joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498594
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x4985ee
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00498584
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00487818
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00487418
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4985f5
lea eax, [ebp - 4]
call fcn.00404af4
ret

Function at 0x49bd18
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp + 4], edx
mov dword [esp], eax
cmp dword [esp], 0
jne 0x49bd3a
mov eax, dword [esp + 4]
call fcn.00404af4
jmp 0x49beaf
mov eax, dword [esp]
call fcn.00404db4
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
xor edx, edx
call fcn.00404be4
mov ebp, 1
mov edi, 1
cmp ebp, dword [esp + 8]
jg 0x49be75
xor esi, esi
lea eax, [esp + 0x10]
lea edx, [ebp + esi]
cmp edx, dword [esp + 8]
jle 0x49bd94
mov byte [eax], 0
jmp 0x49bd9d
mov ecx, dword [esp]
mov dl, byte [ecx + edx - 1]
mov byte [eax], dl
inc esi
inc eax
cmp esi, 3
jne 0x49bd85
mov al, byte [esp + 0x10]
xor edx, edx
mov dl, al
shr edx, 2
mov byte [esp + 0x13], dl
shl eax, 4
mov dl, byte [esp + 0x11]
xor ecx, ecx
mov cl, dl
shr ecx, 4
or al, cl
and al, 0x3f
mov byte [esp + 0x14], al
shl edx, 2
mov al, byte [esp + 0x12]
xor ecx, ecx
mov cl, al
shr ecx, 6
or dl, cl
and dl, 0x3f
mov byte [esp + 0x15], dl
and al, 0x3f
mov byte [esp + 0x16], al
mov esi, 4
lea ebx, [esp + 0x13]
mov al, byte [ebx]
sub al, 0x1a
jb 0x49be03
sub al, 0x1a
jb 0x49be19
sub al, 0xa
je 0x49be2f
dec al
je 0x49be3f
jmp 0x49be4f
mov eax, dword [esp + 4]
call fcn.0040500c
xor edx, edx
mov dl, byte [ebx]
add edx, 0x41
mov byte [eax + edi - 1], dl
jmp 0x49be63
mov eax, dword [esp + 4]
call fcn.0040500c
xor edx, edx
mov dl, byte [ebx]
add edx, 0x47
mov byte [eax + edi - 1], dl
jmp 0x49be63
mov eax, dword [esp + 4]
call fcn.0040500c
mov byte [eax + edi - 1], 0x2b
jmp 0x49be63
mov eax, dword [esp + 4]
call fcn.0040500c
mov byte [eax + edi - 1], 0x2f
jmp 0x49be63
mov eax, dword [esp + 4]
call fcn.0040500c
xor edx, edx
mov dl, byte [ebx]
sub edx, 4
mov byte [eax + edi - 1], dl
inc edi
inc ebx
dec esi
jne 0x49bdef
add ebp, 3
cmp ebp, dword [esp + 8]
jle 0x49bd7f
mov eax, dword [esp + 8]
mov ecx, 3
cdq
idiv ecx
mov esi, 3
sub esi, edx
dec esi
cmp esi, 2
je 0x49beaf
mov ebp, dword [esp + 0xc]
sub ebp, esi
mov ebx, dword [esp + 0xc]
sub ebx, ebp
jl 0x49beaf
inc ebx
mov eax, dword [esp + 4]
call fcn.0040500c
mov byte [eax + ebp - 1], 0x3d
inc ebp
dec ebx
jne 0x49be9d
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49beb8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov dword [esp], edx
mov esi, eax
test esi, esi
jne 0x49bed4
mov eax, dword [esp]
call fcn.00404af4
jmp 0x49c060
mov eax, esi
call fcn.00404db4
mov dword [esp + 4], eax
test byte [esp + 4], 3
je 0x49befc
mov ecx, 0x49c070
mov dl, 1
mov eax, dword [0x40ac58]
call fcn.004101d8
call fcn.00404470
mov eax, dword [esp + 4]
shr eax, 2
lea eax, [eax + eax*2]
mov dword [esp + 8], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
xor edx, edx
call fcn.00404be4
mov ebx, 1
mov edi, 1
cmp ebx, dword [esp + 4]
jg 0x49c034
mov edx, 4
lea eax, [esp + 0xc]
xor ecx, ecx
mov cl, byte [esi + ebx - 1]
cmp ecx, 0x3d
jg 0x49bf54
je 0x49bf91
sub ecx, 0x2b
je 0x49bf87
sub ecx, 4
je 0x49bf8c
dec ecx
sub ecx, 0xa
jb 0x49bf7c
jmp 0x49bf96
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x49bf66
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x49bf71
jmp 0x49bf96
mov cl, byte [esi + ebx - 1]
sub cl, 0x41
mov byte [eax], cl
jmp 0x49bfc2
mov cl, byte [esi + ebx - 1]
sub cl, 0x47
mov byte [eax], cl
jmp 0x49bfc2
mov cl, byte [esi + ebx - 1]
add cl, 4
mov byte [eax], cl
jmp 0x49bfc2
mov byte [eax], 0x3e
jmp 0x49bfc2
mov byte [eax], 0x3f
jmp 0x49bfc2
mov byte [eax], 0
jmp 0x49bfc2
xor eax, eax
mov al, byte [esi + ebx - 1]
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0
lea eax, [esp + 0x10]
push eax
push 0
mov ecx, 0x49c090
mov dl, 1
mov eax, dword [0x40ac58]
call fcn.00410214
call fcn.00404470
inc ebx
inc eax
dec edx
jne 0x49bf35
mov eax, dword [esp]
call fcn.0040500c
xor edx, edx
mov dl, byte [esp + 0xc]
shl edx, 2
xor ecx, ecx
mov cl, byte [esp + 0xd]
shr ecx, 4
or edx, ecx
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
call fcn.0040500c
xor edx, edx
mov dl, byte [esp + 0xd]
shl edx, 4
xor ecx, ecx
mov cl, byte [esp + 0xe]
shr ecx, 2
or edx, ecx
mov byte [eax + edi], dl
mov eax, dword [esp]
call fcn.0040500c
xor edx, edx
mov dl, byte [esp + 0xe]
shl edx, 6
xor ecx, ecx
mov cl, byte [esp + 0xf]
or edx, ecx
mov byte [eax + edi + 1], dl
add edi, 3
cmp ebx, dword [esp + 4]
jle 0x49bf2c
mov edx, esi
mov eax, 0x49c0b4
call fcn.004050f8
mov ebx, eax
test ebx, ebx
je 0x49c060
mov eax, dword [esp + 4]
sub eax, ebx
inc eax
mov ebx, eax
mov edx, dword [esp + 8]
sub edx, ebx
inc edx
mov eax, dword [esp]
mov ecx, ebx
call fcn.00405054
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x4a2934
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a29ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040529c
mov eax, dword [0x554328]
cmp byte [eax], 0
je 0x4a29a3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405860
mov eax, dword [ebx]
call fcn.004054fc
push eax
mov eax, dword [ebx]
call fcn.004054ec
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004054fc
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405860
jmp 0x4a29d5
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040ccec
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a29f5
lea eax, [ebp - 0x3f0]
call fcn.00404af4
ret

Function at 0x4a5c48
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4a5ca2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004a5cac
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5ca9
ret

Function at 0x4ac4c4
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x4ac4fa
jmp 0x4ac5a0
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x4ac53e
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x184], 0
je 0x4ac53e
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x184]
mov eax, dword [eax + 0x14]
jmp 0x4ac54e
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x180]
test edx, edx
je 0x4ac54e
mov eax, dword [edx + 0x14]
test eax, eax
je 0x4ac567
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.004a8e68
jmp 0x4ac5a0
mov dl, 1
mov eax, dword [0x429c88]
call fcn.0042bc6c
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.0042c700
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xc4]
mov eax, dword [esi + 0x10]
call fcn.0042b81c
mov edx, esp
mov eax, esi
call fcn.0042c370
mov eax, esi
call fcn.00403ca4
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4aeda4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.004681d4
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.004618a4
pop ebx
ret
Function at 0x4b532c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b53e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040529c
mov eax, dword [0x554328]
cmp byte [eax], 0
je 0x4b539b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00405860
mov eax, dword [ebx]
call fcn.004054fc
push eax
mov eax, dword [ebx]
call fcn.004054ec
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.004054fc
mov edx, eax
dec edx
mov eax, ebx
call fcn.00405860
jmp 0x4b53cd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.0040ccec
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00405470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b53ed
lea eax, [ebp - 0x3f0]
call fcn.00404af4
ret

Function at 0x4b53f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.0040ccec
add esp, 0x3ec
pop ebx
ret

Function at 0x4b55b4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov esi, edx
mov ebp, eax
mov edx, esi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
cmp dword [esi + 0xc], 0
jne 0x4b567a
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0047921c
mov ebx, eax
mov dx, word [esi + 4]
mov eax, ebp
call fcn.004b5270
mov edi, eax
test edi, edi
je 0x4b5613
mov al, byte [0x4b5688]
cmp al, bl
jne 0x4b5613
mov edx, edi
mov eax, ebp
call fcn.004b51a8
mov dword [esi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4b567a
cmp byte [ebp + 0x171], 2
jne 0x4b563e
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x55497c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
mov edx, 0xb006
call fcn.00462b68
test eax, eax
jne 0x4b567a
jmp 0x4b5675
mov edx, dword [0x5547c0]
mov edx, dword [edx]
mov edx, dword [edx + 0x44]
mov eax, dword [ebp + 0x138]
cmp edx, eax
je 0x4b5675
test byte [eax + 0x2f4], 8
jne 0x4b5675
mov eax, dword [esi + 8]
push eax
movzx ecx, word [esi + 4]
mov eax, dword [0x5547c0]
mov eax, edx
mov edx, 0xb006
call fcn.00462b68
xor eax, eax
mov dword [esi + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bb9b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [0x55497c]
mov eax, dword [eax]
cmp dword [eax + 0x58], 0
jne 0x4bba56
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4bb9f5
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4bba31
jmp 0x4bb9f9
pop edx
pop eax
jge 0x4bba31
mov eax, dword [0x55497c]
mov eax, dword [eax]
mov dword [eax + 0x38], 2
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004b63a8
mov eax, dword [ebx + 0x104]
test eax, eax
je 0x4bba56
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4bba56
cmp dword [ebx + 0x12c], 0
je 0x4bba56
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0043960c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x13c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4c6514
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0x98], 0
je 0x4c653a
push 0
mov eax, dword [ebx + 0x94]
call fcn.004681d4
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x98], 0
pop ebx
ret

Function at 0x4c65f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c6765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xa4], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4c674a
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.0040ccec
mov dl, 1
mov eax, dword [0x49ca24]
call fcn.0049ca7c
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c], eax
mov dl, 1
mov eax, dword [0x41cf34]
call fcn.00403c74
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xa0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.0049caf8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4c6747
mov dl, 1
mov eax, dword [0x49df3c]
call fcn.0049dfa4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
mov edx, 0x4c677c
call fcn.0049d260
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404e00
xor eax, eax
push ebp
push 0x4c6740
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0049e2a4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004c6784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c6747
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x9c]
call fcn.00403ca4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403ca4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403ca4
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c676c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404b18
ret
Function at 0x4c8f5c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41b978]
call fcn.004058c4
xor eax, eax
push ebp
push 0x4c90a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x553358], 0
jne 0x4c8faf
mov ecx, dword [0x554230]
mov dl, 1
mov eax, dword [0x40ac58]
call fcn.00410294
call fcn.00404470
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.0040344c
mov eax, ebx
call fcn.004054ec
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x4c90b0
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406ac4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004054fc
test eax, eax
jle 0x4c9047
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4c9040
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404d7c
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404d64
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040bc08
test eax, eax
jne 0x4c9040
mov ebx, 0x15
jmp 0x4c904c
mov ebx, 0x10
jmp 0x4c904c
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x553358]
call fcn.004c8eb4
mov eax, dword [ebp - 8]
call fcn.004c8eb4
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406adc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c90a7
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404b18
lea eax, [ebp - 0x10]
mov edx, dword [0x41b978]
call fcn.00405994
ret

Function at 0x4ca218
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.00408218
cmp ax, 0xffff
jne 0x4ca239
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x4ca2ba
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4ca2ba
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4ca280
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4ca273
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x4ca2ba
cmp dword [ebp + 8], 0
jle 0x4ca2ba
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0043333c
mov esi, eax
test esi, esi
jle 0x4ca2b1
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0040822c
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4cff90
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x55432c]
cmp byte [eax], 0
jne 0x4cffbe
mov ecx, 0xaf
mov edx, 0x4d000c
mov eax, 0x4d0048
call fcn.00404a50
mov eax, ebx
call fcn.0040529c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4cfffd
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405454
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4d005c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x55432c]
cmp byte [eax], 0
jne 0x4d007f
mov ecx, 0xbd
mov edx, 0x4d00c0
mov eax, 0x4d00fc
call fcn.00404a50
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4d00b2
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4d00b2
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4d00b2
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4d3834
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x554a8c]
cmp dword [eax], 2
je 0x4d3852
mov ecx, 0x35f
mov edx, 0x4d3884
mov eax, 0x4d38c0
call fcn.00404a50
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4d37d4
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5582a8], eax
cmp dword [0x5582a8], 0
jne 0x4d3879
call fcn.004117e0
ret

Function at 0x4d4398
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4d43fc
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404d64
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0040c514
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4403
lea eax, [ebp - 0xc]
call fcn.00404af4
ret

Function at 0x4d44a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4d44fc
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4d44cb
call fcn.004117e0
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402d30
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4d44fc
call fcn.004117e0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4dd0d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4dd258
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x276]
sub al, 2
jb 0x4dd23d
cmp byte [ebx + 0x268], 0
je 0x4dd23d
mov eax, dword [ebp - 4]
call fcn.004d5870
mov word [ebp - 6], ax
xor eax, eax
push ebp
push 0x4dd236
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [ebp - 6]
sub ax, 8
je 0x4dd17a
dec ax
je 0x4dd150
sub ax, 0x12
jne 0x4dd194
call fcn.0040451c
jmp 0x4dd23d
cmp byte [ebx + 0x269], 0
je 0x4dd21c
mov eax, ebx
call fcn.00458964
test al, al
je 0x4dd21c
xor edx, edx
mov eax, ebx
call fcn.00458988
jmp 0x4dd21c
mov eax, dword [esi]
call fcn.004054fc
mov edx, eax
mov eax, esi
mov ecx, 1
call fcn.004056e4
jmp 0x4dd21c
cmp byte [ebx + 0x269], 0
je 0x4dd1b1
mov eax, ebx
call fcn.00458964
test al, al
jne 0x4dd1b1
mov dl, 1
mov eax, ebx
call fcn.00458988
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
sub eax, dword [edx]
cmp eax, 0x4e2
jb 0x4dd1c9
mov eax, esi
call fcn.0040529c
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
push 0
push 1
lea eax, [ebp - 0x10]
mov dx, word [ebp - 6]
call fcn.004053b4
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi]
lea eax, [ebp - 0xc]
call fcn.00405568
mov ecx, dword [ebp - 0xc]
mov edx, edi
mov eax, ebx
call fcn.004dcf04
test al, al
je 0x4dd21c
lea eax, [ebp - 0x14]
mov dx, word [ebp - 6]
call fcn.004053b4
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00405508
mov word [ebp - 6], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd23d
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
call fcn.004d58a4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dd25f
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004052b4
ret

Function at 0x4e20b4
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.004e1b54
test byte [ebx + 0x23d], 4
jne 0x4e2149
mov edx, esp
mov eax, ebx
call fcn.00461324
push esp
mov eax, ebx
call fcn.00467fd0
push eax
push 0
mov eax, ebx
test eax, eax
je 0x4e20e9
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x4e211a
mov ecx, dword [0x5545e8]
mov dl, 1
mov eax, dword [0x4c8b74]
call fcn.00410294
call fcn.00404470
mov eax, ebx
call fcn.004e2688
cmp byte [ebx + 0x57], 0
jne 0x4e2150
mov eax, ebx
call fcn.004681d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4e2150
push 0
mov eax, ebx
call fcn.004681d4
push eax
call sub.user32.dll_ShowWindow
jmp 0x4e2150
mov eax, ebx
call fcn.00465154
add esp, 0x10
pop ebx
ret