joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ec78
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x6edc88]
cmp dword [eax + 0x30], 0
je 0x46ed22
cmp dword [ebx + 0x94], 0
jne 0x46ed1c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46ec08
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46ed1c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x46ece2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46ed1c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cc1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46ecf1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46f800
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x46f835
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404d88
jmp 0x46f842
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404cec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4708f8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x470939
mov eax, esi
call fcn.00455e74
test al, al
je 0x470939
mov eax, dword [ebx + 0x84]
call fcn.00455b70
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x470939
push 0
mov eax, dword [ebx + 0x84]
call fcn.00455b70
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47685c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00476308
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00405148
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4768ba
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6ec11c]
mov dl, 1
mov eax, dword [0x476200]
call fcn.0040d23c
call fcn.004046f8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4768c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00405148
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47691c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x6ec66c]
mov dl, 1
mov eax, dword [0x476200]
call fcn.0040d23c
call fcn.004046f8
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00476338
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47dfa8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47e080
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6edd14], 0
jne 0x47e064
lea eax, [ebp - 4]
mov edx, 0x47e098
call fcn.00404d30
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00405148
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x47e064
mov eax, ebx
call fcn.00402764
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47e05d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x47e047
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x47e0a8
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x47e047
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x6edd14], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e064
mov eax, dword [ebp - 0xc]
call fcn.00402784
ret
mov ebx, dword [0x6edd14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e087
lea eax, [ebp - 4]
call fcn.00404c98
ret

Function at 0x48d814
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404f00
mov eax, dword [ebp - 4]
mov dl, 0x5c
call fcn.0048d6a8
mov esp, ebp
pop ebp
ret

Function at 0x48d854
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404f00
mov eax, dword [ebp - 4]
mov dl, 0x5c
call fcn.0048d6a8
mov esp, ebp
pop ebp
ret
Function at 0x48d894
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, 0x12c
call fcn.004052d4
mov eax, dword [ebp - 4]
call fcn.004051a0
push eax
push 0x12c
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004052d4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0048c408
test al, al
jne 0x48d8e6
mov eax, dword [ebp - 4]
mov edx, 0x48d8fc
call fcn.00404cec
mov eax, dword [ebp - 4]
mov dl, 0x5c
call fcn.0048d6a8
pop ecx
pop ecx
pop ebp
ret
Function at 0x48d900
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405138
xor eax, eax
push ebp
push 0x48dadc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404c98
mov eax, dword [ebp - 8]
mov word [eax], 0
mov eax, dword [ebp - 0xc]
mov word [eax], 0
mov eax, dword [ebp + 0x10]
mov word [eax], 0
mov eax, dword [ebp + 0xc]
mov word [eax], 0
cmp dword [ebp - 4], 0
je 0x48dab9
mov eax, dword [ebp - 4]
call fcn.00409bcc
test al, al
je 0x48dab9
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405148
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x48dab9
mov eax, dword [ebp - 0x10]
call fcn.00402764
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48dab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00405148
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x48da9c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x48daec
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48da9c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
call fcn.00408090
mov edx, dword [ebp - 8]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 8]
mov edx, dword [ebp - 0xc]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
call fcn.00408090
mov edx, dword [ebp + 0x10]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 0xc]
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
call fcn.00408090
movzx eax, ax
lea edx, [ebp - 0x24]
call fcn.0040975c
push dword [ebp - 0x24]
push 0x48daf8
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 8]
call fcn.0040975c
push dword [ebp - 0x28]
push 0x48daf8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
call fcn.00408090
movzx eax, ax
lea edx, [ebp - 0x2c]
call fcn.0040975c
push dword [ebp - 0x2c]
push 0x48daf8
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 0xc]
call fcn.0040975c
push dword [ebp - 0x30]
mov eax, dword [ebp + 8]
mov edx, 7
call fcn.00405010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dab9
mov eax, dword [ebp - 0x18]
call fcn.00402784
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dae3
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00404cbc
lea eax, [ebp - 4]
call fcn.00404c98
ret
Function at 0x48ef8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405138
mov eax, dword [ebp - 8]
call fcn.00405138
xor eax, eax
push ebp
push 0x48f0cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6ec610]
cmp dword [eax], 0
je 0x48effc
mov eax, dword [0x6ec610]
mov eax, dword [eax]
cmp dword [eax + 0x6c], 0
je 0x48effc
mov eax, dword [0x6ec610]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
call fcn.00455b70
test eax, eax
je 0x48effc
mov eax, dword [0x6ec610]
mov eax, dword [eax]
mov eax, dword [eax + 0x6c]
call fcn.00455b70
mov dword [ebp - 0x14], eax
jmp 0x48f02c
mov eax, dword [0x6ec250]
cmp dword [eax], 0
je 0x48f027
mov eax, dword [0x6ec250]
mov eax, dword [eax]
cmp dword [eax + 0x44], 0
je 0x48f027
mov eax, dword [0x6ec250]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.00455b70
mov dword [ebp - 0x14], eax
jmp 0x48f02c
xor eax, eax
mov dword [ebp - 0x14], eax
push 0xa
push 0
mov eax, dword [ebp - 8]
call fcn.00405148
push eax
mov eax, dword [ebp - 4]
call fcn.00405148
push eax
push 0x48f0e0
mov eax, dword [ebp - 0x14]
push eax
call sub.shell32.dll_ShellExecuteA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x20
seta byte [ebp - 9]
cmp byte [ebp - 9], 0
jne 0x48f0a7
push dword [ebp - 4]
push 0x48f0f0
push dword [ebp - 8]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.00405010
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea eax, [ebp - 0x2c]
call fcn.0048f124
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x48f0fc
call fcn.0048fe6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f0d6
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00404cbc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cbc
ret
Function at 0x492b8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x492d62
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x492d49
mov eax, dword [edi + 0x30]
call fcn.00404f50
test eax, eax
jne 0x492be2
mov eax, dword [edi + 0x34]
call fcn.00404f50
test eax, eax
jne 0x492be2
mov eax, edi
call fcn.00492e00
jmp 0x492d49
cmp dword [edi + 0xa0], 0
jne 0x492c19
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00409fd8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x6eddf4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x492c50
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00409fd8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x6eddf4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00492e40
mov ebx, eax
test bl, bl
jne 0x492cfe
mov eax, dword [edi + 0x30]
call fcn.00404f50
test eax, eax
jne 0x492c88
mov eax, dword [edi + 0xc0]
call fcn.00404f50
test eax, eax
je 0x492cfe
mov eax, dword [edi + 0xc0]
call fcn.00404f50
test eax, eax
je 0x492caa
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00409fd8
jmp 0x492cd6
push dword [edi + 0x30]
push 0x492d7c
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00405010
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00409fd8
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x492cfe
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00492e40
mov ebx, eax
test bl, bl
jne 0x492d0b
mov eax, edi
call fcn.00492e00
jmp 0x492d49
mov eax, dword [edi + 0x58]
test eax, eax
je 0x492d1a
mov dword [edi + 0xa8], eax
jmp 0x492d24
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00492eb8
test al, al
je 0x492d49
mov eax, edi
mov si, 0xffee
call fcn.00404128
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00493114
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492d69
lea eax, [ebp - 0x108]
call fcn.00404c98
ret
Function at 0x494728
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x49475c
add eax, 3
sar eax, 2
test eax, eax
jle 0x4948ba
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
movzx eax, byte [eax + edx]
cmp eax, 0x3d
jg 0x494799
je 0x4947ff
sub eax, 0x2b
je 0x4947eb
sub eax, 4
je 0x4947f5
dec eax
sub eax, 0xa
jb 0x4947d5
jmp 0x494807
add eax, 0xffffffbf
sub eax, 0x1a
jb 0x4947ab
add eax, 0xfffffffa
sub eax, 0x1a
jb 0x4947bf
jmp 0x494807
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x41
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x494807
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x61
add al, 0x1a
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x494807
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
sub al, 0x30
add al, 0x34
mov edx, dword [ebp - 0x18]
mov byte [ebp + edx - 0x24], al
jmp 0x494807
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3e
jmp 0x494807
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0x3f
jmp 0x494807
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x24], 0xff
inc dword [ebp - 0x1c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jne 0x494776
mov al, byte [ebp - 0x24]
shl eax, 2
xor edx, edx
mov dl, byte [ebp - 0x23]
shr edx, 4
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx], al
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x22], 0xff
je 0x49486b
cmp byte [ebp - 0x21], 0xff
jne 0x49486b
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x20]
jmp 0x4948ab
cmp byte [ebp - 0x22], 0xff
je 0x4948ab
mov al, byte [ebp - 0x23]
shl eax, 4
xor edx, edx
mov dl, byte [ebp - 0x22]
shr edx, 2
or al, dl
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [edx + ecx + 1], al
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov cl, byte [ebp - 0x22]
shl ecx, 6
or cl, byte [ebp - 0x21]
mov byte [eax + edx + 2], cl
mov eax, dword [ebp - 0x20]
add eax, 3
mov dword [ebp - 0x10], eax
add dword [ebp - 0x20], 2
inc dword [ebp - 0x20]
inc dword [ebp - 0x14]
dec dword [ebp - 0x30]
jne 0x494771
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x4956e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
test eax, eax
jbe 0x49571e
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
dec eax
mov al, byte [eax]
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x10]
dec edx
xor byte [edx], al
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x495704
mov esp, ebp
pop ebp
ret
Function at 0x49fbcc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x49fbfa
mov eax, ebx
call fcn.004a0684
cmp dword [ebx + 0x3c], 0
je 0x49fbf3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x49fc6b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x49fc5d
cmp dword [ebx + 8], 0
je 0x49fc1c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x49fc2e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x49fc5d
cmp dword [ebx + 8], 0
je 0x49fc0f
cmp eax, 3
je 0x49fc41
dec eax
jne 0x49fc0f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x49fc0f
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x49fc0f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x49fc89
cmp dword [ebx + 0x10], 0xcc
je 0x49fc89
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0049fc94
pop ebx
ret

Function at 0x4b0374
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b03c5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b03ac
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b039c
jmp 0x4b03c5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b03ad
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bba54
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x6f1e88
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4bba76
shr eax, 1
xor eax, 0xedb88320
jmp 0x4bba78
shr eax, 1
dec edx
jne 0x4bba64
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4bba5d
mov dword [0x6e9204], 1
pop esi
pop ebx
ret

Function at 0x4bba98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [0x6e9204]
test al, al
jne 0x4bbab6
call fcn.004bba54
mov eax, 4
lea edx, [ebp - 8]
xor ebx, ebx
mov bl, byte [edx]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x6f1e88]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc edx
dec eax
jne 0x4bbabe
mov edx, dword [ebp + 8]
dec edx
test edx, edx
jl 0x4bbb0e
inc edx
xor eax, eax
xor ebx, ebx
mov bl, byte [esi + eax]
mov ecx, dword [ebp - 4]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x6f1e88]
shr ecx, 8
xor ebx, ecx
mov dword [ebp - 4], ebx
inc eax
dec edx
jne 0x4bbaeb
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4f5258
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f54b8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4f52bb
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004f4d20
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d9e8
cmp al, 1
jne 0x4f52bb
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004f5038
test al, al
je 0x4f5447
cmp dword [ebp - 8], 0
jge 0x4f52d9
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004f4d20
mov eax, dword [ebp - 0x210]
call fcn.00404f50
cmp ebx, eax
jge 0x4f5323
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004f4d20
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x6ec634]
and eax, 0xff
bt dword [edx], eax
jae 0x4f5323
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4f5337
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004f5234
cmp ebx, dword [ebp - 8]
je 0x4f5439
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4f5363
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404128
and eax, 0x7f
movzx eax, word [eax*2 + 0x6eba38]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4f5426
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404128
and eax, 0x7f
movzx eax, word [eax*2 + 0x6eba38]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00455b70
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00404128
and eax, 0x7f
movzx eax, word [eax*2 + 0x6eba38]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00455b70
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f542d
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4f549a
cmp dword [ebp - 8], 0
jge 0x4f5452
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004f4d20
mov eax, dword [ebp - 0x218]
call fcn.00404f50
cmp eax, dword [ebp - 8]
jg 0x4f548c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004f4d20
mov eax, dword [ebp - 0x21c]
call fcn.00404f50
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004f5234
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f54bf
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404cbc
ret