joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0518
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4c0547
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4c05c6
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004be904
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c0594
mov cx, word [esp]
sub cx, si
jmp 0x4c0596
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c057d
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4c05bc
mov cx, word [esp]
sub cx, si
jmp 0x4c05be
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4c05a5
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4c06a7
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004c028c
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4c0612
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x74]
cmp eax, 0x106
jae 0x4c0628
mov edx, dword [ebx]
cmp dword [edx + 4], 0
jne 0x4c0522
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x16c0]
cmp ecx, edx
jbe 0x4c06a7
mov esi, dword [ebx + 0x6c]
add esi, eax
cmp esi, edx
jbe 0x4c066a
mov edi, ecx
sub edi, esi
cmp edi, 0x102
jbe 0x4c064f
mov edi, 0x102
push edi
push 0
mov eax, dword [ebx + 0x38]
add eax, esi
push eax
call fcn.004be8ec
add esp, 0xc
add edi, esi
mov dword [ebx + 0x16c0], edi
jmp 0x4c06a7
lea edx, [esi + 0x102]
mov eax, dword [ebx + 0x16c0]
cmp edx, eax
jbe 0x4c06a7
mov edi, edx
mov edx, dword [ebx + 0x3c]
sub edx, eax
sub edi, eax
cmp edi, edx
jbe 0x4c0690
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x16c0]
push edi
push 0
mov edx, dword [ebx + 0x38]
add edx, eax
push edx
call fcn.004be8ec
add esp, 0xc
add dword [ebx + 0x16c0], edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c7ba8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [0x563ce0], eax
xor eax, eax
push ebp
push 0x4c7c17
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
call sub.user32.dll_GetProcessWindowStation
mov dword [0x563ce0], eax
lea eax, [ebp - 4]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, dword [0x563ce0]
push eax
call sub.user32.dll_GetUserObjectInformationA
test eax, eax
je 0x4c7bf6
test byte [ebp - 8], 1
jne 0x4c7c0d
push 0
push 0x4c7b04
call sub.user32.dll_EnumWindowStationsA
test eax, eax
je 0x4c7c0d
xor eax, eax
mov dword [0x563ce0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c7c28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c7d68
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
mov dword [esp], 0x101
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
mov eax, ebx
lea edx, [esp + 4]
call fcn.00404908
add esp, 0x108
pop ebx
ret
Function at 0x4c7d98
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c7fc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48ae00]
call fcn.004aa950
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4c7f8b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4c7f63
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c7f4b
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4c7f35
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c7f35
xor eax, eax
push ebp
push 0x4c7f2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalSize
mov ebx, eax
test ebx, ebx
jle 0x4c7f17
lea eax, [ebp - 0x18]
mov edx, 0xff
call fcn.00404d5c
push 0xff
lea eax, [ebp - 0x18]
call fcn.00404c28
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClipboardFormatNameA
mov esi, eax
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00404d5c
mov eax, dword [ebp - 0x1c]
call fcn.004abb68
cmp dword [ebp - 0x18], 0
je 0x4c7eb0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00404f8c
mov ecx, dword [ebp - 0x20]
mov edx, 0x4c7fd8
mov eax, dword [ebp - 0x1c]
call fcn.004a3f24
jmp 0x4c7ec0
mov ecx, dword [ebp - 8]
mov edx, 0x4c7fe8
mov eax, dword [ebp - 0x1c]
call fcn.004a3b08
push ebx
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x483214]
call fcn.00405c38
add esp, 4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
call fcn.00402d68
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0048d170
mov ecx, dword [ebp - 0x24]
mov edx, 0x4c7ff4
mov eax, dword [ebp - 0x1c]
call fcn.004a3dc8
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x483214]
call fcn.00405c38
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7f35
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x4c7e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7f6a
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4c7f35
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c7fc6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48ae00]
call fcn.004aa950
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4c7f8b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4c7f63
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4c7f4b
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4c7f35
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c7f35
xor eax, eax
push ebp
push 0x4c7f2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalSize
mov ebx, eax
test ebx, ebx
jle 0x4c7f17
lea eax, [ebp - 0x18]
mov edx, 0xff
call fcn.00404d5c
push 0xff
lea eax, [ebp - 0x18]
call fcn.00404c28
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetClipboardFormatNameA
mov esi, eax
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.00404d5c
mov eax, dword [ebp - 0x1c]
call fcn.004abb68
cmp dword [ebp - 0x18], 0
je 0x4c7eb0
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x18]
call fcn.00404f8c
mov ecx, dword [ebp - 0x20]
mov edx, 0x4c7fd8
mov eax, dword [ebp - 0x1c]
call fcn.004a3f24
jmp 0x4c7ec0
mov ecx, dword [ebp - 8]
mov edx, 0x4c7fe8
mov eax, dword [ebp - 0x1c]
call fcn.004a3b08
push ebx
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x483214]
call fcn.00405c38
add esp, 4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
call fcn.00402d68
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.0048d170
mov ecx, dword [ebp - 0x24]
mov edx, 0x4c7ff4
mov eax, dword [ebp - 0x1c]
call fcn.004a3dc8
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x483214]
call fcn.00405c38
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7f35
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x4c7e08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7f6a
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4c8000
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c8008
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4c83d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48ac14]
call fcn.004a94dc
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4c8385
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4c81d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4c81b9
lea eax, [ebp - 0x18]
mov edx, 0xff
call fcn.00404d5c
push 0xff
lea eax, [ebp - 0x18]
call fcn.00404c28
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClipboardFormatNameA
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404d5c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00408ea4
mov eax, dword [ebp - 0x20]
mov edx, 0x4c83ec
call fcn.00404b1c
jne 0x4c81a3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4c81a3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c81a3
xor eax, eax
push ebp
push 0x4c819c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalSize
mov esi, eax
test esi, esi
jle 0x4c8185
mov edx, esi
sar edx, 1
jns 0x4c810d
adc edx, 0
lea eax, [ebp - 0xc]
call fcn.004051e8
mov eax, dword [ebp - 0xc]
call fcn.00404f9c
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.00402d68
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fac
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040514c
mov eax, dword [ebp - 0x24]
mov edx, 0x4c83fc
call fcn.004050c8
jne 0x4c8166
mov eax, dword [ebp - 0xc]
call fcn.00404fac
mov edx, eax
dec edx
lea eax, [ebp - 0xc]
call fcn.004051e8
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004a9098
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004051e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c81a3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x4c8069
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c81d8
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4c81a3
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4c8008
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x4c83d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x48ac14]
call fcn.004a94dc
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4c8385
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x4c81d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x4c81b9
lea eax, [ebp - 0x18]
mov edx, 0xff
call fcn.00404d5c
push 0xff
lea eax, [ebp - 0x18]
call fcn.00404c28
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClipboardFormatNameA
mov ebx, eax
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00404d5c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x18]
call fcn.00408ea4
mov eax, dword [ebp - 0x20]
mov edx, 0x4c83ec
call fcn.00404b1c
jne 0x4c81a3
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4c81a3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4c81a3
xor eax, eax
push ebp
push 0x4c819c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalSize
mov esi, eax
test esi, esi
jle 0x4c8185
mov edx, esi
sar edx, 1
jns 0x4c810d
adc edx, 0
lea eax, [ebp - 0xc]
call fcn.004051e8
mov eax, dword [ebp - 0xc]
call fcn.00404f9c
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, esi
call fcn.00402d68
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404fac
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.0040514c
mov eax, dword [ebp - 0x24]
mov edx, 0x4c83fc
call fcn.004050c8
jne 0x4c8166
mov eax, dword [ebp - 0xc]
call fcn.00404fac
mov edx, eax
dec edx
lea eax, [ebp - 0xc]
call fcn.004051e8
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004a9098
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004051e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c81a3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_EnumClipboardFormats
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x4c8069
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c81d8
call fcn.004372e0
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4c8ac4
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
xor eax, eax
push ebp
push 0x4c8af3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00404700
mov ecx, 0x4c8b08
mov dl, 1
mov eax, dword [0x43bda8]
call fcn.0043c5c0
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4c8b28
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0043c654
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040911c
mov eax, dword [ebp - 4]
call fcn.00403890
cmp dword [ebp - 8], 0
je 0x4c8ad8
mov byte [0x5620c0], 1
cmp dword [ebp - 8], 0
je 0x4c8ac4
mov ecx, 0x4c8b08
mov dl, 1
mov eax, dword [0x43bda8]
call fcn.0043c5c0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c8abd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov ecx, 0x4c8b28
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0043c720
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8ac4
mov eax, dword [ebp - 4]
call fcn.00403890
ret
push 3
mov eax, dword [ebp - 8]
call fcn.00404bd0
push eax
push 0
push 0x14
call sub.user32.dll_SystemParametersInfoA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c8afa
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404724
ret

Function at 0x4cc880
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov ebx, ecx
mov esi, edx
push 0
movzx eax, si
push eax
call sub.user32.dll_MapVirtualKeyA
test bl, bl
je 0x4cc8a5
push 0
push 0
push eax
mov eax, esi
push eax
call sub.user32.dll_keybd_event
pop esi
pop ebx
ret
push 0
push 2
push eax
mov eax, esi
push eax
call sub.user32.dll_keybd_event
pop esi
pop ebx
ret

Function at 0x4cca18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov word [esp + 4], cx
mov dword [esp], edx
mov esi, eax
mov eax, dword [esp]
call fcn.004049d0
mov edi, eax
test edi, edi
jle 0x4ccb15
mov ebp, 1
mov eax, dword [esp]
mov al, byte [eax + ebp - 1]
push eax
call sub.user32.dll_VkKeyScanA
mov ebx, eax
cmp bx, 0xffff
jne 0x4cca99
mov ax, word [esp + 4]
add eax, 0xfffffff0
sub ax, 3
jb 0x4ccb0d
sub ax, 1
je 0x4ccb0d
sub ax, 0x7c
je 0x4ccb0d
mov cl, 1
mov dx, word [esp + 4]
mov eax, esi
call fcn.004cc880
xor ecx, ecx
mov dx, word [esp + 4]
mov eax, esi
call fcn.004cc880
jmp 0x4ccb0d
test bh, 1
setne byte [esp + 8]
test bh, 2
setne byte [esp + 7]
test bh, 4
setne byte [esp + 6]
and bx, 0xf8ff
push 0x14
call sub.user32.dll_GetKeyState
test ax, ax
setg byte [esp + 9]
mov al, byte [esp + 7]
push eax
mov al, byte [esp + 0xa]
push eax
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x11]
mov eax, esi
call fcn.004cc938
mov cl, 1
mov edx, ebx
mov eax, esi
call fcn.004cc880
xor ecx, ecx
mov edx, ebx
mov eax, esi
call fcn.004cc880
mov al, byte [esp + 7]
push eax
mov al, byte [esp + 0xa]
push eax
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x11]
mov eax, esi
call fcn.004cc9a4
inc ebp
dec edi
jne 0x4cca40
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ccb20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov word [esp + 4], cx
mov dword [esp], edx
mov esi, eax
mov eax, dword [esp]
call fcn.00404fac
mov edi, eax
test edi, edi
jle 0x4ccc1e
mov ebp, 1
mov eax, dword [esp]
mov ax, word [eax + ebp*2 - 2]
push eax
call sub.user32.dll_VkKeyScanW
mov ebx, eax
cmp bx, 0xffff
jne 0x4ccba2
mov ax, word [esp + 4]
add eax, 0xfffffff0
sub ax, 3
jb 0x4ccc16
sub ax, 1
je 0x4ccc16
sub ax, 0x7c
je 0x4ccc16
mov cl, 1
mov dx, word [esp + 4]
mov eax, esi
call fcn.004cc880
xor ecx, ecx
mov dx, word [esp + 4]
mov eax, esi
call fcn.004cc880
jmp 0x4ccc16
test bh, 1
setne byte [esp + 8]
test bh, 2
setne byte [esp + 7]
test bh, 4
setne byte [esp + 6]
and bx, 0xf8ff
push 0x14
call sub.user32.dll_GetKeyState
test ax, ax
setg byte [esp + 9]
mov al, byte [esp + 7]
push eax
mov al, byte [esp + 0xa]
push eax
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x11]
mov eax, esi
call fcn.004cc938
mov cl, 1
mov edx, ebx
mov eax, esi
call fcn.004cc880
xor ecx, ecx
mov edx, ebx
mov eax, esi
call fcn.004cc880
mov al, byte [esp + 7]
push eax
mov al, byte [esp + 0xa]
push eax
mov cl, byte [esp + 0x10]
mov dl, byte [esp + 0x11]
mov eax, esi
call fcn.004cc9a4
inc ebp
dec edi
jne 0x4ccb48
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cd504
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404bc0
xor eax, eax
push ebp
push 0x4cd5c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cd5a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00403284
lea eax, [ebp - 0x122]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403284
lea eax, [ebp - 0x122]
mov edx, dword [ebp - 4]
call fcn.0040a434
xor eax, eax
mov dword [ebp - 0x22], eax
lea eax, [ebp - 0x122]
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x1e], 3
mov word [ebp - 0x12], 0x40
or word [ebp - 0x12], 0x10
or word [ebp - 0x12], 4
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd5af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd5cc
lea eax, [ebp - 4]
call fcn.00404700
ret
Function at 0x4ce29c
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe48
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1a0]
mov edx, dword [0x4cd398]
call fcn.00405250
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x4ce486
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
xor ebx, ebx
mov eax, ebx
cmp eax, 0x1f
ja 0x4ce2fd
bt esi, eax
jae 0x4ce429
lea eax, [ebp - 0x1a4]
mov edx, ebx
add dl, 0x41
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x1a4]
lea eax, [ebp - 0x1a8]
call fcn.00403168
mov edx, 0x4ce494
lea eax, [ebp - 0x1a8]
mov cl, 2
call fcn.00403138
lea edx, [ebp - 0x1a8]
lea eax, [ebp - 4]
call fcn.00404974
lea edx, [ebp - 0x1a0]
mov eax, dword [ebp - 4]
call fcn.004cded0
mov eax, dword [edi]
call fcn.004abb68
lea eax, [ebp - 0x1ac]
mov edx, dword [ebp - 4]
call fcn.00404f8c
mov ecx, dword [ebp - 0x1ac]
mov eax, dword [edi]
mov edx, 0x4ce49c
call fcn.004a3f24
push dword [ebp - 0x184]
push dword [ebp - 0x188]
mov eax, dword [edi]
mov edx, 0x4ce4ac
call fcn.004a3c64
push dword [ebp - 0x17c]
push dword [ebp - 0x180]
mov eax, dword [edi]
mov edx, 0x4ce4bc
call fcn.004a3c64
xor ecx, ecx
mov cl, byte [ebp - 0x1a0]
mov eax, dword [edi]
mov edx, 0x4ce4cc
call fcn.004a3b08
push 0x4600
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
lea eax, [ebp - 0x1b0]
mov ecx, 0x4ce4e0
mov edx, dword [ebp - 4]
call fcn.00404a1c
mov eax, dword [ebp - 0x1b0]
call fcn.00404bd0
push eax
call sub.shell32.dll_SHGetFileInfoA
lea edx, [ebp - 0x1b8]
lea eax, [ebp - 0x158]
call fcn.0040a5a4
mov edx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x1b4]
call fcn.00404f8c
mov ecx, dword [ebp - 0x1b4]
mov eax, dword [edi]
mov edx, 0x4ce4e8
call fcn.004a3f24
inc ebx
cmp ebx, 0x1a
jne 0x4ce2f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce48d
lea eax, [ebp - 0x1b8]
call fcn.00404700
lea eax, [ebp - 0x1b4]
call fcn.00404e1c
lea eax, [ebp - 0x1b0]
call fcn.00404700
lea eax, [ebp - 0x1ac]
call fcn.00404e1c
lea eax, [ebp - 0x1a0]
mov edx, dword [0x4cd398]
call fcn.00405320
lea eax, [ebp - 4]
call fcn.00404700
ret

Function at 0x4dcd18
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov esi, eax
lea eax, [esp + 0xa]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00403284
lea eax, [esp + 0xa]
push eax
call sub.user32.dll_GetKeyboardState
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x12]
push eax
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push esi
call sub.user32.dll_ToAscii
dec eax
jne 0x4dcd78
mov bl, byte [esp]
push ebx
call sub.user32.dll_VkKeyScanA
and ax, 0xff
movsx eax, ax
and esi, 0xff
cmp eax, esi
je 0x4dcd7a
xor ebx, ebx
jmp 0x4dcd7a
xor ebx, ebx
mov eax, ebx
add esp, 0x10c
pop esi
pop ebx
ret