joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47eae0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1c]
mov ebp, ecx
mov ecx, esi
mov dword [esp + 0xc], edx
push edi
shr ecx, 2
xor ebx, ebx
xor edi, edi
test ecx, ecx
je 0x47eba9
cmp ecx, 8
jb 0x47eb80
mov ebx, ecx
lea eax, [edx + 0x10]
mov esi, ebp
and ebx, 0xfffffff8
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
movaps xmm2, xmm3
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ebp + edi*4]
add edi, 8
pxor xmm1, xmm0
por xmm3, xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ebx
jb 0x47eb30
mov edx, dword [esp + 0x10]
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd ebx, xmm2
cmp edi, ecx
jae 0x47eba9
mov esi, ebp
lea edx, [edx + edi*4]
sub esi, dword [esp + 0x10]
sub ecx, edi
add edi, ecx
mov eax, dword [edx + esi]
lea edx, [edx + 4]
xor eax, dword [edx - 4]
or ebx, eax
sub ecx, 1
jne 0x47eb91
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
shl edi, 2
sub esi, edi
jne 0x47ebbf
pop edi
xor eax, eax
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0xc
ret
add edx, edi
mov eax, ebx
mov dword [esp + 0x10], edx
add ebp, edi
shr eax, 0x10
mov edx, ebx
shr edx, 0x18
xor edi, edi
or dl, al
mov eax, ebx
shr eax, 8
or dl, al
or dl, bl
mov dword [esp + 0x14], edx
test esi, esi
je 0x47ec96
cmp esi, 0x20
jb 0x47ec77
mov eax, dword [esp + 0x10]
mov ecx, esi
mov edx, ebp
and ecx, 0xffffffe0
sub edx, eax
xorps xmm3, xmm3
mov dword [esp + 0x18], edx
movaps xmm2, xmm3
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + ebp + 0x10]
add edi, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp edi, ecx
jb 0x47ec12
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movaps xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd eax, xmm2
or dl, al
mov ebx, dword [esp + 0x10]
cmp edi, esi
jae 0x47ec96
sub ebp, ebx
lea ecx, [edi + ebx]
sub esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
sub esi, 1
jne 0x47ec86
pop edi
pop esi
test dl, dl
pop ebp
sete al
pop ebx
add esp, 0xc
ret
Function at 0x487c40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movaps xmm0, xmmword [eax]
lea edx, [esi - 1]
pxor xmm0, xmmword [edi]
movaps xmmword [eax], xmm0
cmp edx, 1
jbe 0x487c8d
add edx, 0xfffffffe
lea ecx, [edi + 0x10]
shr edx, 1
inc edx
nop dword [eax]
movaps xmm0, xmmword [eax]
lea ecx, [ecx + 0x20]
aesenc xmm0, xmmword [ecx - 0x20]
movaps xmmword [eax], xmm0
aesenc xmm0, xmmword [ecx - 0x10]
movaps xmmword [eax], xmm0
sub edx, 1
jne 0x487c70
movaps xmm0, xmmword [eax]
add esi, esi
aesenc xmm0, xmmword [edi + esi*8 - 0x10]
movaps xmmword [eax], xmm0
aesenclast xmm0, xmmword [edi + esi*8]
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x487cb0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x18]
sub esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movaps xmm1, xmmword [eax]
movaps xmm0, xmmword [ecx]
mov eax, dword [ebp + 0x14]
pxor xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
push esi
mov esi, dword [ebp + 0x10]
pxor xmm0, xmm1
movaps xmmword [edx], xmm0
push edi
mov edi, dword [ebp + 0x1c]
movaps xmm0, xmmword [esi]
pxor xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
pxor xmm0, xmm1
movaps xmmword [eax], xmm0
cmp edi, 1
jbe 0x487d4d
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
add edi, 0x10
dec ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp + 8]
nop
sub dword [esp + 0xc], 1
lea edi, [edi + 0x10]
movaps xmm1, xmmword [edi - 0x10]
movaps xmm0, xmmword [ecx]
aesenc xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesenc xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesenc xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesenc xmm0, xmm1
movaps xmmword [eax], xmm0
jne 0x487d10
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
add edi, edi
movaps xmm0, xmmword [ecx]
movaps xmm1, xmmword [eax + edi*8]
mov eax, dword [ebp + 0x14]
aesenclast xmm0, xmm1
movaps xmmword [ecx], xmm0
movaps xmm0, xmmword [edx]
aesenclast xmm0, xmm1
movaps xmmword [edx], xmm0
movaps xmm0, xmmword [esi]
aesenclast xmm0, xmm1
movaps xmmword [esi], xmm0
movaps xmm0, xmmword [eax]
aesenclast xmm0, xmm1
pop edi
movaps xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48a0b0
Capabilities:
Parse credit card information

Disassembly:
push esi
mov esi, ecx
xor cl, cl
mov eax, dword [esi + 0x4c]
cmp eax, 0xffffffff
je 0x48a216
push ebx
mov edx, 0x10000000
cmp eax, 0x7c
je 0x48a215
cmp eax, 0x29
jne 0x48a0e8
cmp dword [esi + 0x10], 0
jne 0x48a215
test dword [esi + 0x50], edx
je 0x48a222
cmp eax, 0x2e
jne 0x48a103
push 5
lea ecx, [esi + 0x24]
call fcn.0048b84b
mov ecx, esi
call fcn.0048b88b
jmp 0x48a200
cmp eax, 0x5c
jne 0x48a15e
mov ecx, esi
call fcn.0048b88b
mov eax, dword [esi + 0x50]
and eax, 0x80
je 0x48a135
cmp byte [esi + 0x48], 0x62
jne 0x48a135
push 4
lea ecx, [esi + 0x24]
call fcn.0048b84b
mov ecx, esi
call fcn.0048b88b
jmp 0x48a207
test eax, eax
je 0x48a152
cmp byte [esi + 0x48], 0x42
jne 0x48a152
push 4
lea ecx, [esi + 0x24]
call fcn.0048b84b
mov eax, dword [esi + 0x28]
xor dword [eax + 8], 1
jmp 0x48a129
mov ecx, esi
call fcn.0048a22a
jmp 0x48a200
cmp eax, 0x5b
jne 0x48a17e
mov ecx, esi
call fcn.0048b88b
mov ecx, esi
call fcn.0048a5df
cmp dword [esi + 0x4c], 0x5d
je 0x48a0f7
push 4
jmp 0x48a224
cmp eax, 0x28
jne 0x48a1a6
mov ecx, esi
call fcn.0048b88b
mov ecx, esi
call fcn.0048bc3d
cmp dword [esi + 0x4c], 0x29
mov bl, al
jne 0x48a222
mov ecx, esi
call fcn.0048b88b
jmp 0x48a1fc
cmp eax, 0x5e
jne 0x48a1b2
push 2
jmp 0x48a121
cmp eax, 0x24
jne 0x48a1be
push 3
jmp 0x48a121
cmp eax, 0x2a
je 0x48a21e
cmp eax, 0x2b
je 0x48a21e
cmp eax, 0x3f
je 0x48a21e
cmp eax, 0x7b
je 0x48a21e
cmp eax, 0x7d
jne 0x48a1dc
test dword [esi + 0x50], edx
je 0x48a21a
cmp eax, 0x5d
jne 0x48a1e6
test dword [esi + 0x50], edx
je 0x48a177
movzx eax, byte [esi + 0x48]
lea ecx, [esi + 0x24]
push eax
call fcn.00489a67
mov ecx, esi
call fcn.0048b88b
mov bl, 1
test bl, bl
je 0x48a207
mov ecx, esi
call fcn.0048b8b4
mov eax, dword [esi + 0x4c]
mov cl, 1
cmp eax, 0xffffffff
jne 0x48a0c2
pop ebx
mov al, cl
pop esi
ret
push 6
jmp 0x48a224
push 0xa
jmp 0x48a224
push 5
call fcn.004d2a25
int3
Function at 0x4a8ea8
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x539b0c
call fcn.004e49d2
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4a8fa8
cmp byte [ebx + 0x3d], 0
je 0x4a8fa8
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4a8ee2
xor al, al
jmp 0x4a8faa
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.00416bc9
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4a8f40
sub eax, 1
je 0x4a8f44
dec eax
sub eax, 1
je 0x4a8f96
xor bl, bl
jmp 0x4a8f98
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4a8f7c
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0050fd41
add esp, 0x10
cmp esi, eax
jne 0x4a8f3c
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x4a8f96
test esi, esi
jne 0x4a8f06
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00416d26
jmp 0x4a8f00
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00416ab1
mov al, bl
jmp 0x4a8faa
mov al, 1
call fcn.004e497c
ret
Function at 0x4b1054
Capabilities:
Encode data using base64

Disassembly:
push 0x1c
mov eax, 0x5399f2
call fcn.004e499e
mov ecx, dword [ebp + 0x10]
xor edx, edx
push 3
mov eax, ecx
xor ebx, ebx
pop esi
div esi
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
test edx, edx
je 0x4b1089
inc ecx
xor edx, edx
mov eax, ecx
inc edi
div esi
test edx, edx
jne 0x4b107a
mov dword [ebp - 0x1c], edi
mov eax, ecx
xor edx, edx
shl eax, 2
div esi
mov esi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [esi + 0x14], 0xf
cmp dword [esi + 0x14], 0x10
mov dword [esi + 0x10], ebx
jb 0x4b10ae
mov eax, dword [esi]
jmp 0x4b10b0
mov eax, esi
mov byte [eax], bl
push ecx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 1
call fcn.00414724
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shr eax, 2
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4b11a2
mov edi, ebx
mov ecx, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x10]
jae 0x4b10ea
movzx eax, byte [ecx + edi]
mov dword [ebp - 0x10], eax
jmp 0x4b10ed
mov dword [ebp - 0x10], ebx
lea eax, [edi + 1]
cmp eax, dword [ebp + 0x10]
jae 0x4b10fc
movzx edx, byte [edi + ecx + 1]
jmp 0x4b10fe
mov edx, ebx
inc eax
cmp eax, dword [ebp + 0x10]
jae 0x4b110e
movzx eax, byte [edi + ecx + 2]
mov dword [ebp - 0x14], eax
jmp 0x4b1111
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov cl, al
and al, 3
shr cl, 2
shl al, 4
mov dword [ebp - 0x10], eax
mov al, dl
shr al, 4
and dl, 0xf
add byte [ebp - 0x10], al
mov al, byte [ebp - 0x14]
and byte [ebp - 0x14], 0x3f
shr al, 6
shl dl, 2
add dl, al
movzx eax, cl
mov ecx, esi
mov dword [ebp - 0x28], edx
movzx eax, byte [eax + 0x53f510]
push eax
call fcn.004308ed
mov ecx, dword [ebp - 0x10]
movzx eax, cl
mov ecx, esi
movzx eax, byte [eax + 0x53f510]
push eax
call fcn.004308ed
mov ecx, dword [ebp - 0x28]
movzx eax, cl
mov ecx, esi
movzx eax, byte [eax + 0x53f510]
push eax
call fcn.004308ed
mov ecx, dword [ebp - 0x14]
movzx eax, cl
mov ecx, esi
movzx eax, byte [eax + 0x53f510]
push eax
call fcn.004308ed
add edi, 3
sub dword [ebp - 0x18], 1
jne 0x4b10d9
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
test edi, edi
je 0x4b11be
cmp dword [esi + 0x14], 0x10
jb 0x4b11b0
mov eax, dword [esi]
jmp 0x4b11b2
mov eax, esi
sub eax, ebx
inc ebx
mov byte [eax + ecx - 1], 0x3d
cmp ebx, edi
jb 0x4b11a6
mov eax, esi
call fcn.004e4967
ret
Function at 0x4b1640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_LockResource]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 4
and edi, 0xf
inc eax
mov dword [ebp - 8], 0
movzx ecx, ax
xor esi, esi
mov dword [ebp - 4], 0x409
mov dword [ebp + 8], ecx
movzx eax, word [ebp + esi*4 - 8]
push eax
push ecx
push 6
push dword [0x5eca58]
call dword [sym.imp.KERNEL32.DLL_FindResourceExW]
test eax, eax
je 0x4b16c5
push eax
push dword [0x5eca58]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x4b16c5
push eax
call ebx
test eax, eax
je 0x4b16c5
test edi, edi
jle 0x4b16be
mov edx, edi
nop dword [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + ecx*2]
add eax, 2
sub edx, 1
jne 0x4b16b0
movzx ecx, word [eax]
test ecx, ecx
jne 0x4b16d0
inc esi
cmp esi, 2
jae 0x4b16da
mov ecx, dword [ebp + 8]
jmp 0x4b1671
pop edi
pop esi
add eax, 2
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x5aeb6c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4a00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5e1390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push ebx
push dword [esi + 0xc]
call fcn.004b1310
mov eax, dword [ebx + 4]
add esp, 0xc
inc eax
cdq
sub eax, edx
sar eax, 1
mov dword [ebx + 8], eax
lea eax, [ebp - 0x18]
push 2
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
je 0x4b4a7f
mov edx, dword [ebx + 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
add eax, edx
mov dword [ebx + 0xc], eax
add ecx, edx
mov eax, dword [ebp - 0xc]
sub eax, edx
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 4]
add eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x18], eax
jmp 0x4b4a9b
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov eax, dword [ebx]
mov esi, ecx
mov edi, dword [ebx + 8]
sub ecx, edi
mov edx, dword [ebx + 0x18]
mov dword [ebx + 0x34], ecx
add edx, edi
mov ecx, dword [ebp - 8]
lea eax, [eax + eax*2]
shl eax, 2
sub ecx, edi
sub esi, eax
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp - 0x14]
sub esi, edi
mov dword [ebx + 0x2c], esi
add eax, edi
sub esi, edi
mov dword [ebx + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx + 0x24], esi
xor ecx, ebp
pop esi
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], edx
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
Function at 0x4b5cb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x5e1390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebx]
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x254], ebx
call fcn.004cdea0
add esp, 4
cmp dword [ebp + 0x14], 0
je 0x4b5d30
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 5
call ebx
movzx esi, al
or esi, 0xffffff00
push 5
shl esi, 8
call ebx
shr eax, 8
movzx edi, al
or edi, esi
push 5
shl edi, 8
call ebx
mov ebx, dword [ebp - 0x254]
shr eax, 0x10
movzx eax, al
or eax, edi
push eax
push dword [ebx]
call fcn.004ce3a0
mov esi, dword [ebp - 0x258]
add esp, 8
lea eax, [ebp - 0x250]
push eax
push esi
call fcn.004b4a00
mov eax, dword [ebp - 0x244]
add esp, 8
mov ecx, dword [ebp - 0x23c]
cmp eax, ecx
jge 0x4b5de3
mov edx, dword [ebp - 0x240]
mov edi, dword [ebp - 0x238]
cmp edx, edi
jge 0x4b5de3
movd xmm0, eax
lea eax, [ebp - 0x204]
cvtdq2ps xmm0, xmm0
push 0x100
push eax
push dword [esi]
movss dword [ebp - 0x214], xmm0
movd xmm0, edx
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x210], xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x20c], xmm0
movd xmm0, edi
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x208], xmm0
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xff000000
push dword [ebx + 4]
call fcn.004cdd10
push 9
push dword [ebx + 4]
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebx + 8]
push dword [ebx]
call fcn.004ce8d0
add esp, 0x24
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004b5820
mov ecx, dword [esi + 0x10]
add esp, 0xc
and ecx, 0x3f
cmp ecx, 9
ja case.default.0x4b5e03
jmp dword [ecx*4 + 0x4b5ebc]
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004ba0f0
add esp, 0xc
jmp case.default.0x4b5e03
lea eax, [ebp - 0x250]
push eax
push ebx
push esi
call fcn.004bb610
add esp, 0xc
jmp case.default.0x4b5e03
cmp ecx, 3
je 0x4b5e41
cmp ecx, 5
je 0x4b5e41
xor edx, edx
jmp 0x4b5e46
mov edx, 1
cmp ecx, 4
je 0x4b5e54
cmp ecx, 5
je 0x4b5e54
xor eax, eax
jmp 0x4b5e59
mov eax, 1
lea ecx, [ebp - 0x250]
push ecx
push ebx
push edx
push eax
push esi
call fcn.004b8e70
add esp, 0x14
jmp case.default.0x4b5e03
lea eax, [ebp - 0x250]
push eax
xor eax, eax
cmp ecx, 7
push ebx
sete al
push eax
push esi
call fcn.004b7820
jmp 0x4b5e9e
lea eax, [ebp - 0x250]
push eax
xor eax, eax
cmp ecx, 9
push ebx
sete al
push eax
push esi
call fcn.004b3e50
add esp, 0x10
push dword [ebx]
call fcn.004ce110
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
Function at 0x4b6980
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5e1390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
add eax, dword [edi + 4]
mov cl, byte [edi + 8]
mov dword [ebp + 0xc], eax
test cl, cl
je 0x4b6a96
test eax, eax
je 0x4b6a96
push esi
test cl, cl
jle 0x4b6a0c
push eax
push 0x53f7dc
push ebx
call fcn.004b3320
mov edx, eax
add esp, 0xc
movsx eax, byte [edi + 8]
mov ecx, edx
add eax, edx
cmp edx, eax
jge 0x4b69ef
mov esi, 0x30
nop dword [eax + eax]
mov word [ebx + ecx*2], si
inc ecx
movsx eax, byte [edi + 8]
add eax, edx
cmp ecx, eax
jl 0x4b69e0
movsx eax, byte [edi + 8]
add eax, edx
xor ecx, ecx
pop esi
pop edi
mov word [ebx + eax*2], cx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
movsx eax, cl
mov esi, 0xa
neg eax
cmp eax, 1
je 0x4b6a2a
dec eax
nop dword [eax]
lea esi, [esi + esi*4]
add esi, esi
sub eax, 1
jne 0x4b6a20
push 4
lea eax, [ebp - 0xc]
push eax
push 0xe
call dword [sym.imp.KERNEL32.DLL_GetThreadLocale]
push eax
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4b6a56
mov eax, 0x2e
mov dword [ebp - 0x10], 1
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 0xc]
cdq
xor eax, edx
movsx ecx, byte [edi + 8]
sub eax, edx
neg ecx
cdq
idiv esi
lea eax, [ebp - 0xc]
push edx
push ecx
push eax
mov eax, dword [ebp + 0xc]
cdq
idiv esi
push dword [ebp - 0x10]
push eax
push str._d_.s_0.d
push ebx
call fcn.004b3320
add esp, 0x1c
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret
push eax
push 0x53f7dc
push ebx
call fcn.004b3320
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret

Function at 0x4bd820
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, byte [eax + 0x13]
and eax, 1
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004b1640
Function at 0x4c1370
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0x100
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x4c13ba
cmp ebx, 9
je 0x4c13ba
cmp ebx, 8
je 0x4c13ba
cmp ebx, 0x2e
je 0x4c13ba
cmp ebx, 0x56
je 0x4c13a6
cmp ebx, 0x43
je 0x4c13a6
cmp ebx, 0x58
je 0x4c13a6
cmp ebx, 0x5a
jne 0x4c13b3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jne 0x4c13ba
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0x20], ebx
mov eax, dword [edi + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x18], eax
lea edx, [ebp - 8]
movsx eax, si
mov dword [ebp - 0x14], eax
shr esi, 0x10
movsx eax, si
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x14]
push edx
push 0x540754
push eax
mov ecx, dword [eax]
mov eax, dword [ecx]
call eax
pop edi
pop esi
test eax, eax
jne 0x4c1464
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4c1464
mov eax, dword [ecx]
lea edx, [ebp - 4]
push edx
push 0x540704
push ecx
mov eax, dword [eax]
call eax
test eax, eax
jne 0x4c1459
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4c1459
mov eax, dword [ecx]
lea edx, [ebp - 0x28]
push edx
push ecx
mov eax, dword [eax + 0x14]
call eax
sub eax, 0
jne 0x4c144e
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
call eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ecx]
mov ecx, dword [edx + 8]
call ecx
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c35c0
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5e1390]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edi, eax
mov dword [ebp - 0x68], 0x30
xor eax, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x64], 0xe3
mov dword [ebp - 0x3c], 0xffffffff
cmp ax, word [ebx + 0x22]
jae 0x4c366e
mov edx, 0x1000
nop word [eax + eax]
lea eax, [esi + 0x3e8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x58], eax
xor ecx, ecx
movsx eax, word [ebx + 0x4c]
cmp esi, eax
mov eax, dword [ebx + 0x1c]
cmove ecx, edx
mov dword [ebp - 0x5c], ecx
movzx ecx, si
add ecx, ecx
mov ecx, dword [eax + ecx*8]
mov dword [ebp - 0x44], ecx
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c3640
lea eax, [ebp - 0x68]
sub ecx, edx
push eax
push 1
push esi
sar ecx, 1
push edi
mov dword [ebp - 0x40], ecx
call dword [sym.imp.USER32.dll_InsertMenuItemW]
movzx eax, word [ebx + 0x22]
inc esi
mov edx, 0x1000
cmp esi, eax
jl 0x4c3610
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x1c
push eax
push edi
mov dword [ebp - 0x34], 0x10
call dword [sym.imp.USER32.dll_GetMenuInfo]
or dword [ebp - 0x30], 0x4000000
lea eax, [ebp - 0x38]
push eax
push edi
call dword [sym.imp.USER32.dll_SetMenuInfo]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xca
push 0x419
push dword [ebx + 8]
call edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x14
push ecx
push eax
push 0x41d
push dword [ebx + 8]
call edi
push 0
push 0xca
push 0x412
push dword [ebx + 8]
call edi
movzx esi, ax
mov eax, esi
or eax, 2
push eax
push 0xca
push 0x411
push dword [ebx + 8]
call edi
push 2
lea eax, [ebp - 0x14]
push eax
push 0
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 8
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_DestroyMenu]
push esi
push 0xca
push 0x411
push dword [ebx + 8]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3e0d
mov esp, ebp
pop ebp
ret