x18a0]
imul eax, eax, 0x12c
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x4c7300], eax
cmp dword [0x4c7300], 0
je 0x4b057b
xor eax, eax
mov al, byte [edi + 0x18a0]
imul eax, eax, 0x12c
mov dword [esp], eax
cmp byte [0x4c8177], 0
je 0x4b0527
push esp
mov eax, dword [0x4c7300]
push eax
push 0
push 0
mov eax, dword [0x4bdd8c]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4b057b
mov eax, dword [0x4bdd8c]
call fcn.004b1c50
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.004adc9c
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_GetFileSize_1
mov ecx, 0x12c
xor edx, edx
div ecx
mov edx, eax
xor eax, eax
mov al, byte [edi + 0x18a0]
call fcn.004aa570
imul eax, eax, 0x12c
push eax
mov eax, dword [0x4c7300]
push eax
push ebx
call sub.kernel32.dll__lread
push ebx
call sub.kernel32.dll_CloseHandle_1
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4b067c
Capabilities:
Create process on windows

Disassembly:
mov al, 4
call fcn.004b0608
mov edx, 0x4b06fc
mov eax, 0x4cf288
call fcn.004b81b0
mov al, byte [0x4c6710]
sub al, 1
jb 0x4b06a5
dec al
je 0x4b06b6
dec al
je 0x4b06c7
jmp 0x4b06d8
push 0x4b0720
push 0x4cf288
call sub.kernel32.dll_lstrcatA
jmp 0x4b06e7
push 0x4b0728
push 0x4cf288
call sub.kernel32.dll_lstrcatA
jmp 0x4b06e7
push 0x4b0730
push 0x4cf288
call sub.kernel32.dll_lstrcatA
jmp 0x4b06e7
push 0x4b0738
push 0x4cf288
call sub.kernel32.dll_lstrcatA
push 5
push 0
push 0
push 0x4cf288
push 0
push 0
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x4b1054
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov ebp, edx
mov edi, eax
cmp byte [0x4cfe02], 6
je 0x4b116f
cmp dword [0x4c2d98], 0
je 0x4b116f
cmp byte [0x4cfe04], 0
jne 0x4b116f
mov eax, dword [0x4cfdf8]
call fcn.004b8144
mov esi, eax
mov eax, dword [0x4cfdfc]
call fcn.004b8144
add esi, eax
add esi, 0x12c
mov eax, esi
call fcn.00402504
mov ebx, eax
mov byte [ebx], 0
push 0x4b1184
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4c4524]
push eax
mov eax, dword [0x4cfdfc]
push eax
call sub.kernel32.dll_lstrcmpA
test eax, eax
je 0x4b10e6
mov eax, dword [0x4cfdfc]
push eax
push ebx
call sub.kernel32.dll_lstrcatA
mov eax, ebx
call fcn.004ab7d8
mov eax, dword [0x4cfdf8]
push eax
push ebx
call sub.kernel32.dll_lstrcatA
cmp byte [0x4cfe00], 0
jne 0x4b1104
cmp byte [0x4cfe02], 2
jne 0x4b113a
mov eax, ebx
call fcn.004ab7d8
push 0x14
lea eax, [esp + 4]
push eax
push ebp
push edi
call sub.user32.dll_GetDlgItem
push eax
call sub.user32.dll_GetWindowTextA
mov eax, esp
mov dl, 0x26
call fcn.004aec2c
push 0x4b1190
push ebx
call sub.kernel32.dll_lstrcatA
push esp
push ebx
call sub.kernel32.dll_lstrcatA
cmp byte [0x4ceb86], 0
jne 0x4b1158
mov eax, dword [0x4c2d98]
add eax, 0x148
xor ecx, ecx
mov edx, ebx
call fcn.004ac0f4
jmp 0x4b1166
mov eax, dword [0x4c2d98]
xor ecx, ecx
mov edx, ebx
call fcn.004a9c04
mov edx, esi
mov eax, ebx
call fcn.00402524
push ebp
push edi
call sub.user32.dll_EndDialog
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b194c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret

Function at 0x4b2068
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4b2089
mov al, byte [esp]
jmp 0x4b208b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4b2090
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4b20c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0040498c
jmp 0x4b20d2
mov eax, ebx
mov edx, esi
call fcn.004048f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b22b8
Capabilities:
Get file size

Disassembly:
add esp, 0xfffffff4
lea edx, [esp + 8]
push edx
push eax
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [esp + 8]
call fcn.004af018
fistp qword [esp]
wait
fild qword [esp]
add esp, 0xc
ret

Function at 0x4b2314
Capabilities:
Get file size

Disassembly:
push ebx
add esp, 0xfffffff4
mov ecx, 0x8000000
xor edx, edx
call fcn.004adc9c
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4b233c
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
jmp 0x4b235a
lea eax, [esp + 8]
push eax
push ebx
call sub.kernel32.dll_GetFileSize_1
mov edx, dword [esp + 8]
call fcn.004af018
fistp qword [esp]
wait
push ebx
call sub.kernel32.dll_CloseHandle_1
fild qword [esp]
add esp, 0xc
pop ebx
ret
Function at 0x4b34c0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffd30
mov ebx, eax
mov ebp, esp
push 0
push 0
push 0x418
mov eax, dword [0x4cfd40]
push eax
call sub.user32.dll_SendMessageA
test eax, eax
je 0x4b370d
mov edx, dword [0x4cf234]
mov eax, ebp
call fcn.00402bec
mov eax, ebp
call fcn.0040297c
call fcn.00402634
test eax, eax
je 0x4b351b
mov edx, dword [0x4cf234]
mov ax, 3
call fcn.004acdac
jmp 0x4b370d
push 0xff
lea eax, [esp + 0x1d0]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [esp + 0x1cc]
mov eax, ebp
call fcn.004035b8
call fcn.00403624
mov eax, ebp
call fcn.00403624
push 8
push ebx
call sub.user32.dll_GetWindowLongA
mov esi, eax
push 4
push ebx
call sub.user32.dll_GetWindowLongA
mov edi, eax
fild dword [esi + 0x400]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 8
xor eax, eax
call fcn.004af0b0
push eax
mov edx, dword [0x4be688]
mov edx, dword [edx + 0xc]
mov eax, ebp
call fcn.004035b8
mov edx, 0x4b3720
call fcn.00404e58
pop edx
call fcn.004035b8
call fcn.00403624
fild dword [esi + 0x404]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 8
xor eax, eax
call fcn.004af0b0
push eax
mov edx, dword [0x4be688]
mov edx, dword [edx + 0x18]
mov eax, ebp
call fcn.004035b8
mov edx, 0x4b372c
call fcn.00404e58
pop edx
call fcn.004035b8
call fcn.00403624
mov eax, ebp
call fcn.00403624
mov edx, 0x4b3738
mov eax, ebp
call fcn.00404e58
call fcn.00403624
push 0x10
push ebx
call sub.user32.dll_GetWindowLongA
cmp eax, 0xff
jg 0x4b36d9
mov ebx, eax
mov dword [esp + 0x2cc], ebx
fild dword [esp + 0x2cc]
add esp, 0xfffffff8
fistp qword [esp]
wait
mov dl, 2
xor eax, eax
call fcn.004af0b0
mov edx, eax
mov eax, ebp
call fcn.004035b8
mov dl, 9
call fcn.00403500
mov ecx, 3
mov edx, ebx
call fcn.0040353c
mov dl, 9
call fcn.00403500
call fcn.00402ca8
cmp ebx, 0x20
jge 0x4b365c
mov dl, 0x2e
mov eax, ebp
call fcn.00403500
call fcn.00402ca8
jmp 0x4b366a
mov edx, ebx
mov eax, ebp
call fcn.00403500
call fcn.00402ca8
mov dl, 9
mov eax, ebp
call fcn.00403500
mov edx, dword [esi + ebx*4]
call fcn.0040357c
call fcn.00402ca8
test edi, edi
jle 0x4b36c5
fild dword [esi + ebx*4]
mov dword [esp + 0x2cc], edi
fild dword [esp + 0x2cc]
fdivp st(1)
fmul dword [0x4b374c]
add esp, 0xfffffff4
fstp xword [esp]
wait
mov dl, 9
mov eax, ebp
call fcn.00403500
mov ecx, 2
xor edx, edx
call fcn.004035f0
mov dl, 0x25
call fcn.00403500
call fcn.00402ca8
mov eax, ebp
call fcn.00403624
inc ebx
cmp ebx, 0x100
jne 0x4b3601
mov eax, ebp
call fcn.00402d90
call fcn.00402634
test eax, eax
je 0x4b36fa
mov edx, dword [0x4cf234]
mov ax, 5
call fcn.004acdac
jmp 0x4b370d
mov ax, 0x13a
call fcn.004aa600
mov edx, 4
call fcn.004b12a8
add esp, 0x2d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b3750
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov ebx, eax
push 0
push 0x46
push 0x4cf288
push 0x46
mov eax, dword [0x4cfde8]
push eax
call sub.user32.dll_GetMenuStringA
mov eax, 0x4cf288
mov dl, 0x2e
call fcn.004b8284
test eax, eax
je 0x4b3783
mov byte [eax], 0
mov eax, 0x4cf288
mov dl, 0x26
call fcn.004b8284
test eax, eax
je 0x4b3796
mov byte [eax], 0x20
push 0x4b3864
push 0x4cf288
call sub.kernel32.dll_lstrcatA
push 0xff
lea eax, [esp + 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
mov edx, esp
mov eax, 0x4cf4b4
call fcn.004b81b0
mov eax, 0x4cf4b4
call fcn.004ab7d8
mov eax, 0x4cf4b4
call fcn.004ab7d8
push 0x4cf288
push 0x4cf4b4
call sub.kernel32.dll_lstrcatA
mov eax, 0x4cf4b4
mov edx, 2
call fcn.004b12a8
test al, al
jne 0x4b37ff
push ebx
call sub.user32.dll_BringWindowToTop
jmp 0x4b385a
push ebx
call sub.user32.dll_BringWindowToTop
push 0xffffffffffffffff
push 0
push ebx
call sub.user32.dll_InvalidateRect
call fcn.004ae0a4
mov eax, dword [0x4d00b0]
push eax
push 0x4cff7e
push 0x4cfef0
push 0x4cff71
call sub.gdi32.dll_CreateDCA
mov esi, eax
test esi, esi
jne 0x4b3849
mov ax, 0x13d
call fcn.004aa600
mov edx, 1
call fcn.004b12a8
jmp 0x4b385a
mov ecx, esp
mov edx, esi
mov eax, ebx
call fcn.004b2b94
push esi
call sub.gdi32.dll_DeleteDC
add esp, 0x100
pop esi
pop ebx
ret
Function at 0x4b4570
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, edx
mov ebx, eax
lea eax, [esp + 8]
push eax
push edi
call sub.user32.dll_GetWindowRect
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 8]
mov dword [esp + 4], eax
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0xc]
push edi
call sub.user32.dll_GetWindowDC
mov edi, eax
push edi
call sub.gdi32.dll_CreateCompatibleDC
mov ebp, eax
push esi
mov eax, dword [esp + 8]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [esp], eax
mov eax, dword [esp]
push eax
push ebp
call sub.gdi32.dll_SelectObject
push 0xcc0020
push 0
push 0
push edi
push esi
mov eax, dword [esp + 0x18]
push eax
push 0
push 0
push ebp
call sub.gdi32.dll_BitBlt
mov dword [ebx + 0x14], 0x36
mov eax, dword [esp + 4]
lea eax, [eax + eax*2]
add eax, 3
and eax, 0x7ffffffc
mov dword [ebx + 0x10], eax
mov edx, eax
imul edx, esi
add edx, dword [ebx + 0x14]
mov eax, ebx
call fcn.00410604
mov eax, dword [ebx + 4]
add eax, 0xe
mov dword [ebx + 0x18], eax
mov cl, 0x42
xor edx, edx
mov eax, ebx
call fcn.004107f8
mov cl, 0x4d
mov edx, 1
mov eax, ebx
call fcn.004107f8
mov ecx, dword [ebx + 8]
mov edx, 2
mov eax, ebx
call fcn.00410818
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.00410804
xor ecx, ecx
mov edx, 8
mov eax, ebx
call fcn.00410804
mov ecx, dword [ebx + 0x14]
mov edx, 0xa
mov eax, ebx
call fcn.00410818
mov eax, dword [ebx + 0x18]
mov dword [eax], 0x28
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov word [eax + 0xc], 1
mov word [eax + 0xe], 0x18
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
xor edx, edx
mov dword [eax + 0x18], edx
xor edx, edx
mov dword [eax + 0x1c], edx
xor edx, edx
mov dword [eax + 0x20], edx
xor edx, edx
mov dword [eax + 0x24], edx
push 0
mov eax, dword [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 0x14]
add eax, edx
push eax
push esi
push 0
mov eax, dword [esp + 0x14]
push eax
push edi
call sub.gdi32.dll_GetDIBits
mov al, 1
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b67c0
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, edx
mov edx, dword [0x4be784]
cmp byte [edx + 0x187f], 0
je 0x4b6814
push eax
push 0x4b6778
push eax
call sub.user32.dll_EnumChildWindows
test bl, bl
je 0x4b6814
mov eax, dword [0x4be3cc]
cmp dword [eax], 0
jne 0x4b6814
mov eax, dword [0x4beb60]
mov eax, dword [eax]
call fcn.0040678c
push eax
mov eax, dword [0x4bf704]
push eax
mov eax, 0x4b6660
push eax
push 2
call sub.user32.dll_SetWindowsHookExA
mov edx, dword [0x4be3cc]
mov dword [edx], eax
pop ebx
ret
Function at 0x401868
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x40637c
call fcn.00405f40
push ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
and dword [ebp - 4], 0
push str.QQ.exe
lea ecx, [ebp - 0x10]
call fcn.00405d76
push 5
push 0
push 0x40aa94
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4018be
Capabilities:
Get disk size

Disassembly:
mov eax, 0x4063b0
call fcn.00405f40
sub esp, 0x20
push ebx
push esi
push 1
lea eax, [ebp - 0x24]
pop esi
xor ebx, ebx
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 4], esi
push dword [ebp + 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
add ecx, 0x100000
adc eax, ebx
cmp eax, dword [ebp - 0x18]
jb 0x4019cc
ja 0x40191e
cmp ecx, dword [ebp - 0x1c]
jb 0x4019cc
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
push 5
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
push 6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push dword [ebp + 0x18]
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 4
push dword [ebp + 0x14]
push dword [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push 2
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 3
jne 0x401986
push 2
pop esi
jmp 0x40198d
cmp eax, 4
je 0x40198d
xor esi, esi
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, esi
jmp 0x4019e5
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret