joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477ca4
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x477e35
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x477e05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [ebx + 0xc]
call fcn.00403cf8
lea eax, [ebp - 0x105]
mov edx, dword [ebp - 4]
call fcn.004093e8
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [ebp - 0x114], esi
mov eax, esi
cdq
cmp edx, 0
jne 0x477d8c
cmp eax, 0xffffffff
jne 0x477d8c
lea eax, [ebp - 0x105]
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
je 0x477d69
lea eax, [ebx + 4]
mov edx, dword [ebx + 0xc]
call fcn.00403cb4
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebx], eax
lea ecx, [ebp - 0x11c]
mov edx, dword [ebx]
mov eax, edi
call fcn.004781c0
mov edx, dword [ebp - 0x11c]
lea eax, [ebx + 8]
call fcn.00403cb4
jmp 0x477dfb
xor eax, eax
mov dword [ebx], eax
lea eax, [ebx + 4]
call fcn.00403c60
lea eax, [ebx + 8]
call fcn.00403c60
lea eax, [ebx + 0xc]
mov edx, 0x477e4c
call fcn.00403cb4
jmp 0x477dfb
mov dword [ebx], esi
lea ecx, [ebp - 0x120]
mov edx, dword [ebx]
mov eax, edi
call fcn.004781c0
mov edx, dword [ebp - 0x120]
lea eax, [ebx + 8]
call fcn.00403cb4
lea eax, [ebx + 4]
mov edx, 0x477e5c
call fcn.00403cb4
cmp byte [edi + 0x1f5], 0
je 0x477dfb
push 2
push 4
push ebx
call sub.wsock32.dll_gethostbyaddr
mov esi, eax
test esi, esi
je 0x477dee
lea edx, [ebp - 0x124]
mov eax, dword [esi]
call fcn.0040950c
mov edx, dword [ebp - 0x124]
lea eax, [ebx + 4]
call fcn.00403cb4
jmp 0x477dfb
lea eax, [ebx + 4]
mov edx, 0x477e74
call fcn.00403cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x477e0f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477e3c
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00403c84
lea eax, [ebp - 4]
call fcn.00403c60
ret

Function at 0x477e90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x10
call fcn.00402bc8
mov word [esp], 2
mov ax, word [ebx + 0x1f0]
mov word [esp + 2], ax
mov eax, dword [ebx + 0x1e0]
mov dword [esp + 4], eax
mov eax, 0x10
push eax
lea eax, [esp + 4]
push eax
push 0
mov eax, dword [esi]
push eax
push edi
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_sendto
test eax, eax
jge 0x477eed
mov eax, ebx
call fcn.00478280
jmp 0x477eef
mov dword [esi], eax
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x477ef8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, dword [0x477478]
call fcn.0040447c
xor eax, eax
push ebp
push 0x477ff0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00402bc8
mov word [ebp - 0x28], 2
mov ax, word [ebx + 0x1bc]
mov word [ebp - 0x26], ax
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0x14
call fcn.00402bc8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
mov eax, dword [esi]
dec eax
push eax
push edi
mov eax, dword [ebx + 0x24]
push eax
call sub.wsock32.dll_recvfrom
test eax, eax
jge 0x477f90
mov eax, ebx
call fcn.00478280
lea eax, [ebp - 0xc]
mov edx, 0x478008
call fcn.00403cf8
jmp 0x477fbb
mov dword [esi], eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.004781c0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0xc]
call fcn.00403cf8
movzx eax, word [ebp - 0x26]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00477ca4
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x18]
mov ecx, dword [0x477478]
call fcn.00404760
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477ff7
lea eax, [ebp - 0x2c]
call fcn.00403c60
lea eax, [ebp - 0x18]
mov edx, dword [0x477478]
call fcn.00404548
ret
Function at 0x47a668
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x47a83d
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x47a824
mov eax, dword [esi + 0x24]
call fcn.00403ee0
test eax, eax
jne 0x47a6bd
mov eax, dword [esi + 0x28]
call fcn.00403ee0
test eax, eax
jne 0x47a6bd
mov eax, esi
call fcn.0047a8dc
jmp 0x47a824
cmp dword [esi + 0x94], 0
jne 0x47a6f4
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.004093e8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5298c0]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x47a72b
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.004093e8
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x5298c0]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0047a91c
mov ebx, eax
test bl, bl
jne 0x47a7d9
mov eax, dword [esi + 0x24]
call fcn.00403ee0
test eax, eax
jne 0x47a763
mov eax, dword [esi + 0xb0]
call fcn.00403ee0
test eax, eax
je 0x47a7d9
mov eax, dword [esi + 0xb0]
call fcn.00403ee0
test eax, eax
je 0x47a785
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.004093e8
jmp 0x47a7b1
push dword [esi + 0x24]
push 0x47a858
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004093e8
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x47a7d9
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.0047a91c
mov ebx, eax
test bl, bl
jne 0x47a7e6
mov eax, esi
call fcn.0047a8dc
jmp 0x47a824
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x47a7f5
mov dword [esi + 0x9c], eax
jmp 0x47a7ff
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.0047a994
test al, al
je 0x47a824
mov eax, esi
mov bx, 0xffef
call fcn.004030d4
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.0047ab64
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a844
lea eax, [ebp - 0x108]
call fcn.00403c60
ret
Function at 0x48b808
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48b810
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48ba02
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48ba18
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00403cb4
lea ecx, [ebp - 0x10]
mov edx, 0x48ba2c
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00403cb4
lea ecx, [ebp - 0x14]
mov edx, 0x48ba44
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00403cb4
lea ecx, [ebp - 0x18]
mov edx, 0x48ba60
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00403cb4
lea ecx, [ebp - 0x1c]
mov edx, 0x48ba7c
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00403cb4
lea ecx, [ebp - 0x24]
mov edx, 0x48ba94
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408b64
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408f28
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48baac
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x28]
call fcn.00481950
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48babc
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x2c]
call fcn.00481950
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48bad4
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408f28
inc eax
je 0x48b9a5
lea ecx, [ebp - 0x34]
mov edx, 0x48bad4
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x34]
call fcn.00408eec
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409cec
fstp qword [ebp - 0x3c]
wait
call fcn.0040a0c4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48b9c0
lea ecx, [ebp - 0x40]
mov edx, 0x48bad4
mov eax, esi
call fcn.00489410
mov eax, dword [ebp - 0x40]
call fcn.00481950
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48bae4
mov eax, esi
call fcn.00489410
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00403cb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ba09
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00403c84
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00403c84
ret
Function at 0x49c914
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
call sub.kernel32.dll_GetCurrentProcess
push esp
push 0x28
push eax
call sub.advapi32.dll_OpenProcessToken
lea eax, [esp + 8]
push eax
push 0x49c98c
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
test bl, bl
je 0x49c95f
mov dword [esp + 0x20], 2
jmp 0x49c965
xor eax, eax
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
add esp, 0x24
pop ebx
ret
Function at 0x49c9d0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49cbfe
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor edi, edi
push ebp
push 0x49cbce
push dword fs:[edi]
mov dword fs:[edi], esp
xor edi, edi
push ebp
push 0x49cbbd
push dword fs:[edi]
mov dword fs:[edi], esp
mov ecx, 0x49c9a0
mov eax, 0x64
lea edx, [ebp - 0x8c]
mov bl, byte [ecx]
mov byte [edx], bl
inc ecx
inc edx
dec eax
jne 0x49ca3d
push 0x49cc10
push 0x49cc20
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x194], eax
mov eax, esi
call fcn.00409324
mov ecx, eax
test ecx, ecx
jl 0x49ca81
inc ecx
xor eax, eax
lea edx, [ebp - 0x190]
mov bl, byte [esi + eax]
mov byte [edx], bl
inc eax
inc edx
dec ecx
jne 0x49ca77
mov eax, esi
call fcn.00409324
mov byte [ebp + eax - 0x190], 0
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x16c
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49caba
call fcn.0040d150
push 0x49cc30
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x49cb41
lea eax, [ebp - 0x20]
mov edx, 0x49cc48
call fcn.00403cf8
lea eax, [ebp - 0x24]
mov edx, 0x49cc58
call fcn.00403cf8
lea eax, [ebp - 0x28]
mov edx, 0x49cc6c
call fcn.00403cf8
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x198]
mov edx, 3
call fcn.00403fa0
mov eax, dword [ebp - 0x198]
call fcn.004040a4
push eax
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x16c
lea eax, [ebp - 0x194]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call esi
test eax, eax
jne 0x49cb41
call fcn.0040d150
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x108
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x49cb72
call fcn.0040d150
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cbc4
cmp dword [ebp - 0x10], 0
je 0x49cbbc
push 0x8000
push 0x16c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
Function at 0x49cc70
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ce70
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
xor edi, edi
push ebp
push 0x49ce43
push dword fs:[edi]
mov dword fs:[edi], esp
mov ecx, 0x49c9b4
mov edx, 0x64
lea eax, [ebp - 0x8c]
mov bl, byte [ecx]
mov byte [eax], bl
inc ecx
inc eax
dec edx
jne 0x49ccd1
push 0x49ce84
push 0x49ce90
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], esi
push 0x49cea0
push 0x49ceac
call sub.kernel32.dll_GetModuleHandleA_2
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [ebp - 0x94], eax
xor eax, eax
mov dword [ebp - 0x90], eax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x74
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49cd45
call fcn.0040d150
push 0x49ceb8
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x49cdc9
lea eax, [ebp - 0x20]
mov edx, 0x49ced0
call fcn.00403cf8
lea eax, [ebp - 0x24]
mov edx, 0x49cee0
call fcn.00403cf8
lea eax, [ebp - 0x28]
mov edx, 0x49cef4
call fcn.00403cf8
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0xa0]
mov edx, 3
call fcn.00403fa0
mov eax, dword [ebp - 0xa0]
call fcn.004040a4
push eax
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x74
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call esi
test eax, eax
jne 0x49cdc9
call fcn.0040d150
push ebx
call sub.kernel32.dll_FreeLibrary_1
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CreateRemoteThread
mov ebx, eax
test ebx, ebx
jne 0x49cdf8
call fcn.0040d150
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.kernel32.dll_GetExitCodeThread
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ce4a
cmp dword [ebp - 0x10], 0
je 0x49ce42
push 0x8000
push 0x16c
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_VirtualFreeEx
ret
Function at 0x4ad710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4ad725
add esp, 0xfffffff0
call fcn.00403238
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404094
xor eax, eax
push ebp
push 0x4ad7eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004a97f4
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041093c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041093c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041093c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041093c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00410954
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad7f2
lea eax, [ebp - 4]
call fcn.00403c60
ret

Function at 0x4b1c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b1d15
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4b1d2c
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00403cb4
push 0xffffffffffffffff
mov ecx, 0x4b1d3c
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
mov ecx, 0x4b1d58
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049daf0
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1d74
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049d9dc
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x10]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1d88
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049d9dc
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x20]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b1da0
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049d9dc
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x34]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4b1dbc
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049daf0
mov byte [ebx + 0x44], al
mov ecx, 0x4b1dd0
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004a94d0
mov byte [ebx + 0x45], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b1d1c
lea eax, [ebp - 4]
call fcn.00403c60
ret
Function at 0x4bc978
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bca50
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52ad90], 0
jne 0x4bca34
lea eax, [ebp - 4]
mov edx, 0x4bca68
call fcn.00403cf8
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004040a4
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4bca34
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4bca2d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x4bca17
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4bca78
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4bca17
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x52ad90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bca34
mov eax, dword [ebp - 0xc]
call fcn.00402744
ret
mov ebx, dword [0x52ad90]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bca57
lea eax, [ebp - 4]
call fcn.00403c60
ret
Function at 0x4e42c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e4527
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4e432a
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004e3de0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c77c
cmp al, 1
jne 0x4e432a
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004e40a8
test al, al
je 0x4e44b6
cmp dword [ebp - 8], 0
jge 0x4e4348
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004e3de0
mov eax, dword [ebp - 0x210]
call fcn.00403ee0
cmp ebx, eax
jge 0x4e4392
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004e3de0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5286e4]
and eax, 0xff
bt dword [edx], eax
jae 0x4e4392
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x4e43a6
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004e42a4
cmp ebx, dword [ebp - 8]
je 0x4e44a8
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4e43d2
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x527d70]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x4e4495
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x527d70]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00437844
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004030d4
and eax, 0x7f
movzx eax, word [eax*2 + 0x527d70]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00437844
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e449c
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x4e4509
cmp dword [ebp - 8], 0
jge 0x4e44c1
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004e3de0
mov eax, dword [ebp - 0x218]
call fcn.00403ee0
cmp eax, dword [ebp - 8]
jg 0x4e44fb
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004e3de0
mov eax, dword [ebp - 0x21c]
call fcn.00403ee0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004e42a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e452e
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00403c84
ret