joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cc130
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x528
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x14b
mov esi, ecx
push 0x6d
push esi
call edi
mov eax, dword [0x5ac5d8]
test eax, eax
mov byte [esp + 0x148], 0
je 0x4cc181
lea ecx, [esp + 0x148]
push ecx
push 0x180
push 0xd
push 0x198
push eax
call edi
mov al, byte [esp + 0x148]
test al, al
jne 0x4cc1a2
xor eax, eax
jmp 0x4cc190
mov cl, byte [eax + 0x5a9e78]
mov byte [esp + eax + 0x148], cl
inc eax
test cl, cl
jne 0x4cc190
push ebp
lea edx, [esp + 0x14c]
push edx
push str._s.
push 0x5ac5e0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6d
push esi
call edi
lea eax, [esp + 0xc]
push eax
push 0x5ac5e0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4cc25b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
test byte [esp + 0x10], 0x10
je 0x4cc247
cmp byte [esp + 0x3c], 0x2e
je 0x4cc247
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [eax + 0x5ac5e0], cl
inc eax
test cl, cl
jne 0x4cc200
push 0x5ac5e0
push 0
push 0x158
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
jne 0x4cc240
push 0x5ac5e0
push 0
push 0x143
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
je 0x4cc253
cmp eax, 0xfffffffe
je 0x4cc253
lea ecx, [esp + 0x10]
push ecx
jmp 0x4cc24c
lea edx, [esp + 0x10]
push edx
push ebp
call ebx
test eax, eax
jne 0x4cc1f0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push 0
push 0
push 0x146
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
pop ebp
jne 0x4cc271
xor eax, eax
mov ecx, dword [0x5a9f80]
test ecx, ecx
jl 0x4cc27f
cmp ecx, eax
jle 0x4cc287
xor ecx, ecx
mov dword [0x5a9f80], ecx
push 0
push ecx
push 0x14e
push 0x6d
push esi
call edi
pop edi
pop esi
add esp, 0x528
ret
Function at 0x4cc5e0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x5a9f98]
push ebx
push esi
mov dword [esp + 8], edx
xor edx, edx
test eax, eax
push edi
mov esi, ecx
je 0x4cc6af
mov ecx, 0xe89
call fcn.0041d620
push eax
push 0
push 0xc
push 0x68
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x6d
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 0
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x6e
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x6f
push esi
call edi
push eax
call ebx
push 0
push 1
push esi
call edi
push eax
call ebx
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
mov ecx, 0xe88
call fcn.0041d620
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
push 0
push 0xc
push 0x68
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 5
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x6d
push esi
call edi
push eax
call ebx
push 1
push 0x65
push esi
call edi
push eax
call ebx
push 1
push 0x66
push esi
call edi
push eax
call ebx
push 1
push 0x6e
push esi
call edi
push eax
call ebx
push 1
push 0x67
push esi
call edi
push eax
call ebx
push 1
push 0x6f
push esi
call edi
push eax
call ebx
push 1
push 1
push esi
call edi
push eax
call ebx
push 0
push 0
push 0x190
push 0x67
push esi
call ebp
cmp eax, 0xffffffff
pop ebp
je 0x4cc7ec
test eax, eax
jne 0x4cc767
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
jmp 0x4cc7cc
cmp eax, 1
jne 0x4cc7b6
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 1
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4cc7ec
push 0
push 0x6a
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 1
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4cc7ec
xor ecx, ecx
call fcn.0041d520
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4cf130
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x4d6e20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [edx + 0x1f30]
push esi
call fcn.00542c90
mov esi, eax
test esi, esi
je 0x4d6ffc
push edi
mov edi, dword [esi + 0xbbc]
mov ecx, edi
call fcn.004e2760
test eax, eax
je 0x4d6ffb
cmp ebx, 0x1b58
jne 0x4d6e9d
mov eax, dword [esi + 0x874]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push eax
call ebx
cmp eax, 0xffffffff
je 0x4d6f42
mov ecx, dword [esi + 0x874]
push 0x5aaa28
push eax
push 0x189
push ecx
call ebx
mov edx, edi
mov ecx, 0x5aaa28
call fcn.004c94e0
jmp 0x4d6f3a
cmp ebx, 0x1b59
jne 0x4d6f4c
mov edx, dword [esi + 0x874]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push edx
call edi
cmp eax, 0xffffffff
je 0x4d6f42
push 0x5aa640
push eax
mov eax, dword [esi + 0x874]
push 0x189
push eax
call edi
mov al, byte [0x5aa640]
test al, al
je 0x4d6ffb
cmp al, 9
mov ecx, 0x5aa640
jne 0x4d6ef8
mov al, byte [ecx + 1]
inc ecx
cmp al, 9
je 0x4d6ef0
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4d6f00
sub eax, esi
inc eax
push eax
push ecx
push 0x5aa640
call fcn.00571040
push 0x20
push 0x5aa640
call fcn.00570260
add esp, 0x14
test eax, eax
je 0x4d6f2c
mov byte [eax], 0
push 0
mov edx, 0x5aa640
xor ecx, ecx
call fcn.0041dd00
test eax, eax
jne 0x4d6ffb
pop edi
pop esi
xor ecx, ecx
pop ebx
jmp fcn.0041d520
cmp ebx, 0x1b5a
jne 0x4d6f83
mov ecx, dword [esi + 0x874]
push 0
push 0
push 0x184
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [edi]
push edi
push 0
push 0
push 0
push 0
mov edx, str.__.links
call fcn.0043e080
pop edi
pop esi
pop ebx
ret
cmp ebx, 0x1b5b
jne 0x4d6ffb
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x5a9798
push str._slinks.ini
push 0x5b0960
call edi
add esp, 0xc
push 4
push 0
xor edx, edx
mov ecx, 0x13ef
call fcn.0041d620
mov ecx, dword [esi]
push eax
mov edx, 3
call fcn.00519df0
test eax, eax
je 0x4d6ffb
push 0x5b0ae0
push 0x5b0960
push 0x583954
push 0x5aaa28
call edi
mov ecx, dword [esi + 0x6cc]
add esp, 0x10
push 0x5aaa28
push 0
push 0x583d84
mov edx, str.links
call fcn.004b23b0
pop edi
pop esi
pop ebx
ret
Function at 0x4d7000
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x7d4
push esi
push 0
push 0x104
lea eax, [esp + 0x3f8]
push eax
mov esi, edx
push esi
push ecx
call dword [sym.imp.USER32.dll_GetMenuStringA]
test eax, eax
jg 0x4d7030
xor eax, eax
pop esi
add esp, 0x7d4
ret 4
cmp esi, 0x64
jne 0x4d7095
mov eax, dword [0x5ac5d8]
test eax, eax
jne 0x4d70ad
call fcn.00517130
mov ecx, dword [0x5b0380]
push 0
mov edx, 1
call fcn.0051f5e0
xor ecx, ecx
mov dword [0x5b0380], eax
call fcn.005172a0
push 0x5a98a0
push 0
mov edx, str.host
mov ecx, 0x5843c8
call fcn.004b1bc0
mov edx, str._recent_
mov ecx, 0x5b0200
call fcn.004b2700
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
cmp esi, 0x1b57
jne 0x4d70c3
mov ecx, dword [esp + 0x7dc]
call fcn.004e4c10
test eax, eax
jne 0x4d70b4
xor ecx, ecx
call fcn.0041d520
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
push ebx
push edi
call fcn.00517130
push 0
push 0
mov edx, str._recent_
mov ecx, 0x5b0200
call fcn.004b2440
mov edx, 0x3e7
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
xor edi, edi
mov esi, eax
call fcn.0041ef30
mov bl, 0x2e
test esi, esi
je 0x4d71a0
lea ecx, [ecx]
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4d7106
lea ecx, [esp + 0x10]
push 0x585f04
push ecx
call fcn.00570b40
add esp, 8
test eax, eax
je 0x4d7182
lea edx, [esp + 0x10]
push 0x3a
push edx
mov byte [eax], 0
call fcn.00570260
add esp, 8
test eax, eax
je 0x4d7156
lea esp, [esp]
mov byte [eax], 0x2c
lea eax, [esp + 0x10]
push 0x3a
push eax
call fcn.00570260
add esp, 8
test eax, eax
jne 0x4d7140
cmp byte [esp + 0x10], bl
lea eax, [esp + 0x10]
jne 0x4d7168
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
je 0x4d7160
cmp byte [eax], 0
je 0x4d7182
lea ecx, [esp + 0x3f8]
push ecx
push eax
call fcn.005809c6
add esp, 8
test eax, eax
je 0x4d718f
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4d7100
jmp 0x4d71a0
mov edx, dword [esi]
push edx
mov edx, 0x3e7
lea ecx, [esp + 0x14]
call fcn.0041ee40
lea ecx, [esp + 0xc]
call fcn.004c8280
test esi, esi
jne 0x4d71cf
test edi, edi
jne 0x4d71c1
mov esi, dword [0x5b0380]
mov edi, 1
jmp 0x4d70f5
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0x7d4
ret 4
mov esi, dword [esp + 0x7e4]
mov ecx, esi
call fcn.004e2760
test eax, eax
je 0x4d71fa
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x4d7212
mov ecx, esi
call fcn.004e4c10
mov esi, eax
test esi, esi
jne 0x4d7212
xor ecx, ecx
call fcn.0041d520
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.004c8280
push 0
lea edx, [esp + 0x14]
xor ecx, ecx
call fcn.004c7e10
mov edx, esi
lea ecx, [esp + 0x10]
mov dword [edi], eax
call fcn.005185b0
mov ecx, esi
mov dword [esi + 0x14], 0xc
call fcn.004560e0
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0x7d4
ret 4
Function at 0x4d74b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp ecx, 0xd
jl 0x4d76a6
cmp ecx, 0xf
jg 0x4d76a6
cmp edx, 0x1b6c
jne 0x4d74ed
mov eax, dword [0x5b4314]
push 0
push 0x9f
push 0x111
push eax
mov dword [0x5ad280], 6
call dword [sym.imp.USER32.dll_PostMessageA]
ret
cmp ecx, 0xd
jne 0x4d7540
mov eax, dword [0x5a13ac]
test eax, eax
je 0x4d76a6
cmp edx, 0x1b58
mov ecx, dword [eax]
jne 0x4d750e
jmp fcn.0041b8a0
cmp edx, 0x1b59
jne 0x4d751b
jmp fcn.0041ba30
add edx, 0xffffe4a6
call fcn.0041baf0
mov eax, dword [0x5a13ac]
mov ecx, dword [eax + 0x948]
test ecx, ecx
je 0x4d76a6
mov ecx, dword [eax]
jmp fcn.0041a710
cmp ecx, 0xe
push ebx
jne 0x4d7561
cmp edx, 0x1b58
je 0x4d755a
cmp edx, 0x1b59
jne 0x4d769d
mov ebx, 0x5b1898
jmp 0x4d759a
cmp ecx, 0xf
jne 0x4d769d
cmp edx, 0x1b58
je 0x4d7595
cmp edx, 0x1b59
je 0x4d7595
cmp edx, 0x1b62
je 0x4d758e
cmp edx, 0x1b63
jne 0x4d769d
mov ebx, 0x5b32d8
jmp 0x4d759a
mov ebx, 0x5b31c0
cmp edx, 0x1b58
je 0x4d75cb
cmp edx, 0x1b62
je 0x4d75cb
cmp edx, 0x1b59
je 0x4d75be
cmp edx, 0x1b63
jne 0x4d769d
mov ecx, ebx
mov edx, 1
pop ebx
jmp fcn.00421b10
mov cl, byte [ebx + 0x10]
test cl, cl
lea eax, [ebx + 0x10]
je 0x4d75ec
mov edx, 0x5b0960
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d75e0
jmp 0x4d7604
push 0x5a2cb8
push str._s.bmp
push 0x5b0960
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1e
push 0
xor edx, edx
mov ecx, 0x13ed
call fcn.0041d620
mov ecx, dword [ebx]
push eax
mov edx, 6
call fcn.00519df0
test eax, eax
je 0x4d76a5
xor eax, eax
jmp 0x4d7630
mov cl, byte [eax + 0x5b0960]
mov byte [eax + 0x5a2cb8], cl
inc eax
test cl, cl
jne 0x4d7630
xor eax, eax
mov cl, byte [eax + 0x5b0960]
mov byte [eax + 0x5aa640], cl
inc eax
test cl, cl
jne 0x4d7643
mov eax, 0x5b0ae0
mov edx, eax
jmp 0x4d7660
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d7660
push esi
push edi
mov edi, 0x5aa640
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d7671
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, 0x5aa640
mov ecx, ebx
call fcn.00421c10
test eax, eax
pop edi
pop esi
jne 0x4d76a5
xor ecx, ecx
pop ebx
jmp fcn.0041d520
pop ebx
ret
Function at 0x4da5d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, edx
test ebx, ebx
mov dword [esp + 4], ecx
jl 0x4da7f8
cmp ebx, 2
jg 0x4da7f8
push ebp
call fcn.004d4990
mov ebp, dword [sym.imp.USER32.dll_CreatePopupMenu]
call ebp
test eax, eax
mov dword [0x5aa0e0], eax
jne 0x4da60c
pop ebp
xor ecx, ecx
pop ebx
add esp, 4
jmp fcn.0041d520
push esi
push edi
call ebp
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
mov edi, eax
test edi, edi
je 0x4da724
xor edx, edx
mov ecx, 0x17dd
call fcn.0041d620
push eax
push 0x1b58
push 0
push edi
call esi
xor edx, edx
mov ecx, 0x17de
call fcn.0041d620
push eax
push 0x1b59
push 0
push edi
call esi
test ebx, ebx
jne 0x4da6ce
push 0x583b74
push ebx
push 0x800
push edi
call esi
xor edx, edx
mov ecx, 0x17e1
call fcn.0041d620
push eax
push 0x1b5a
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e2
call fcn.0041d620
push eax
push 0x1b5b
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e3
call fcn.0041d620
push eax
push 0x1b5c
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e4
call fcn.0041d620
push eax
push 0x1b5d
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e5
call fcn.0041d620
push eax
push 0x1b5e
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e7
call fcn.0041d620
push eax
mov eax, dword [0x5aa0e0]
push edi
push 0x10
push eax
call esi
test ebx, ebx
jne 0x4da728
mov eax, dword [0x5a13ac]
test eax, eax
push 8
je 0x4da711
mov ecx, dword [eax + 0x95c]
mov edx, dword [0x5aa0e0]
add ecx, 0x1b5a
push ecx
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4da774
mov eax, dword [0x5aa0e0]
push 0x1b5c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4da774
test ebx, ebx
je 0x4da774
cmp ebx, 1
je 0x4da774
call ebp
mov edi, eax
test edi, edi
je 0x4da774
xor edx, edx
mov ecx, 0x17dd
call fcn.0041d620
push eax
push 0x1b62
push 0
push edi
call esi
xor edx, edx
mov ecx, 0x17de
call fcn.0041d620
push eax
push 0x1b63
push 0
push edi
call esi
mov ecx, dword [0x5aa0e0]
push str.Buttons
push edi
push 0x10
push ecx
call esi
mov edx, dword [0x5aa0e0]
push 0x583b74
push 0
push 0x800
push edx
call esi
xor edx, edx
mov ecx, 0xefc
call fcn.0041d620
push eax
mov eax, dword [0x5aa0e0]
push 0x1b6c
push 0
push eax
call esi
test ebx, ebx
pop edi
pop esi
jne 0x4da7c4
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [0x5b4314]
mov edx, 0xd
call fcn.004d44d0
pop ebp
pop ebx
pop ecx
ret
cmp ebx, 1
jne 0x4da7e2
mov edx, dword [esp + 8]
mov ecx, dword [0x5b3198]
push edx
mov edx, 0xe
call fcn.004d44d0
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 8]
mov ecx, dword [0x5b1880]
push eax
mov edx, 0xf
call fcn.004d44d0
pop ebp
pop ebx
pop ecx
ret
Function at 0x4dac20
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, edx
xor edx, edx
push esi
mov dword [esp + 0x14], ecx
xor ebp, ebp
xor eax, eax
xor ecx, ecx
xor esi, esi
cmp ebx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
jl 0x4dace0
push edi
mov edi, dword [esp + 0x20]
jmp 0x4dac51
mov ebx, dword [esp + 0x10]
test edx, edx
jne 0x4dac63
cmp ebp, ebx
jge 0x4dac63
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx + ebp]
inc ebp
jmp 0x4dac73
xor bl, bl
inc ebp
test ecx, ecx
mov edx, 1
mov dword [esp + 0x14], ecx
je 0x4dac7e
movzx ebx, bl
shl esi, 8
add ecx, 8
or esi, ebx
cmp ecx, 6
jl 0x4dacaf
sub ecx, 6
mov ebx, esi
shr ebx, cl
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi], bl
inc eax
cmp eax, 0x3c
jge 0x4dacdb
cmp eax, dword [esp + 0x24]
jge 0x4dacc5
test edx, edx
jne 0x4dacad
cmp ecx, 6
jge 0x4dac83
jmp 0x4dacaf
xor ecx, ecx
cmp ebp, dword [esp + 0x10]
jle 0x4dac4d
mov ecx, dword [esp + 0x14]
cmp ecx, 2
jne 0x4daccd
mov byte [eax + edi], 0x3d
inc eax
jmp 0x4dacd2
or eax, 0xffffffff
or ebp, 0xffffffff
jmp 0x4dacdf
cmp ecx, 4
jne 0x4dacd7
mov byte [eax + edi], 0x3d
inc eax
test eax, eax
je 0x4dacdf
mov byte [eax + edi], 0
pop edi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop esi
mov dword [ecx], ebp
pop ebp
mov dword [edx], eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4db1d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
mov edi, ecx
push eax
xor ebx, ebx
push edi
mov dword [esp + 0x28], edx
mov byte [edx], bl
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x4db200
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
push ebp
push esi
call fcn.00570098
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x4db2d2
mov ecx, dword [esp + 0x20]
push ebp
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4db2c9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push str.VarFileInfoTranslation
push ebp
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4db2c9
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4db2c9
mov ecx, dword [esp + 0x10]
shr ecx, 2
xor esi, esi
test ecx, ecx
jle 0x4db2c9
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4db270
mov eax, dword [esp + 0x1c]
jmp 0x4db270
movzx edx, word [eax + esi*4 + 2]
movzx eax, word [eax + esi*4]
push edx
push eax
lea ecx, [esp + 0x30]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4db2bd
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4db2bd
cmp byte [eax], bl
je 0x4db2bd
cmp dword [esp + 0x14], ebx
jne 0x4db2df
mov edx, dword [esp + 0x10]
inc esi
shr edx, 2
cmp esi, edx
jl 0x4db267
push ebp
call fcn.005700aa
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
mov edx, dword [esp + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4db2e5
push ebp
call fcn.005700aa
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x4db450
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
mov eax, dword [0x5aa620]
test eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push edi
je 0x4db470
push 0x46
push eax
call esi
mov dword [0x5aa5f8], eax
mov eax, dword [0x5aa620]
mov ecx, dword [0x5aa5f8]
test ecx, ecx
jne 0x4db48e
mov eax, dword [0x5b4310]
push 0x46
push eax
call esi
mov dword [0x5aa5f8], eax
mov eax, dword [0x5aa620]
test eax, eax
je 0x4db49c
push 0x47
push eax
call esi
mov dword [0x5aa5fc], eax
mov eax, dword [0x5aa5fc]
test eax, eax
jne 0x4db4b5
mov ecx, dword [0x5b4310]
push 0x47
push ecx
call esi
mov dword [0x5aa5fc], eax
mov edx, dword [0x5b4314]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
mov eax, dword [0x5b4310]
push eax
push 0x4979b0
push 2
call edi
mov ecx, dword [0x5b4314]
push 0
push ecx
mov dword [0x5a8ccc], eax
call esi
mov edx, dword [0x5b4310]
push eax
push edx
push 0x498900
push 3
call edi
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.MSWHEEL_ROLLMSG
mov dword [0x5a8cd8], eax
call esi
push str.TaskbarCreated
mov dword [0x5aa634], eax
call esi
pop edi
mov dword [0x5aa638], eax
pop esi
ret
Function at 0x4dcc70
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [0x5b4314]
push esi
mov esi, dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0x64
push 0x89
push eax
call esi
mov ecx, dword [0x5b4314]
push 0
push 0x3e8
push 0x78
push ecx
call esi
call fcn.00508980
mov ecx, dword [0x5ab6c4]
call fcn.004e2760
test eax, eax
je 0x4dcd26
mov ecx, dword [0x5ab6c4]
mov dl, byte [ecx + 0x8a4]
test dl, dl
lea eax, [ecx + 0x8a4]
je 0x4dcd26
mov edx, dword [ecx + 0x908]
test edx, edx
jne 0x4dcd26
push eax
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov edx, dword [0x5ab6c4]
mov dword [edx + 0x908], eax
mov ecx, dword [0x5ab6c4]
mov eax, dword [ecx + 0x908]
cmp eax, 0xffffffff
jne 0x4dcd13
add ecx, 0x8a4
mov edx, 0x64
call fcn.0041ef30
mov eax, dword [0x5ab6c4]
mov dword [eax + 0x908], 0
jmp 0x4dcd26
push eax
call dword [sym.imp.WSOCK32.dll_htonl]
mov ecx, dword [0x5ab6c4]
mov dword [ecx + 0x908], eax
call fcn.004c79f0
call fcn.0041dc00
call fcn.004674c0
call fcn.00508030
mov edx, dword [0x5b4314]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
push 0x8047
push edx
call esi
mov eax, dword [0x5a9278]
test eax, eax
je 0x4dcd6c
mov eax, dword [0x5b4314]
push 0
push 0
push 0x8029
push eax
call esi
mov eax, dword [0x5a84b8]
test eax, eax
je 0x4dcd87
mov ecx, dword [0x5b4314]
push 0
push 0
push 0x802d
push ecx
call esi
mov eax, dword [0x5ab138]
test eax, eax
je 0x4dcda2
mov edx, dword [0x5b4314]
push 0
push 0
push 0x8033
push edx
call esi
mov al, byte [0x5a9da8]
test al, al
pop esi
jne 0x4dcdc5
mov eax, dword [0x5b4314]
push 1
push 0xc2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret
jmp fcn.004db530
Function at 0x4e12e0
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
mov dword [0x59bc14], 0xffffffff
mov dword [0x59bc10], 0xffffffff
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x59bc10], eax
je 0x4e132d
mov edx, dword [0x59bc0c]
mov ecx, eax
call fcn.00504920
test eax, eax
je 0x4e132d
mov eax, dword [0x59bc10]
push 5
push eax
call dword [sym.imp.WSOCK32.dll_listen]
test eax, eax
je 0x4e1334
xor ecx, ecx
jmp fcn.004e1260
mov ecx, dword [0x5b4314]
mov edx, dword [0x59bc10]
push 8
push 0x8034
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_WSAAsyncSelect]
ret
Function at 0x4e2c60
Capabilities:
Get graphical window text

Disassembly:
mov edx, dword [0x5ab6c4]
mov eax, edx
test eax, eax
push edi
mov edi, ecx
je 0x4e2cde
nop
mov ecx, edx
test ecx, ecx
je 0x4e2ca0
cmp eax, ecx
je 0x4e2c86
mov ecx, dword [ecx + 0x2424]
test ecx, ecx
jne 0x4e2c76
jmp 0x4e2ca0
mov ecx, dword [eax + 0x41c]
test ecx, ecx
je 0x4e2ca0
cmp dword [eax + 4], 0xffffffff
je 0x4e2ca0
mov ecx, dword [eax + 0x1710]
test ecx, ecx
je 0x4e2d0b
mov ecx, edx
test ecx, ecx
je 0x4e2cd4
cmp eax, ecx
je 0x4e2cb6
mov ecx, dword [ecx + 0x2424]
test ecx, ecx
jne 0x4e2ca6
jmp 0x4e2cd4
mov ecx, dword [eax + 0x420]
test ecx, ecx
jne 0x4e2d0b
mov ecx, dword [eax + 0x440]
test ecx, ecx
jne 0x4e2d0b
mov ecx, dword [eax + 0x430]
test ecx, ecx
jne 0x4e2d0b
mov eax, dword [eax + 0x2424]
test eax, eax
jne 0x4e2c70
mov eax, dword [0x5b3d24]
test eax, eax
je 0x4e2d03
mov ecx, dword [0x5b4314]
push 0x84
push ecx
mov dword [0x5b3d24], 0
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, edi
pop edi
jmp 0x538370
mov eax, dword [0x5b3d24]
test eax, eax
jne 0x4e2d03
mov eax, dword [0x5b4314]
push 0
push 0xc8
push 0x84
push eax
mov dword [0x5b3d24], 1
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, edi
pop edi
jmp 0x538370
mov eax, 1
cmp ecx, eax
jne 0x5383b0
test byte [0x5b3d20], al
jne 0x538413
mov ecx, dword [0x5b3d20]
or ecx, eax
push 0
mov dword [0x5b3d20], ecx
call fcn.00572efa
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x82
jmp 0x5383ea
mov eax, 2
cmp ecx, eax
jne 0x5383f7
test byte [0x5b3d20], al
jne 0x538413
mov ecx, dword [0x5b3d20]
or ecx, eax
push 0
mov dword [0x5b3d20], ecx
call fcn.00572efa
cdq
mov ecx, 0x96
idiv ecx
add edx, 0x12c
push edx
push 0x83
mov edx, dword [0x5b4314]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [0x5b3c10]
test eax, eax
je 0x538413
mov eax, dword [0x5b3d24]
test eax, eax
jne 0x538413
mov ecx, 5
jmp fcn.00537e30
ret