joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ab18
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
mov edx, 0x50495c
and eax, 0xff
mov ecx, dword [edx]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x502480]
mov ebx, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ecx
mov dword [edx], ebx
and ebx, 0xff
add dword [edx + 4], ebx
imul eax, dword [edx + 4], 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
mov ecx, dword [edx + 8]
xor eax, ecx
and eax, 0xff
mov ebx, dword [0x502480]
mov eax, dword [ebx + eax*4]
shr ecx, 8
and ecx, 0xffffff
xor eax, ecx
mov dword [edx + 8], eax
pop ebx
ret

Function at 0x48ac38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48ac61
call fcn.0048ac18
mov edx, dword [esi]
xor byte [edx], al
mov eax, dword [esi]
mov al, byte [eax]
call fcn.0048ab18
inc dword [esi]
dec ebx
jne 0x48ac4a
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48ac68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov ebx, edx
test ebx, ebx
jle 0x48ac9c
call fcn.0048ac18
mov esi, eax
and esi, 0xff
mov eax, dword [edi]
mov al, byte [eax]
call fcn.0048ab18
mov eax, esi
mov edx, dword [edi]
xor byte [edx], al
inc dword [edi]
dec ebx
jne 0x48ac7b
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x48acc4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48ad73
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x48ad5d
mov eax, dword [ebp + 8]
call fcn.0048ab7c
test eax, eax
jne 0x48ad5d
xor ebx, ebx
call fcn.0048ac18
xor edx, edx
mov dl, bl
xor al, byte [esi + edx + 0xc]
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
call fcn.0048ab18
xor eax, eax
mov al, bl
mov dl, byte [ebp - 5]
mov byte [esi + eax], dl
inc ebx
cmp bl, 0xc
jne 0x48ad00
mov bl, byte [esi + 0xb]
and di, 8
cmp di, 8
je 0x48ad4b
mov eax, dword [ebp - 4]
call fcn.004079b8
call fcn.004079bc
cmp bl, al
sete al
mov ebx, eax
jmp 0x48ad5d
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ad7a
lea eax, [ebp + 8]
call fcn.00404370
ret

Function at 0x48b328
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040484c
xor eax, eax
push ebp
push 0x48b379
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040485c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48b35d
test al, 0x10
jne 0x48b361
xor ebx, ebx
jmp 0x48b363
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b380
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x48b4e8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push esp
push 0x103
call sub.kernel32.dll_GetTempPathA
test eax, eax
je 0x48b510
mov eax, ebx
mov edx, esp
mov ecx, 0x104
call fcn.004045f0
jmp 0x48b519
mov eax, ebx
xor edx, edx
call fcn.004049e8
add esp, 0x104
pop ebx
ret

Function at 0x48dd08
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
xor edx, edx
push ebp
push 0x48de69
push dword fs:[edx]
mov dword fs:[edx], esp
sub al, 1
jb 0x48dd2c
je 0x48dd46
dec al
je 0x48dd60
jmp 0x48de1b
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de20
push 0
push 0
push 1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de20
push 0x80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.0040485c
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x48dd91
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.00409de8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x370]
call fcn.0040a300
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
test dword [eax + 0x1e1e], 0x200
jbe 0x48ddf4
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
mov dl, 1
call fcn.0048b41c
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, 0x4d8
call fcn.004043c4
push 0
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de20
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x4d8]
call fcn.0040485c
push eax
push 0
push 2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call dword [0x50498c]
mov esi, eax
jmp 0x48de20
mov esi, 0xc
test esi, esi
je 0x48de53
push 0x48de80
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, esi
call fcn.0048ced0
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [eax + 0x3208]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
xor ecx, ecx
mov ebx, dword [eax]
call dword [ebx + 0x98]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48de70
lea eax, [ebp - 4]
call fcn.00404370
ret
Function at 0x4a1dd4
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x51cad8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4a1df6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4a1df8
shr eax, 1
dec edx
jne 0x4a1de4
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4a1ddd
mov byte [0x51ced8], 1
pop esi
pop ebx
ret

Function at 0x4a1e14
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x51ced8], 0
jne 0x4a1e2b
call fcn.004a1dd4
mov eax, edi
dec eax
cmp eax, 0xffff
jg 0x4a1e5b
test eax, eax
jl 0x4a1e5b
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x51cad8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4a1e3c
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a4998
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4a49c9
dec al
je 0x4a4a05
dec al
je 0x4a4a49
dec al
je 0x4a4ab4
jmp 0x4a4b3e
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4a4b3e
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a49d9
jmp 0x4a4b3e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4b3e
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4a4a15
jmp 0x4a4b3e
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4b3e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4a4a77
xor ebp, ebp
jmp 0x4a4a88
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4a4a91
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a4a59
jmp 0x4a4b3e
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4a4b3e
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4a4b0c
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004a1e64
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4a4ac8
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a8ce4
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a8d53
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20e]
push eax
push 0
push 0x4a8d64
mov eax, dword [ebp - 4]
call fcn.00404cec
push eax
call sub.kernel32.dll_GetTempFileNameW
test eax, eax
je 0x4a8d3b
lea eax, [ebp - 0x20e]
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x4a8d3d
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8d5a
lea eax, [ebp - 4]
call fcn.00404aa8
ret

Function at 0x4a9220
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a933c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cec
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.004027b0
mov dword [ebp - 0x18], eax
xor edx, edx
push ebp
push 0x4a9309
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4a934c
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax + 8]
shr ebx, 0x10
mov si, word [eax + 8]
and si, 0xffff
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ebp - 0x1e], dx
mov di, word [eax + 0xc]
and di, 0xffff
mov eax, dword [ebp - 8]
push eax
movzx eax, bx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, si
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
movzx eax, word [ebp - 0x1e]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, di
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x4a9358
call fcn.0040aa60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a931b
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.004027d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a9343
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x4a9374
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a94e0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x4a94f4
mov edx, dword [ebp - 4]
call fcn.00404d68
mov eax, dword [ebp - 0x25c]
call fcn.00404cec
push eax
call sub.kernel32.dll_FindFirstFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4a9485
lea eax, [ebp - 8]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.00404c54
mov eax, 0x4a9500
mov edx, dword [ebp - 8]
call fcn.00404e14
je 0x4a946a
mov eax, 0x4a9508
mov edx, dword [ebp - 8]
call fcn.00404e14
je 0x4a946a
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404d68
mov eax, dword [ebp - 0x258]
and eax, 0x10
cmp eax, 0x10
je 0x4a944c
push 0x20
mov eax, dword [ebp - 8]
call fcn.00404cec
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesW
push esi
call sub.kernel32.dll_DeleteFileW
jmp 0x4a946a
lea eax, [ebp - 0x260]
mov ecx, 0x4a9514
mov edx, dword [ebp - 8]
call fcn.00404d68
mov eax, dword [ebp - 0x260]
call fcn.004a9374
lea eax, [ebp - 0x258]
push eax
push ebx
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x4a93e5
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 4]
call fcn.00404cfc
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404e98
mov eax, dword [ebp - 0x264]
call fcn.00404cec
push eax
call sub.kernel32.dll_RemoveDirectoryW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a94e7
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00404ac0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ac0
ret

Function at 0x4a9758
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4a9788
push 0
push esi
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x4a9782
push esi
call sub.kernel32.dll_CloseHandle
mov bl, 1
jmp 0x4a9788
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4a9888
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a98dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404cec
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesW
push ebx
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a98e3
lea eax, [ebp - 4]
call fcn.00404aa8
ret
Function at 0x4a98ec
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004050a4
xor eax, eax
push ebp
push 0x4a99cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov eax, dword [ebp - 4]
call fcn.00404cec
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [0x502588]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x4a99e4
mov edx, dword [ebp - 4]
call fcn.00404d68
mov eax, dword [ebp - 0x28]
call fcn.00404cec
mov dword [ebp - 0x1a], eax
mov eax, 0x4a99e8
mov dword [ebp - 0x16], eax
test bl, bl
je 0x4a9968
mov word [ebp - 0x12], 0x454
jmp 0x4a996e
mov word [ebp - 0x12], 0x40
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4a99a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a99af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a99d4
lea eax, [ebp - 0x28]
call fcn.00404aa8
lea eax, [ebp - 4]
call fcn.00404aa8
ret

Function at 0x4ab2a0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push 0
push eax
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404c54
add esp, 0x20c
pop ebx
ret

Function at 0x4ab66c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4ab688
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4ab737
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
call sub.shell32.dll_SHGetDesktopFolder
call fcn.00417f48
test al, al
je 0x4ab721
lea eax, [ebp - 0x18]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00417f48
test al, al
je 0x4ab721
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x5025e8]
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
call fcn.00417f48
test al, al
je 0x4ab719
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, ebx
call fcn.00404cec
push eax
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.00417f54
test al, al
je 0x4ab719
mov eax, dword [ebp - 4]
call fcn.004061a4
lea eax, [ebp - 0x18]
call fcn.004ab2d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab73e
lea eax, [ebp - 0x14]
call fcn.004061a4
ret
Function at 0x4b36d4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4b371e
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404c54
jmp 0x4b3725
mov eax, ebx
call fcn.00404aa8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4b372c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4b3764
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4b3764
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4b3764
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4b9744
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b9795
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b977c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b976c
jmp 0x4b9795
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b977d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9ac0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c9d20
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4c9b23
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004c9588
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040e3a4
cmp al, 1
jne 0x4c9b23
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004c98a0
test al, al
je 0x4c9caf
cmp dword [ebp - 8], 0
jge 0x4c9b41
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004c9588
mov eax, dword [ebp - 0x210]
call fcn.0040465c
cmp ebx, eax
jge 0x4c9b8b
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004c9588
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x50278c]
and eax, 0xff
bt dword [edx], eax
jae 0x4c9b8b
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4c9b9f
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c9a9c
cmp ebx, dword [ebp - 8]
je 0x4c9ca1
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4c9bcb
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040371c
and eax, 0x7f
movzx eax, word [eax*2 + 0x501dc0]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4c9c8e
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040371c
and eax, 0x7f
movzx eax, word [eax*2 + 0x501dc0]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00467d84
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040371c
and eax, 0x7f
movzx eax, word [eax*2 + 0x501dc0]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00467d84
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9c95
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4c9d02
cmp dword [ebp - 8], 0
jge 0x4c9cba
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004c9588
mov eax, dword [ebp - 0x218]
call fcn.0040465c
cmp eax, dword [ebp - 8]
jg 0x4c9cf4
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004c9588
mov eax, dword [ebp - 0x21c]
call fcn.0040465c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c9a9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9d27
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404394
ret