joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4ea4
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
xor ebx, ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b50bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.0040725c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 0x4b50d8
call fcn.00408458
je 0x4b5090
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4b5090
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 1
lea eax, [ebp - 0xf8]
xor ecx, ecx
mov edx, 0xc8
call fcn.00405008
mov dword [ebp - 0x18], 0xc8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004080c4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_LookupAccountNameW
mov eax, dword [ebp - 0x14]
call fcn.004048fc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004080c4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_LookupAccountNameW
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4b4fba
mov edx, dword [ebp - 0x14]
add edx, edx
mov eax, dword [ebp + 8]
call fcn.00408248
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004080c4
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
call fcn.0045baec
mov eax, dword [ebp - 0x10]
call fcn.0040494c
cmp byte [ebp - 5], 0
je 0x4b502e
lea eax, [ebp - 0x24]
call fcn.004b4e58
lea eax, [ebp - 0xfc]
lea edx, [ebp - 0xf8]
mov ecx, 0x64
call fcn.00408170
cmp dword [ebp - 0xfc], 0
setne al
test al, al
je 0x4b5009
lea eax, [ebp - 0x28]
lea edx, [ebp - 0xf8]
mov ecx, 0x64
call fcn.00408170
jmp 0x4b5014
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x24]
call fcn.00407684
push dword [ebp - 0x28]
push 0x4b50d8
mov eax, dword [ebp - 4]
push dword [eax]
mov eax, dword [ebp - 4]
mov edx, 3
call fcn.004083a8
mov eax, dword [ebp + 8]
cmp dword [eax], 0
sete al
and al, byte [ebp + 0xc]
je 0x4b5090
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004080c4
push eax
call sub.kernel32.dll_lstrlenW_1
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
add edx, edx
mov eax, dword [ebp + 8]
call fcn.00408248
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00422d54
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.004080c4
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
call fcn.0045baec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b50c2
lea eax, [ebp - 0x100]
mov edx, 2
call fcn.004072bc
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004072bc
ret
Function at 0x4b5708
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetVersionExW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp dword [ebp - 0x108], 2
sete byte [0x7a1909]
cmp dword [ebp - 0x114], 6
setae byte [0x7a1908]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x4b7a00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407340
xor eax, eax
push ebp
push 0x4b7a88
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xa], 0
cmp byte [ebp - 9], 0
je 0x4b7a4c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
jmp 0x4b7a72
cmp dword [ebp - 8], 0
je 0x4b7a72
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
push 4
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
call sub.advapi32.dll_SetFileSecurityW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xa], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7a8f
lea eax, [ebp - 4]
call fcn.0040725c
ret
Function at 0x4b7a98
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00407340
xor eax, eax
push ebp
push 0x4b7bed
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 7], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [0x7173e0]
cmp byte [eax], 0
je 0x4b7b92
push 1
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4b6fe0]
call fcn.004096a0
add esp, 4
mov eax, dword [ebp - 0x10]
call fcn.0040725c
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 1
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0x1fffff
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x10], 1
lea eax, [ebp - 0x10]
call fcn.004b7020
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4b7b5d
push 0x14
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebp - 0xc], eax
push 1
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 7], al
cmp dword [ebp - 0xc], 0
jne 0x4b7b69
cmp byte [ebp - 7], 0
je 0x4b7ba4
mov dword [ebp - 0x1c], 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xffffffff
push ebp
lea edx, [ebp - 0x1c]
mov cl, byte [ebp - 6]
mov eax, dword [ebp - 4]
call fcn.004b7a00
pop ecx
mov byte [ebp - 7], al
jmp 0x4b7ba4
push ebp
mov cl, byte [ebp - 6]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004b7a00
pop ecx
mov byte [ebp - 7], al
cmp byte [ebp - 5], 0
je 0x4b7bba
push 6
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp dword [ebp - 0xc], 0
je 0x4b7bc9
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7bf4
lea eax, [ebp - 0x10]
mov edx, dword [0x4b6fe0]
call fcn.004097c4
lea eax, [ebp - 4]
call fcn.0040725c
ret
Function at 0x4bb828
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bb9e3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407684
mov eax, dword [ebp - 4]
call fcn.004bb178
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x4bb87a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004084d8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.004bc464
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4bb959
xor eax, eax
push ebp
push 0x4bb952
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.004bb418
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.004bba18
test al, al
je 0x4bb930
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.004073e4
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4bb930
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.004080c4
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004bb378
test al, al
je 0x4bb92a
mov eax, dword [ebp - 8]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040811c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004bb828
dec ebx
cmp ebx, 0xffffffff
jne 0x4bb8d9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb959
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.004bb418
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
cmp byte [0x7a1938], 0
je 0x4bb999
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004bb404
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004bb378
mov ebx, eax
jmp 0x4bb9c0
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.004bb404
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.004bb378
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb9ea
lea eax, [ebp - 0x3c]
call fcn.0040725c
lea eax, [ebp - 8]
mov edx, 2
call fcn.004072bc
ret
Function at 0x4bba84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4bbb3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004bba18
test al, al
je 0x4bbb1e
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004073e4
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x4bbb1e
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040811c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x4bbad7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bbb43
lea eax, [ebp - 0x2c]
call fcn.0040725c
lea eax, [ebp - 4]
call fcn.0040725c
ret

Function at 0x4bc340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.004bb190
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.004080c4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.004bb378
test al, al
jne 0x4bc3a8
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x717dc8]
mov dl, 1
mov eax, dword [0x4b9f64]
call fcn.0042a688
call fcn.00406938
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4bc3b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.004080c4
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edx, eax
mov eax, ebx
call fcn.004bb378
test al, al
jne 0x4bc415
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x718860]
mov dl, 1
mov eax, dword [0x4b9f64]
call fcn.0042a688
call fcn.00406938
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004bb1c0
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4bca14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4bcb3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.004bb418
xor eax, eax
push ebp
push 0x4bcb17
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bba18
test al, al
je 0x4bcafb
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004bc8f4
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004073e4
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x4bcafb
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bb378
test al, al
je 0x4bcaf7
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040811c
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.004bc8f4
pop ecx
inc edi
dec ebx
jne 0x4bca9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcb1e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.004bb418
ret
Function at 0x4bcb4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bcd9a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004bb418
xor eax, eax
push ebp
push 0x4bcd70
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bba18
test al, al
je 0x4bcd54
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.004073e4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4bcd54
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.004080c4
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bb378
test al, al
je 0x4bcd48
mov eax, dword [ebp - 4]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040811c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bc464
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4bcd48
xor eax, eax
push ebp
push 0x4bcd41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004bb418
xor eax, eax
push ebp
push 0x4bcd23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040811c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bb41c
mov eax, dword [ebp - 4]
call fcn.004080c4
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040811c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004bc464
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4bcd00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004bca14
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004bcb4c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcd07
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4bcbd7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bcd77
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004bb418
ret
Function at 0x4c578c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4c5792
ret
Function at 0x4d336c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d352f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x30], 0
jne 0x4d350b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
je 0x4d350b
mov eax, dword [ebp - 4]
add eax, 0x2c
push eax
mov eax, dword [ebp - 4]
add eax, 0x28
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
shl eax, 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
imul dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x4d3334]
call fcn.004096a0
add esp, 4
lea eax, [ebp - 8]
call fcn.0040ae80
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x71782c]
push eax
call sub.windowscodecs.dll_WICConvertBitmapSource
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004094ec
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x2c
call fcn.00405008
mov dword [ebp - 0x44], 0x2c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x3c], eax
mov word [ebp - 0x38], 1
mov word [ebp - 0x36], 0x20
mov dl, 1
mov eax, dword [0x4c4040]
call fcn.004cee64
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
xor eax, eax
push ebp
push 0x4d34dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, 7
call fcn.004d1294
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
push 0
call sub.gdi32.dll_SetDIBits
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.004cfeec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d350b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3536
lea eax, [ebp - 0x10]
mov edx, dword [0x4d3334]
call fcn.004097c4
lea eax, [ebp - 8]
call fcn.0040ae80
ret
Function at 0x4de960
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x70fc28
test edx, edx
jne 0x4de97f
xor eax, eax
jmp 0x4dea9d
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4de99c
push esi
push edx
push eax
call fcn.004deaa4
add esp, 0xc
jmp 0x4dea9d
push esi
push edx
push eax
call fcn.004ded64
add esp, 0xc
jmp 0x4dea9d
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4f7a8c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.user32.dll_GetMessagePos
call fcn.0040d334
mov dword [ebp - 0x1c], eax
movsx eax, word [ebp - 0x1c]
mov dword [ebp - 0x24], eax
movsx eax, word [ebp - 0x1a]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004efe38
cmp dword [ebp - 0xc], 0
jne 0x4f7ae2
push 0
push 0
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004f78bc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4f7be9
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
je 0x4f7b14
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x134], eax
jmp 0x4f7b26
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 8]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0xa]
cmp eax, 0x201
jge 0x4f7b65
add eax, 0xffffff5f
sub eax, 2
jb 0x4f7b7d
dec eax
sub eax, 2
jb 0x4f7b8f
dec eax
sub eax, 2
jb 0x4f7b86
jmp 0x4f7b98
add eax, 0xfffffdff
sub eax, 2
jb 0x4f7b7d
dec eax
sub eax, 2
jb 0x4f7b8f
dec eax
sub eax, 2
jb 0x4f7b86
jmp 0x4f7b98
mov byte [ebp - 0x12c], 0
jmp 0x4f7b9f
mov byte [ebp - 0x12c], 2
jmp 0x4f7b9f
mov byte [ebp - 0x12c], 1
jmp 0x4f7b9f
mov byte [ebp - 0x12c], 0
lea eax, [ebp - 0x124]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0x124]
call fcn.00594034
mov ebx, eax
call fcn.004eb8c4
or bx, ax
mov word [ebp - 0x12b], bx
lea eax, [ebp - 0x138]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, dword [ebp - 0xc]
call fcn.004f21c0
mov edx, dword [ebp - 8]
mov dword [edx + 0xc], eax
mov byte [ebp - 0xd], 1
jmp 0x4f7bed
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
pop ebx
mov esp, ebp
pop ebp
ret