joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bc354
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4bc3f2
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x660298]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x660298]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x660298]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x660298]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4bc373
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4bc408
dec edx
je 0x4bc43d
jmp 0x4bc48e
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x660298]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x660298]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4bc48e
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x660298]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x660298]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x660298]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4bd2a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4bd2c4
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4bd2b2
pop edi
pop esi
pop ebx
ret
Function at 0x4c4de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c4e95
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402a38
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c4e01
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 4], 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c4ea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c4f5b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402a38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx - 4]
mov ecx, dword [ecx + 0x1c]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c4ec5
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 4], 2
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c4f6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jge 0x4c5021
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [edx + ecx], al
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x24]
inc eax
call fcn.00402a38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
mov cl, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jl 0x4c4f8d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 4], 2
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c5a48
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 0x100
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [ebp - 8]
and al, 0xff
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
mov eax, dword [ebp - 8]
and eax, 0xff
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 4]
mov byte [edx + eax], cl
mov eax, dword [ebp - 8]
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov dword [ebp - 8], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jne 0x4c5a71
mov esp, ebp
pop ebp
ret
Function at 0x4c6458
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x20], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
lea eax, [eax + eax*4]
add eax, 0x661f94
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0xc]
xor byte [ebp + edx - 0x20], al
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jne 0x4c647a
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov al, byte [eax + edx]
xor byte [ebp - 5], al
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
jne 0x4c646d
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 5]
xor byte [ebp + eax - 0x20], dl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
jne 0x4c64bc
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov ecx, 0xc
call fcn.00408350
mov esp, ebp
pop ebp
ret

Function at 0x4c6574
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shr eax, 1
mov ecx, 3
cdq
idiv ecx
and dl, 1
imul dx, word [ebp - 1]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov al, byte [eax + ecx]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
xor al, byte [ecx + ebx]
xor dl, al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [eax + ecx], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x4c6589
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004c6458
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4c66d4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xc
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 3
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x28]
mov ecx, 0xc
call fcn.00408350
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
mov al, byte [ebp + eax - 0x28]
not al
mov edx, dword [ebp - 0x18]
or al, byte [ebp + edx - 0x28]
and eax, 0xff
mov dword [ebp - 8], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x14], 0
jne 0x4c6732
mov dword [ebp - 0x14], 0xc
dec dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0
jne 0x4c6742
mov dword [ebp - 0x18], 0xc
dec dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 8]
xor byte [eax + edx], cl
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xc
jne 0x4c670a
mov esp, ebp
pop ebp
ret
Function at 0x4c68ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c6a16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 9]
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, 0xc
call fcn.00403224
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0xc
call fcn.00403224
lea edx, [ebp - 0x2c]
xor eax, eax
mov al, byte [ebp - 0xd]
lea eax, [eax + eax*2]
lea eax, [eax*4 + 0x661394]
mov ecx, 0xc
call fcn.00402a38
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 1]
xor al, 0x17
mov edx, dword [ebp - 4]
mov byte [edx], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 2]
xor al, 0xca
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 3]
xor al, 0x60
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
mov eax, dword [ebp + 0xc]
mov al, byte [eax + 4]
xor al, 0x89
mov edx, dword [ebp - 4]
mov byte [edx + 3], al
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [edx + ecx], al
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx + 5]
mov edx, dword [ebp - 0x14]
xor byte [ebp + edx - 0x2c], al
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jne 0x4c694e
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xa], 0
je 0x4c69c3
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0xb], 0
je 0x4c69c3
mov eax, dword [ebp - 4]
mov al, byte [eax]
not al
mov edx, dword [ebp - 4]
mov byte [edx + 4], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
not al
mov edx, dword [ebp - 4]
mov byte [edx + 5], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 2]
not al
mov edx, dword [ebp - 4]
mov byte [edx + 6], al
mov eax, dword [ebp - 4]
mov al, byte [eax + 3]
not al
mov edx, dword [ebp - 4]
mov byte [edx + 7], al
lea edx, [ebp - 0x20]
mov eax, 0x66137c
mov ecx, 0xc
call fcn.00402a38
cmp byte [ebp - 0xd], 0x80
jae 0x4c69ea
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0xc
call fcn.00403224
push 0xb
lea eax, [ebp - 0x2c]
push eax
push 0xb
lea ecx, [ebp - 0x20]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004c6760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6a1d
lea eax, [ebp - 0x30]
call fcn.00404ae4
ret
Function at 0x4d0ff4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov edx, dword [0x419940]
call fcn.004058a0
xor eax, eax
push ebp
push 0x4d1147
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x662228], 0
jne 0x4d104a
mov ecx, dword [0x668fcc]
mov dl, 1
mov eax, dword [0x408b14]
call fcn.0040ef94
call fcn.00404460
lea eax, [ebp - 0x30]
xor ecx, ecx
mov edx, 0x10
call fcn.00403224
mov eax, dword [ebp - 4]
call fcn.004054c8
mov dword [ebp - 0x2c], eax
mov esi, 0x4d1158
lea edi, [ebp - 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
call fcn.00406b84
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.004054d8
test eax, eax
jle 0x4d10e5
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x4d10dc
lea eax, [ebp - 0x54]
mov edx, dword [ebp - 4]
call fcn.00404d7c
mov eax, dword [ebp - 0x54]
push eax
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x50]
mov ecx, 0x10
call fcn.00404d64
mov eax, dword [ebp - 0x58]
pop edx
call fcn.00409b80
test eax, eax
jne 0x4d10dc
mov dword [ebp - 0x10], 0x15
jmp 0x4d10ec
mov dword [ebp - 0x10], 0x10
jmp 0x4d10ec
mov dword [ebp - 0x10], 0x15
lea eax, [ebp - 0x20]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call dword [0x662228]
call fcn.004d0f24
mov eax, dword [ebp - 0x18]
call fcn.004d0f24
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
call fcn.00406b9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d114e
lea eax, [ebp - 0x58]
mov edx, 2
call fcn.00404b08
lea eax, [ebp - 0x20]
mov edx, dword [0x419940]
call fcn.00405970
ret
Function at 0x4d22bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00408308
cmp ax, 0xffff
jne 0x4d22e4
neg ebx
jno 0x4d22e4
call fcn.00403bd4
mov eax, ebx
shr eax, 4
and eax, 0xffff
add eax, 1
jae 0x4d22f8
call fcn.00403bd4
test eax, eax
jns 0x4d2301
call fcn.00403bcc
and ebx, 0xf
test ebx, ebx
jns 0x4d230d
call fcn.00403bcc
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
je 0x4d23b1
push eax
push edi
call sub.KERNEL32.DLL_LoadResource
test eax, eax
je 0x4d23b1
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
sub eax, 1
jno 0x4d2345
call fcn.00403bd4
test eax, eax
jl 0x4d235f
inc eax
movzx edx, word [ebx]
imul edx, edx, 2
jno 0x4d2357
call fcn.00403bd4
add ebx, edx
add ebx, 2
dec eax
jne 0x4d234a
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4d23b1
cmp dword [ebp + 8], 0
jle 0x4d23b1
mov eax, dword [ebp + 8]
sub eax, 1
jno 0x4d237e
call fcn.00403bd4
mov edx, esi
call fcn.004344fc
mov esi, eax
test esi, esi
jle 0x4d23a8
imul ecx, esi, 2
jno 0x4d2395
call fcn.00403bd4
test ecx, ecx
jns 0x4d239e
call fcn.00403bcc
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00408350
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x4d31f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4d3264
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
call sub.KERNEL32.DLL_GetACP
test eax, eax
jns 0x4d3229
call fcn.00403bcc
push eax
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d64
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0040a69c
mov ebx, eax
test ebx, ebx
jns 0x4d324e
call fcn.00403bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d326b
lea eax, [ebp - 0xc]
call fcn.00404ae4
ret

Function at 0x4d32c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4d331c
push esp
push 0x40
push 6
push ebx
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x4d32eb
call fcn.004109b0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402a38
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.KERNEL32.DLL_VirtualProtect
test eax, eax
jne 0x4d331c
call fcn.004109b0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4da658
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x6691bc]
cmp byte [eax], 0
jne 0x4da686
mov ecx, 0xaf
mov edx, 0x4da6dc
mov eax, 0x4da728
call fcn.00404a40
mov eax, ebx
call fcn.0040529c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
jns 0x4da6a6
call fcn.00403bcc
test eax, eax
je 0x4da6ce
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405430
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4da73c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x6691bc]
cmp byte [eax], 0
jne 0x4da75f
mov ecx, 0xbd
mov edx, 0x4da7b0
mov eax, 0x4da7fc
call fcn.00404a40
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4da79f
movzx esi, bx
sub esi, 0x30
jno 0x4da784
call fcn.00403bd4
add esi, 0x30
jno 0x4da78e
call fcn.00403bd4
cmp si, di
je 0x4da79f
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4da79f
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4dc700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc876
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6691bc]
cmp byte [eax], 0
je 0x4dc756
mov eax, ebx
mov edx, dword [0x46c500]
call fcn.00403e20
test al, al
je 0x4dc76f
mov eax, ebx
call fcn.0047a390
test al, al
je 0x4dc76f
mov eax, ebx
call fcn.00479ec0
push eax
call sub.user32.dll_IsWindowUnicode
test eax, eax
jne 0x4dc76f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00471608
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040544c
jmp 0x4dc84b
mov eax, ebx
mov edx, dword [0x46c500]
call fcn.00403e20
test al, al
jne 0x4dc7c4
xor edx, edx
mov eax, ebx
call fcn.004dc640
mov edi, eax
test edi, edi
jne 0x4dc7a8
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00471608
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.0040544c
jmp 0x4dc84b
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00471608
mov edx, dword [ebp - 0xc]
mov ecx, esi
lea eax, [edi + 0x38]
call fcn.004d70e8
jmp 0x4dc84b
mov edi, ebx
mov eax, edi
call fcn.0047a390
test al, al
jne 0x4dc7f4
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00471608
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.0040544c
mov edx, dword [ebp - 0x10]
mov ecx, esi
mov eax, ebx
call fcn.004dc66c
jmp 0x4dc84b
mov eax, edi
call fcn.00479ec0
push eax
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
add edx, 1
jno 0x4dc80d
call fcn.00403bd4
mov eax, esi
call fcn.0040583c
mov eax, dword [esi]
call fcn.004054d8
push eax
mov eax, dword [esi]
call fcn.004054c8
push eax
mov eax, edi
call fcn.00479ec0
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [esi]
call fcn.004054d8
mov edx, eax
sub edx, 1
jno 0x4dc844
call fcn.00403bd4
mov eax, esi
call fcn.0040583c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc87d
lea eax, [ebp - 0x14]
call fcn.00404ae4
lea eax, [ebp - 0x10]
call fcn.0040529c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b08
ret

Function at 0x4ebe48
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ebeb9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x662528]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x4ebea3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.004ebe38
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4ebc44]
call fcn.004ebee0
mov dword [0x66258c], eax
mov eax, dword [ebp - 4]
call fcn.004ebde8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ebec0
lea eax, [ebp - 8]
call fcn.00406b84
ret