joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474cfc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4173e4]
call fcn.00404fe4
xor eax, eax
push ebp
push 0x474e40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e2068], 0
jne 0x474d4f
mov ecx, dword [0x4e60d0]
mov dl, 1
mov eax, dword [0x407e44]
call fcn.0040d388
call fcn.00403c38
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402de8
mov eax, ebx
call fcn.00404c0c
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x474e50
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406018
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404c1c
test eax, eax
jle 0x474de7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x474de0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404570
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040453c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408dc8
test eax, eax
jne 0x474de0
mov ebx, 0x15
jmp 0x474dec
mov ebx, 0x10
jmp 0x474dec
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4e2068]
call fcn.00474c54
mov eax, dword [ebp - 8]
call fcn.00474c54
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e47
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042e0
lea eax, [ebp - 0x10]
mov edx, dword [0x4173e4]
call fcn.004050b4
ret

Function at 0x47914c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4791a6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e616c]
cmp byte [eax], 0
je 0x479176
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x479190
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004044f4
mov eax, dword [ebp - 4]
call fcn.004047a8
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4791ad
lea eax, [ebp - 4]
call fcn.004042bc
ret
Function at 0x479254
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.004077b4
cmp ax, 0xffff
jne 0x479275
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x479301
push eax
push edi
call sub.kernel32.dll_LoadResource
mov edi, eax
test edi, edi
je 0x479301
push edi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
mov eax, ebx
dec eax
test eax, eax
jl 0x4792c2
inc eax
mov edx, dword [ebp - 8]
movzx edx, word [edx]
add edx, edx
add edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 8], edx
dec eax
jne 0x4792ae
mov eax, dword [ebp - 8]
movzx esi, word [eax]
add dword [ebp - 8], 2
cmp dword [ebp - 4], 0
je 0x479301
cmp dword [ebp + 8], 0
jle 0x479301
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042efa8
mov esi, eax
test esi, esi
jle 0x4792f8
mov ecx, esi
add ecx, ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004077c8
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x479e60
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x479ec4
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040453c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409518
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479ecb
lea eax, [ebp - 0xc]
call fcn.004042bc
ret

Function at 0x479f70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x479fcc
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x479f9b
call fcn.0040e79c
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402970
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x479fcc
call fcn.0040e79c
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x482214
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x48225e
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404b74
jmp 0x482265
mov eax, ebx
call fcn.004049c8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48226c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4822a4
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4822a4
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4822a4
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x489b4c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402de8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x489f84
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + 0x14]
add eax, ecx
add eax, 0x18
cmp ebx, dword [eax + 0xc]
jae 0x489fa2
mov eax, ebx
jmp 0x489fdd
xor edx, edx
add eax, 0x34
jmp 0x489fd2
movzx esi, word [ecx + 6]
lea edi, [edx + 1]
cmp esi, edi
jne 0x489fb9
mov esi, dword [ecx + 0x50]
jmp 0x489fbb
mov esi, dword [eax]
cmp ebx, dword [eax - 0x28]
jb 0x489fce
cmp esi, ebx
jbe 0x489fce
sub ebx, dword [eax - 0x28]
add ebx, dword [eax - 0x20]
mov eax, ebx
jmp 0x489fdd
inc edx
add eax, 0x28
movzx esi, word [ecx + 6]
cmp edx, esi
jb 0x489fa9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x48a604
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret
Function at 0x493dc8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4e802c
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x493dea
shr eax, 1
xor eax, 0xedb88320
jmp 0x493dec
shr eax, 1
dec edx
jne 0x493dd8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x493dd1
mov byte [0x4e842c], 1
pop esi
pop ebx
ret

Function at 0x493e08
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4e842c], 0
jne 0x493e1f
call fcn.00493dc8
mov eax, edi
dec eax
cmp eax, 0xffff
jg 0x493e4f
test eax, eax
jl 0x493e4f
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e802c]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x493e30
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x49698c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4969bd
dec al
je 0x4969f9
dec al
je 0x496a3d
dec al
je 0x496aa8
jmp 0x496b32
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x496b32
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4969cd
jmp 0x496b32
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x496b32
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x496a09
jmp 0x496b32
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x496b32
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x496a6b
xor ebp, ebp
jmp 0x496a7c
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x496a85
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x496a4d
jmp 0x496b32
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x496b32
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x496b00
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00493e58
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x496abc
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49acb8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x49ad27
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x49ad38
mov eax, dword [ebp - 4]
call fcn.00404c0c
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x49ad0f
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x49ad11
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ad2e
lea eax, [ebp - 4]
call fcn.004049c8
ret

Function at 0x49b09c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x49b1b8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404c0c
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00402774
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x49b185
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x49b1c8
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov si, word [eax + 8]
and si, 0xffff
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1e], dx
mov di, word [eax + 0xc]
and di, 0xffff
mov eax, dword [ebp - 8]
push eax
movzx eax, bx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, si
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, word [ebp - 0x1e]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, di
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x49b1d4
call fcn.0040a3dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b197
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00402794
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b1bf
lea eax, [ebp - 4]
call fcn.004049c8
ret

Function at 0x49b43c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x49b46c
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x49b466
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
jmp 0x49b46c
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x49b56c
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x49b5c0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404c0c
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b5c7
lea eax, [ebp - 4]
call fcn.004049c8
ret

Function at 0x49b5d0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404fc4
xor eax, eax
push ebp
push 0x49b6b1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404c0c
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [0x4e6448]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x49b6c8
mov edx, dword [ebp - 4]
call fcn.00404c88
mov eax, dword [ebp - 0x28]
call fcn.00404c0c
mov dword [ebp - 0x1a], eax
mov eax, 0x49b6cc
mov dword [ebp - 0x16], eax
test bl, bl
je 0x49b64c
mov word [ebp - 0x12], 0x454
jmp 0x49b652
mov word [ebp - 0x12], 0x40
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x49b687
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49b693
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b6b8
lea eax, [ebp - 0x28]
call fcn.004049c8
lea eax, [ebp - 4]
call fcn.004049c8
ret

Function at 0x49cf44
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push 0
push eax
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404b74
add esp, 0x20c
pop ebx
ret

Function at 0x49eae4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x49eb35
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x49eb1c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x49eb0c
jmp 0x49eb35
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x49eb1d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4aee60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af0c0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4aeec3
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004ae928
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dcc8
cmp al, 1
jne 0x4aeec3
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004aec40
test al, al
je 0x4af04f
cmp dword [ebp - 8], 0
jge 0x4aeee1
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ae928
mov eax, dword [ebp - 0x210]
call fcn.004045a8
cmp ebx, eax
jge 0x4aef2b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004ae928
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4e6630]
and eax, 0xff
bt dword [edx], eax
jae 0x4aef2b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4aef3f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004aee3c
cmp ebx, dword [ebp - 8]
je 0x4af041
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4aef6b
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403668
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e5cc0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4af02e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403668
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e5cc0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00465140
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403668
and eax, 0x7f
movzx eax, word [eax*2 + 0x4e5cc0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00465140
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af035
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4af0a2
cmp dword [ebp - 8], 0
jge 0x4af05a
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004ae928
mov eax, dword [ebp - 0x218]
call fcn.004045a8
cmp eax, dword [ebp - 8]
jg 0x4af094
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004ae928
mov eax, dword [ebp - 0x21c]
call fcn.004045a8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004aee3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af0c7
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042e0
ret
Function at 0x4c3f58
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, 0x4c3ff4
call fcn.00404d34
jne 0x4c3f79
push esp
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x4c3fd2
mov eax, dword [ebx + 4]
call fcn.00404c1c
test eax, eax
jle 0x4c3fd2
mov eax, dword [ebx + 4]
call fcn.00404c1c
mov edx, dword [ebx + 4]
cmp word [edx + eax*2 - 2], 0x3a
jne 0x4c3fa5
lea eax, [ebx + 4]
mov edx, 0x4c400c
call fcn.00404c28
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [ebx + 4]
call fcn.00404c0c
push eax
push 0
push 0
mov eax, dword [0x4e5d64]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebx + 8]
test eax, eax
je 0x4c3fde
call fcn.0040346c
mov eax, dword [esp]
call fcn.004c3960
mov dword [ebx + 8], eax
add esp, 0xc
pop ebx
ret

Function at 0x4c4010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x4c4084
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push eax
lea eax, [ebp - 0x20a]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00404b74
mov edx, dword [ebp - 0x210]
mov eax, ebx
mov ecx, 0x4c4094
call fcn.00404c88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c408b
lea eax, [ebp - 0x210]
call fcn.004049c8
ret

Function at 0x4c4a8c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4c4abc
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4c4ab6
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
jmp 0x4c4abc
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4c4ac4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov ebx, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
jmp 0x4c4b2e
push 1
push 0
push 0
mov eax, dword [esi + 0x34]
push eax
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4c4afb
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageA
test bl, bl
je 0x4c4b2e
call sub.kernel32.dll_GetTickCount_1
xor edx, edx
push edx
push eax
mov eax, edi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4c4b22
cmp eax, 0xbb8
jbe 0x4c4b2e
jmp 0x4c4b24
jle 0x4c4b2e
call sub.kernel32.dll_GetCurrentProcessId
call fcn.004c4a8c
mov eax, esi
call fcn.004c46e8
test al, al
jne 0x4c4ad7
add esp, 0x1c
pop edi
pop esi
pop ebx
ret