joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471838
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4719e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4719c4
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004058c8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4719b3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004628c4
test al, al
je 0x4719a6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4719f4
lea eax, [ebp - 0x254]
call fcn.0040c504
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4719a6
xor eax, eax
push ebp
push 0x47199f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x471a2c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x471988
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405b38
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x471988
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00405b38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4719a6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4718a9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00422d9c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4719ea
lea eax, [ebp - 0x260]
call fcn.004058c8
ret

Function at 0x47235c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x526cac]
cmp byte [eax + 0xad], 0
jne 0x4723cd
cmp dword [0x526cc8], 0
jne 0x47238e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x472318
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x526cc8], eax
cmp dword [0x526cc4], 0
jne 0x4723a9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x526cc4], eax
cmp dword [0x526ccc], 0
jne 0x4723cd
push esp
push 0
push 0
push 0x4722bc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x526ccc], eax
pop edx
ret
Function at 0x4725d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4725e7
add esp, 0xfffffff0
call fcn.00404c28
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427868
mov eax, dword [0x520c90]
cmp word [eax + 2], 0
jne 0x47260f
mov eax, dword [0x520c90]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004742d8
mov eax, dword [0x520e10]
cmp word [eax + 2], 0
jne 0x472629
mov eax, dword [0x520e10]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004744e4
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41dcb0]
call fcn.004048d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41dcb0]
call fcn.004048d4
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x41dcb0]
call fcn.004048d4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42c510]
call fcn.0043488c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4727e0
mov eax, dword [0x520a60]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00434c60
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x474ba8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x520a60]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.00410fc0
test eax, eax
je 0x472730
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040bae4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.00410ff4
test eax, eax
je 0x472744
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00405b38
mov byte [ebx + 0xd4], 0
push ebx
push 0x473d4c
call fcn.004289e4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x520784]
cmp byte [eax], 0
jne 0x472795
mov eax, ebx
call fcn.00472924
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00474dbc
mov eax, ebx
call fcn.00475920
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4727d5
call fcn.00404c80
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472ba4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x472c43
cmp dword [ebx + 0x94], 0
jne 0x472c3d
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x472b2c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x472c3d
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x472c03
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x472c3d
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00420380
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x472c12
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x472e5c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x526cac]
cmp dword [eax + 0x30], 0
je 0x472fb9
test bl, bl
jne 0x472f0a
cmp dword [esi + 0x9c], 0
jne 0x472eff
mov eax, esi
call fcn.0047579c
push eax
push 0x472d88
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x472ed0
mov eax, dword [0x526cac]
call fcn.00475e7c
test al, al
je 0x472ed0
mov eax, dword [0x526cd0]
call fcn.00406fec
mov edi, eax
cmp edi, 0
jl 0x472ed0
push 0
mov eax, dword [0x526cd0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x472eba
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x472eff
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00420380
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x472edf
inc dword [esi + 0x9c]
jmp 0x472fb9
cmp dword [esi + 0x9c], 0
jle 0x472fb9
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x472fb9
cmp dword [esi + 0x44], 0
je 0x472f65
mov eax, dword [0x526cac]
call fcn.00475e7c
test al, al
je 0x472f65
mov eax, dword [0x526cd0]
call fcn.00406fec
mov edi, eax
cmp edi, 0
jl 0x472f65
push 5
mov eax, dword [0x526cd0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x472f4f
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x472f94
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00420380
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x472f74
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x526cd0
mov ecx, 1
mov edx, dword [0x472d68]
call fcn.004071a0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x473aa0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x473b0a
mov eax, ebx
call fcn.00475e7c
test al, al
jne 0x473b0a
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004059b8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x473af7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x473b17
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040591c
jmp 0x473b17
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040591c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x474fa0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x47500e
mov eax, esi
call fcn.0045d4b0
test al, al
je 0x47500e
mov eax, dword [ebx + 0x84]
call fcn.0045d110
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x47500e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x475002
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045d110
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00454f30
jmp 0x47500e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00474ddc
pop esi
pop ebx
ret
Function at 0x4766cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47673b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004058c8
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jbe 0x47671b
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405b38
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476742
lea eax, [ebp - 4]
call fcn.004058c8
ret

Function at 0x47679c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47680b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004058c8
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4767eb
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00405b38
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040591c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476812
lea eax, [ebp - 4]
call fcn.004058c8
ret
Function at 0x48f914
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4124c8]
call fcn.00406558
xor eax, eax
push ebp
push 0x48fab5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x51bcd4], 0
jne 0x48f96f
mov ecx, dword [0x5207c8]
mov dl, 1
mov eax, dword [0x409334]
call fcn.00410120
call fcn.0040523c
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403c30
mov eax, ebx
call fcn.004062a0
mov dword [ebp - 0x24], eax
mov esi, 0x48fac4
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004079d8
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004062b0
test eax, eax
jle 0x48fa58
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48fa44
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405b38
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x48f9ea
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405b50
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x48fa00
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405b50
mov eax, dword [ebp - 0x54]
call fcn.00405d58
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405b38
mov eax, dword [ebp - 0x58]
call fcn.00405d58
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x48fa46
xor eax, eax
test al, al
je 0x48fa51
mov ebx, 0x15
jmp 0x48fa5d
mov ebx, 0x10
jmp 0x48fa5d
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x51bcd4]
call fcn.0048f794
mov eax, dword [ebp - 4]
call fcn.0048f794
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004079f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fabc
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004058ec
lea eax, [ebp - 0xc]
mov edx, dword [0x4124c8]
call fcn.00406628
ret

Function at 0x4a3c64
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x51c638]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret
Function at 0x4a3c9c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x4a3cb4
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4a3cad
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.00403c30
xor edx, edx
mov eax, 0x51c838
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x4a3d1b
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x4a3cd2
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x4a3f5c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x4a3f75
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x4a3f6e
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x4a3f87
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x4a3f80
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.004a3b54
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4a3fa1
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.004a3c64
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x4a4029
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x4a4047
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.004a3be4
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x4a4071
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a4088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4a40a1
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4a409a
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x4a40b5
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a3a54
test bl, bl
jne 0x4a418f
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x527fd8
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a40ed
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a4102
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a3f5c
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x4a4135
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x4a40e2
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a4159
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x4a416b
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x4a4180
jmp 0x4a4250
cmp bl, 1
jne 0x4a4250
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x528032
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x4a41af
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x4a41c4
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a3f5c
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x4a41f7
sub ebx, 6
inc dword [ebp - 8]
jne 0x4a41a4
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x4a421f
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x4a4231
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x4a4246
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.004a3ad4
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a5a34
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x4a5a4a
add esp, 0xfffffff0
call fcn.00404c28
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a5ba1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, esi
call fcn.0040591c
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b874
mov edx, dword [ebp - 4]
lea eax, [edi + 8]
mov ecx, 0x4a5bd0
call fcn.00405be0
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x1c], eax
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x24], eax
mov dl, 1
mov eax, dword [0x41e31c]
call fcn.004048d4
mov dword [edi + 0x20], eax
mov byte [edi + 0x4c], 0
mov byte [edi + 0x4d], 0
mov byte [edi + 0x4e], 0
mov eax, dword [0x5208c4]
mov eax, dword [eax]
call fcn.00405d58
push eax
push 0
push 0x4a5bdc
push 0x4a5be4
call sub.kernel32.dll_GetPrivateProfileIntA
mov esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.0040e0f0
call fcn.00403508
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
test edx, edx
jge 0x4a5b2b
neg eax
adc edx, 0
neg edx
cmp edx, 0
jne 0x4a5b37
cmp eax, 0xf
jb 0x4a5b80
jmp 0x4a5b39
jl 0x4a5b80
mov eax, dword [edi + 8]
call fcn.00405d58
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5208c4]
mov eax, dword [eax]
call fcn.00405d58
push eax
call fcn.0040e0f0
call fcn.00403508
push edx
push eax
lea eax, [ebp - 8]
call fcn.0040b0c4
mov eax, dword [ebp - 8]
call fcn.00405d58
push eax
push 0x4a5bdc
push 0x4a5be4
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5ba8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004058ec
ret
Function at 0x4a6f20
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov byte [ebp - 1], cl
mov esi, edx
mov ebx, eax
cmp bl, 0x90
jne 0x4a6f75
push 0x90
call sub.user32.dll_GetKeyState
and ax, 1
cmp al, 1
sbb ebx, ebx
inc ebx
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
test bl, bl
je 0x4a6f60
and byte [ebp - 0x72], 0xfe
jmp 0x4a6f64
or byte [ebp - 0x72], 1
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_SetKeyboardState
jmp 0x4a6ffc
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov byte [ebp - 2], al
test si, si
jbe 0x4a6ffc
mov eax, ebx
movzx eax, al
bt dword [0x51f200], eax
jae 0x4a6fca
mov eax, dword [ebp + 8]
push eax
mov ecx, 1
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004a6ed4
pop ecx
cmp byte [ebp - 1], 0
je 0x4a6ff7
mov eax, dword [ebp + 8]
push eax
mov ecx, 3
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004a6ed4
pop ecx
jmp 0x4a6ff7
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004a6ed4
pop ecx
cmp byte [ebp - 1], 0
je 0x4a6ff7
mov eax, dword [ebp + 8]
push eax
mov ecx, 2
movzx edx, byte [ebp - 2]
mov eax, ebx
call fcn.004a6ed4
pop ecx
dec si
jne 0x4a6f8a
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a7004
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
push 0
movzx eax, bl
push eax
call sub.user32.dll_MapVirtualKeyA
and al, 0xff
mov edx, ebx
movzx edx, dl
bt dword [0x51f200], edx
jae 0x4a7038
mov edx, dword [ebp + 8]
push edx
xor ecx, ecx
mov edx, eax
mov eax, ebx
call fcn.004a6ed4
pop ecx
pop ebx
pop ebp
ret
mov edx, dword [ebp + 8]
push edx
mov ecx, 2
mov edx, eax
mov eax, ebx
call fcn.004a6ed4
pop ecx
pop ebx
pop ebp
ret