joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x48432d
cmp byte [edx], al
je 0x484325
inc ebx
cmp byte [ebx], al
jne 0x484320
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x4843cf
mov ecx, edi
cmp edi, 2
jge 0x484347
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x48434a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x48439e
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x484380
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58f230]
cmp cl, byte [edx + 0x58f230]
jne 0x484380
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484363
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x58f230]
movzx eax, byte [eax + 0x58f230]
sub eax, ecx
jne 0x4843bf
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0044eb10
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x4843cf
jmp 0x4843c2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x484338
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4844f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x48451d
cmp byte [edx], al
je 0x484515
jmp 0x484510
inc ebx
cmp byte [ebx], al
jne 0x484510
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x4845c3
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x48453d
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x48459b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x484580
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58f230]
cmp cl, byte [edx + 0x58f230]
jne 0x48457d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484560
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x58f230]
movzx ecx, byte [ecx + 0x58f230]
sub eax, ecx
jne 0x4845b0
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.0044eb10
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x4845c3
jmp 0x4845b3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x484533
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, edx
mov dword [esp + 0x1c], esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
test esi, esi
je 0x484b2d
test edi, edi
je 0x48496d
cmp dword [edi + 0x200], 0
jne 0x48497c
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x484b2d
mov ebx, dword [esi + 8]
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x484acf
jmp 0x484990
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x18], esi
test edi, edi
je 0x4849a8
cmp dword [edi + 0x200], 0
jne 0x484a6f
mov esi, dword [ebx]
mov ecx, esi
mov dword [esp + 0x30], esi
test esi, esi
je 0x4849ce
cmp byte [esi], 0
je 0x4849c6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x4849c0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x18]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov edx, dword [eax]
mov dword [esp + 0x34], edx
test edx, edx
je 0x484a41
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
test ecx, ecx
jle 0x484a35
mov ebx, ecx
mov edi, eax
mov ecx, esi
lea ebx, [ebx]
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x58f230]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x484a00
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
xor edx, edx
div dword [esp + 0x34]
mov eax, dword [esp + 0x14]
jmp 0x484a43
xor edx, edx
push edx
mov dword [esp + 0x14], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0044ea00
add esp, 8
test eax, eax
je 0x484a6b
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.0044eab0
add esp, 4
mov esi, dword [esp + 0x18]
test edi, edi
je 0x484a7c
cmp dword [edi + 0x200], 0
jne 0x484a90
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x484a90
dec dword [eax]
jne 0x484a90
push eax
call fcn.0044a640
add esp, 4
mov edx, dword [ebx + 0x24]
mov ecx, edi
call fcn.0047b540
mov edx, dword [ebx + 0x10]
mov ecx, edi
call fcn.0044a6e0
test byte [ebx + 0x38], 0x10
je 0x484ab4
mov edx, dword [ebx + 0x20]
mov ecx, edi
call fcn.0044a6e0
mov edx, ebx
mov ecx, edi
call fcn.0044a6e0
mov dword [esp + 0x1c], esi
mov ebx, esi
test esi, esi
jne 0x484990
mov esi, dword [esp + 0x20]
mov edx, esi
mov ecx, edi
call fcn.00491860
mov edx, esi
mov ecx, edi
call fcn.004848c0
mov edx, dword [esi]
mov ecx, edi
call fcn.0044a6e0
mov edx, dword [esi + 0x14]
mov ecx, edi
call fcn.0044a6e0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x484b0d
mov edx, esi
mov ecx, edi
call fcn.0049ac80
mov edx, esi
mov ecx, edi
call fcn.0044a6e0
mov esi, dword [esp + 0x20]
mov ecx, edi
mov edx, dword [esi + 0x18]
call fcn.0047c250
mov edx, esi
mov ecx, edi
call fcn.004ab1c0
mov edx, esi
mov ecx, edi
call fcn.0044a6e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x486f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0044c550
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x486fb6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x486fb0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x4870f1
mov edi, ebx
cmp ebx, 2
jge 0x486fe1
xor edi, 1
test esi, esi
je 0x48703f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x48701d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x58f230]
cmp cl, byte [edx + 0x58f230]
jne 0x48701d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x487000
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x58f230]
movzx ecx, byte [ecx + 0x58f230]
sub eax, ecx
jne 0x4870b3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x48708b
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x487080
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x58f230]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x487060
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x48708d
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.0044ea00
add esp, 8
test eax, eax
je 0x4870ac
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4870d0
jmp 0x4870b6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4870b6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x486fd7
test eax, eax
je 0x4870f1
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.00484200
add esp, 0x18
jmp 0x4870f4
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 4
jle 0x486f80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
Function at 0x4bda50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4bda70
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4bda99
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4bda96
inc esi
cmp esi, edx
jb 0x4bda87
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4bdba1
cmp ecx, 3
jbe 0x4bdab2
xor eax, eax
jmp 0x4bdaf0
dec ecx
shl eax, cl
and eax, 7
je 0x4bdaf0
movzx ecx, byte [eax + 0x59251c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x592514], 0
mov cl, byte [edx + 4]
je 0x4bdada
test cl, cl
je 0x4bdada
cmp cl, 0xff
jne 0x4bdaed
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4bda80
mov edx, dword [ebp - 8]
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x4bdb12
cmp cl, 0xff
je 0x4bdb12
mov ecx, dword [ebp - 4]
and eax, 3
add eax, eax
or eax, 1
inc edi
jmp 0x4bda80
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4bdb6e
movzx edx, byte [eax + 0x59251c]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4bdb5a
cmp dl, 0xff
jne 0x4bdb6e
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4bdb30
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
add edi, 5
mov byte [esi + 2], cl
mov ecx, dword [ebp - 4]
jmp 0x4bda80
pop esi
pop ebx
cmp ecx, 3
jbe 0x4bdbb6
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4bfdcf
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4bfdf2
or esi, 1
push 1
call edi
test ax, ax
jns 0x4bfdfe
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4bfe0a
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4bfe16
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c09bb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xd0]
call fcn.004befe2
mov edi, dword [ebp + 8]
test eax, eax
jle 0x4c0a0b
push ebx
mov byte [ebp + 0xb], 0
call fcn.004bf005
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4c0a66
lea ecx, [esi + 0xd0]
inc ebx
call fcn.004befe2
cmp ebx, eax
jl 0x4c09da
sub edi, 0x100
je 0x4c0ac0
sub edi, 4
je 0x4c0a6a
dec edi
dec edi
jne 0x4c0ab5
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.00547f3e
pop ecx
mov ecx, dword [esi + 0x50]
lea edx, [ebp + 8]
push 0x8000000a
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x4c3b73
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4c0ab5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4c0ab7
cmp dword [esi + 0x54], 0
je 0x4c0ab5
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004bfdcf
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4c0ab5
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x4c0b0d
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x4c0b0d
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x4c0b0d
mov ecx, dword [esi + 0x54]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0053d3af
pop ecx
pop ecx
test eax, eax
je 0x4c0b0d
mov ecx, dword [esi + 0x54]
call fcn.004d3ee0
test al, al
jne 0x4c0ab5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.004c26f5
jmp 0x4c0a66
Function at 0x4c22e4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx]
je 0x4c2310
cmp esi, dword [ebx + 0x54]
je 0x4c23da
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [ebx + 0x54]
je 0x4c23da
cmp dword [ebx + 0x54], 0
je 0x4c2367
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
xor edi, edi
mov ecx, ebx
push edi
push edi
push str.killfocus
push dword [ebx + 0x54]
call fcn.004c293a
mov dword [ebx + 0x54], edi
test esi, esi
je 0x4c23da
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x4c23da
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x4c23da
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x4c23da
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x54], esi
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x15
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push str.setfocus
push dword [ebx + 0x54]
mov ecx, ebx
call fcn.004c293a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c8ed4
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x2cc
mov eax, 0x574da8
call fcn.005487bb
mov esi, ecx
mov ebx, dword [ebp + 8]
call fcn.004c910c
call fcn.004c045e
push eax
lea ecx, [ebp - 0x9c]
call fcn.004bf17e
and dword [ebp - 4], 0
call fcn.004c0464
mov edx, eax
mov ecx, eax
call fcn.004bf2cb
lea ecx, [ebp - 0x9c]
test al, al
je 0x4c8fee
push ebx
call fcn.004bf516
xor ebx, ebx
lea ecx, [ebp - 0x9c]
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
call fcn.004bf1bc
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2d8], eax
push ebx
cmp eax, 0xffffffff
jne 0x4c8f5e
push 0x59ecc4
jmp 0x4c90c3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
test edi, edi
jne 0x4c8f71
push ebx
jmp 0x4c905f
cmp edi, 0x400000
jbe 0x4c8f7f
push ebx
jmp 0x4c9070
push edi
mov dword [ebp - 0x2d0], ebx
call fcn.00520986
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2d0]
push 0
push eax
push edi
push ebx
push dword [ebp - 0x2d8]
mov dword [ebp - 0x2d4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x2d8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2d0], edi
je 0x4c8fd9
push ebx
call fcn.0053c06b
pop ecx
mov ecx, esi
call fcn.004c910c
push 0
push str.Could_not_read_file
jmp 0x4c90c3
push ecx
push edi
push ebx
mov ecx, esi
call fcn.004c8e41
push dword [ebp - 0x2d4]
jmp 0x4c90ef
push edx
call fcn.004bf4f9
call fcn.004c046a
test al, al
je 0x4c9004
call fcn.004c0470
jmp 0x4c901b
push 2
lea ecx, [ebp - 0x9c]
call fcn.004bf2f3
xor edx, edx
mov ecx, eax
call fcn.004d2c32
pop ecx
mov edi, eax
test edi, edi
jne 0x4c902c
push eax
push str.Error_opening_zip_file
jmp 0x4c90c3
lea eax, [ebp - 0x2cc]
mov edx, ebx
push eax
lea eax, [ebp - 0x2d4]
push eax
push ecx
mov ecx, edi
call fcn.004d2dc0
add esp, 0xc
test eax, eax
je 0x4c9054
push 0
push str.Could_not_find_ziped_file
jmp 0x4c90c3
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
jne 0x4c9066
push ebx
push str.File_is_empty
jmp 0x4c90c3
cmp ebx, 0x400000
jbe 0x4c9077
push 0
push str.File_too_large
jmp 0x4c90c3
push ebx
call fcn.00520986
mov edx, dword [ebp - 0x2d4]
mov ecx, edi
push ebx
push eax
mov dword [ebp - 0x2d0], eax
call fcn.004d2e94
add esp, 0xc
test eax, eax
je 0x4c90ce
cmp eax, 0x600
je 0x4c90ce
push dword [ebp - 0x2d0]
call fcn.0053c06b
pop ecx
call fcn.004c046a
test al, al
jne 0x4c90bc
mov ecx, edi
call fcn.004d2ec7
push 0
push str.Could_not_unzip_file
mov ecx, esi
call fcn.004c9830
mov bl, al
jmp 0x4c90f7
call fcn.004c046a
test al, al
jne 0x4c90de
mov ecx, edi
call fcn.004d2ec7
mov edi, dword [ebp - 0x2d0]
push ecx
push ebx
push edi
mov ecx, esi
call fcn.004c8e41
push edi
mov bl, al
call fcn.0053c06b
pop ecx
lea ecx, [ebp - 0x9c]
call fcn.004bf1a3
mov al, bl
call fcn.0054876a
ret 8
Function at 0x4c9881
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
shr edx, 0x10
mov esi, ecx
push edi
test dx, dx
je 0x4c98be
cmp word [eax], 0x3c
jne 0x4c98b5
push eax
call fcn.004c8df6
test al, al
jne 0x4c992e
xor eax, eax
jmp 0x4c993e
push ecx
push eax
call fcn.004c8ed4
jmp 0x4c98a6
mov ebx, dword [ebp + 0xc]
push ebx
push eax
call fcn.004c044f
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x4c98ae
push edi
call fcn.004c044f
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x4c98f3
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4c98ae
mov eax, dword [ebp + 0x10]
push ecx
push edi
mov dword [esi + 0x140], eax
call fcn.004c044f
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.004c8e41
test al, al
je 0x4c98ae
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [esi + 0x144], ebx
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004c9947
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4d0d52
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4d0d5d
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4d0e15
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
dec edi
jne 0x4d0d78
pop edi
test esi, esi
je 0x4d0e2e
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x593650]
inc edx
dec esi
jne 0x4d0e19
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x4d161e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x4d1658
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4d1653
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x4d167f
mov edx, dword [edi + 0x18]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x14]
jbe 0x4d1668
mov esi, dword [edi + 0x14]
sub esi, edx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0053c3c0
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d28f1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x5bb250]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov ebx, ecx
test esi, esi
je 0x4d29a3
movzx eax, word [esi]
test ax, ax
je 0x4d29a3
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4d292f
cmp ax, 0x5c
jne 0x4d2931
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4d2923
cmp edi, esi
je 0x4d2976
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.00545196
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4d29b3
xor eax, eax
lea edx, [ebp - 0x20c]
mov ecx, ebx
mov word [ebp + edi - 0x20c], ax
call fcn.004d28f1
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0053d2b1
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0053d282
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0053e21c
mov esp, ebp
pop ebp
ret
call fcn.0053bdae
int3

Function at 0x4d4c39
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x4d4], 0
je 0x4d4ca2
cmp dword [ebp + 8], 0x100
jne 0x4d4c92
cmp word [ebp + 0xc], 0xd
jne 0x4d4c92
cmp byte [esi + 0x4da], 0
je 0x4d4c77
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4d4c92
cmp byte [esi + 0x4db], 0
jne 0x4d4c92
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x4d4c8e
push ecx
push 0
push 0
push str.return
push esi
call fcn.004c293a
xor eax, eax
jmp 0x4d4ca5
mov eax, dword [esi + 0x4d4]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop esi
pop ebp
ret 0x10