joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484214
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x5c4e18]
cmp dword [eax + 0x30], 0
je 0x4842be
cmp dword [ebx + 0x94], 0
jne 0x4842b8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4841a4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4842b8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x48427e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4842b8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00422014
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x48428d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x484e20
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x484e55
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004052bc
jmp 0x484e62
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405220
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x485f6c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x485fad
mov eax, esi
call fcn.0046b978
test al, al
je 0x485fad
mov eax, dword [ebx + 0x84]
call fcn.0046b674
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x485fad
push 0
mov eax, dword [ebx + 0x84]
call fcn.0046b674
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48cfd4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x48d068
push 0
mov eax, ebx
call fcn.0040569c
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x48d043
mov eax, esi
call fcn.0040549c
inc eax
push eax
mov eax, esi
call fcn.0040569c
push eax
push 1
push 0
mov eax, edi
call fcn.0040569c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x48d05e
mov ecx, dword [0x5c1368]
mov dl, 1
mov eax, dword [0x48b5f8]
call fcn.00410cc0
call fcn.00404b48
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x48d0bc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41ea34]
call fcn.00405fa4
xor eax, eax
push ebp
push 0x48d200
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5b5b58], 0
jne 0x48d10f
mov ecx, dword [0x5c1040]
mov dl, 1
mov eax, dword [0x40b44c]
call fcn.00410cc0
call fcn.00404b48
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040380c
mov eax, ebx
call fcn.00405bcc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48d210
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004072bc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405bdc
test eax, eax
jle 0x48d1a7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48d1a0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405464
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040544c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040c3d0
test eax, eax
jne 0x48d1a0
mov ebx, 0x15
jmp 0x48d1ac
mov ebx, 0x10
jmp 0x48d1ac
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x5b5b58]
call fcn.0048cf64
mov eax, dword [ebp - 8]
call fcn.0048cf64
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004072d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d207
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004051f0
lea eax, [ebp - 0x10]
mov edx, dword [0x41ea34]
call fcn.00406074
ret

Function at 0x48e4a0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xffffffb8
mov dword [esp], eax
mov eax, dword [0x5c183c]
cmp byte [eax], 0
je 0x48e4ff
mov eax, dword [0x5c1308]
call fcn.004033f8
call fcn.00402ca4
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
call fcn.0040d4e4
push eax
lea eax, [esp + 0xc]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 8]
push eax
push 2
push 0x48e544
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x48e535
push 0x40
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x5c124c]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5c2668]
call fcn.00406cb8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 8]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x48
ret
Function at 0x490a68
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x5b63c3
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048e650
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0048e610
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048e610
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
push 0x5b63c5
lea ecx, [ebp - 0x200]
push ecx
call fcn.0048e650
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0048e610
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.00492580
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x490b79
push esi
call fcn.0048e610
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0048e610
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0048e548
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x490b50
xor eax, eax
jmp 0x490c00
push esi
call fcn.0048e610
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0048e610
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0048e5dc
add esp, 0xc
jmp 0x490bb9
mov edi, dword [ebx + 0x24]
push edi
call fcn.0048e610
pop ecx
push eax
push esi
call fcn.0048e610
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0048e610
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0048e584
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x490bb9
xor eax, eax
jmp 0x490c00
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0048e650
add esp, 8
push 0x5b63c7
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0048e650
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0048e650
add esp, 8
push 0x5b63c9
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0048e650
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49365e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4936b2
push esi
call fcn.0048e610
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4bdd50
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040568c
xor eax, eax
push ebp
push 0x4bddce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040569c
mov dword [ebp - 8], eax
cmp dword [ebx + 8], 0
jne 0x4bdd99
mov eax, dword [ebx + 4]
call fcn.0040569c
push eax
push 0
call sub.advapi32.dll_RegisterEventSourceA
mov dword [ebx + 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ax, word [ebp + 0xc]
push eax
push esi
mov eax, dword [ebx + 8]
push eax
call sub.advapi32.dll_ReportEventA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bddd5
lea eax, [ebp - 4]
call fcn.004051cc
ret

Function at 0x4beda0
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4bef3d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402f48
cmp word [ebx + 0xa2], 0
je 0x4bede9
mov edx, ebx
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
mov eax, dword [ebx + 0x90]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4bedfd
lea esi, [ebp - 8]
jmp 0x4bedff
xor esi, esi
cmp dword [ebx + 0x80], 0
jne 0x4bee0c
xor edi, edi
jmp 0x4bee19
mov eax, dword [ebx + 0x80]
call fcn.0040569c
mov edi, eax
mov eax, dword [ebx + 0x7c]
call fcn.0040569c
push eax
push edi
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004be508
mov eax, dword [ebp - 0x14]
call fcn.0040569c
push eax
push esi
mov eax, dword [ebx + 0x74]
call fcn.0040569c
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040569c
push eax
mov eax, ebx
call fcn.004be63c
push eax
mov eax, ebx
call fcn.004be610
push eax
mov eax, ebx
call fcn.004be5c4
push eax
push 0xf01ff
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004be3d4
mov eax, dword [ebp - 0x18]
call fcn.0040569c
push eax
mov eax, dword [ebx + 8]
call fcn.0040569c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0x90], eax
cmp dword [ebp - 0xc], 0
jne 0x4beea2
call fcn.00412360
xor edx, edx
push ebp
push 0x4bef1b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x4beee0
push dword fs:[edx]
mov dword fs:[edx], esp
cmp word [ebx + 0xaa], 0
je 0x4beed6
mov edx, ebx
mov eax, dword [ebx + 0xac]
call dword [ebx + 0xa8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bef04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bef22
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4bef4c
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax + 0xb2], 0
je 0x4bef78
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xb4]
call dword [esi + 0xb0]
push 0xf01ff
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
call fcn.0040569c
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4bef9d
call fcn.00412360
xor eax, eax
push ebp
push 0x4befd4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
test eax, eax
jne 0x4befbd
call fcn.00412360
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4befdb
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
Function at 0x4c2d1c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c2db7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jle 0x4c2da1
call sub.kernel32.dll_GetTickCount
cmp eax, dword [esi]
jae 0x4c2d80
mov edx, dword [esi]
sub edx, eax
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jbe 0x4c2d80
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xc]
call fcn.0040cafc
mov ecx, dword [ebp - 0xc]
mov dl, 0xc
mov eax, edi
call fcn.004c45a8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_Sleep
fild dword [ebp - 4]
mov dword [ebp - 0x10], ebx
fild dword [ebp - 0x10]
fdivp st(1)
fmul dword [0x4c2dc8]
call fcn.00403034
mov ebx, eax
call sub.kernel32.dll_GetTickCount
add ebx, eax
mov dword [esi], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2dbe
lea eax, [ebp - 0xc]
call fcn.004051cc
ret

Function at 0x4cef00
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4cef2e
mov eax, ebx
call fcn.004cf9b4
cmp dword [ebx + 0x40], 0
je 0x4cef27
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4cef9f
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4cef91
cmp dword [ebx + 8], 0
je 0x4cef50
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4cef62
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4cef91
cmp dword [ebx + 8], 0
je 0x4cef43
cmp eax, 3
je 0x4cef75
dec eax
jne 0x4cef43
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4cef43
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4cef43
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4cefbd
cmp dword [ebx + 0x14], 0xcc
je 0x4cefbd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004cefc8
pop ebx
ret
Function at 0x4e1244
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4e1271
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4e12f0
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004df654
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e12be
mov cx, word [esp]
sub cx, si
jmp 0x4e12c0
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e12a7
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4e12e6
mov cx, word [esp]
sub cx, si
jmp 0x4e12e8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4e12cf
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4e134d
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004e0f18
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4e1338
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4e134d
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4e124e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4e6e18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00408a88
cmp ax, 0xffff
jne 0x4e6e39
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4e6eba
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4e6eba
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4e6e80
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4e6e73
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4e6eba
cmp dword [ebp + 8], 0
jle 0x4e6eba
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.00436568
mov esi, eax
test esi, esi
jle 0x4e6eb1
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408a9c
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4e7ac8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4e7b2c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040544c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040cb88
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e7b33
lea eax, [ebp - 0xc]
call fcn.004051cc
ret

Function at 0x4e7bd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4e7c2c
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4e7bfb
call fcn.00412360
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402dbc
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4e7c2c
call fcn.00412360
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4f3d24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4f3ea8
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4f3e8d
cmp byte [ebx + 0x268], 0
je 0x4f3e8d
mov eax, dword [ebp - 4]
call fcn.004f8ab4
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4f3e86
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4f3dca
dec ax
je 0x4f3da0
sub ax, 0x12
jne 0x4f3de4
call fcn.00404bf4
jmp 0x4f3e8d
cmp byte [ebx + 0x269], 0
je 0x4f3e6c
mov eax, ebx
call fcn.0045be34
test al, al
je 0x4f3e6c
xor edx, edx
mov eax, ebx
call fcn.0045be58
jmp 0x4f3e6c
mov eax, dword [esi]
call fcn.00405bdc
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.00405dc4
jmp 0x4f3e6c
cmp byte [ebx + 0x269], 0
je 0x4f3e01
mov eax, ebx
call fcn.0045be34
test al, al
jne 0x4f3e01
mov dl, 1
mov eax, ebx
call fcn.0045be58
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4f3e19
mov eax, esi
call fcn.00405984
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.00405aac
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405c48
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004f3b54
test al, al
je 0x4f3e6c
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.00405aac
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405be8
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3e8d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.004f8ae8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f3eaf
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040599c
ret

Function at 0x4f611c
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x5c1afc]
cmp dword [eax], 2
je 0x4f613a
mov ecx, 0x30e
mov edx, 0x4f616c
mov eax, 0x4f61b0
call fcn.00405128
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4f60bc
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5c5588], eax
cmp dword [0x5c5588], 0
jne 0x4f6161
call fcn.00412360
ret

Function at 0x4f64ac
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5c1184]
cmp byte [eax], 0
jne 0x4f64da
mov ecx, 0xaf
mov edx, 0x4f6528
mov eax, 0x4f656c
call fcn.00405128
mov eax, ebx
call fcn.00405984
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4f6519
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405b34
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4f6580
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x5c1184]
cmp byte [eax], 0
jne 0x4f65a3
mov ecx, 0xbd
mov edx, 0x4f65e4
mov eax, 0x4f6628
call fcn.00405128
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4f65d6
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4f65d6
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4f65d6
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x5008e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x500918]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5008f6
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x500905
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x500914
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x5012f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x460be0]
call fcn.00404444
test al, al
je 0x501332
mov eax, dword [0x5c1738]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x501332
mov edx, dword [0x5c1738]
xor edx, edx
call fcn.0047e860
push 0
mov eax, dword [0x5c1738]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret