joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46eb34
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x46eca5
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46ec80
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x111], 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x105
lea eax, [ebp - 0x111]
push eax
lea eax, [ebp - 0x118]
mov edx, ebx
call fcn.0049b4ac
lea eax, [ebp - 0x118]
mov edx, 0x46ecbc
call fcn.0049b58c
mov eax, dword [ebp - 0x118]
call fcn.0049b77c
push eax
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x46ebf2
lea eax, [ebp - 0x111]
call fcn.00488a74
mov ecx, eax
lea edx, [ebp - 0x111]
mov eax, esi
call fcn.0049b3bc
jmp 0x46ebf9
mov eax, esi
call fcn.0049b2cc
cmp bl, 0x61
jae 0x46ec1a
lea edx, [ebp - 0x11c]
mov eax, dword [esi]
call fcn.0048ca40
mov edx, dword [ebp - 0x11c]
mov eax, esi
call fcn.0049b320
jmp 0x46ec34
lea edx, [ebp - 0x120]
mov eax, dword [esi]
call fcn.0048c9b4
mov edx, dword [ebp - 0x120]
mov eax, esi
call fcn.0049b320
lea eax, [ebp - 0x124]
push eax
mov eax, dword [esi]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0xb
lea edx, [ebp - 0x12c]
xor ecx, ecx
mov eax, 0x46ecc8
call fcn.004891e4
mov edx, dword [ebp - 0x124]
mov eax, esi
call fcn.0049b320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ec87
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x483a5c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x557f0c
cmp dword [edi], 0
jne 0x483ad8
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
mov eax, dword [0x557f08]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x53d640
mov ecx, 2
call fcn.00499928
mov edx, 0x483a34
lea eax, [esi + 5]
call fcn.00483a54
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00483a54
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x483aad
mov dword [0x557f08], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x485130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00484c78
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0049b77c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x48518e
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x542e0c]
mov dl, 1
mov eax, dword [0x484b04]
call fcn.0048bd50
call fcn.0049af2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x485198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0049b77c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4851f0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x542e08]
mov dl, 1
mov eax, dword [0x484b04]
call fcn.0048bd50
call fcn.0049af2c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00484ca8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x488584
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0049b77c
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x48859d
test al, 0x10
jne 0x4885a1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x48b4ac
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x48b4e5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.0049b3bc
jmp 0x48b4ee
mov eax, ebx
mov edx, esi
call fcn.0049b320
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48b4f8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x48b519
mov al, byte [esp]
jmp 0x48b51b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x48bba0
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x48ba18
mov eax, dword [0x542ffc]
cmp byte [eax], 0
je 0x48bc0d
mov eax, dword [0x543000]
call fcn.00499e80
call fcn.00499774
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00488a74
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x48bc54
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
jmp 0x48bc43
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x542eb4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x5432a4]
call fcn.0049ca44
push eax
call sub.user32.dll_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA
add esp, 0x444
ret

Function at 0x48cb6c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x48cbd0
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0049b534
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004880fc
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48cbd7
lea eax, [ebp - 0xc]
call fcn.0049b2cc
ret

Function at 0x499820
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf0
mov esi, edx
mov ebx, eax
test bl, bl
je 0x49985d
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x109]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
push esp
call sub.kernel32.dll_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryA
test bl, bl
je 0x49987d
lea eax, [esp + 0x109]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.0049b534
add esp, 0x210
pop esi
pop ebx
ret

Function at 0x499ab4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0049b2cc
test esi, esi
jne 0x499aea
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0049b3bc
jmp 0x499b08
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00499968
mov edi, eax
test esi, esi
je 0x499b08
cmp dword [ebx], 0
je 0x499b08
dec esi
jmp 0x499af1
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x49a5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x53db80]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x49a688
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49a668
xor eax, eax
push ebp
push 0x49a661
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x49a6a4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a668
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x53db80]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x53db80], ax
mov esp, ebp
pop ebp
ret

Function at 0x49b150
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x558288], 0
je 0x49b1b1
cmp word [0x55845c], 0xd7b2
jne 0x49b179
cmp dword [0x558464], 0
jbe 0x49b179
mov eax, 0x558458
call dword [fcn.00558474]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x53dbc8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x49b1d8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x53db90], 0
jne 0x49b1cd
push 0
push 0x53dbe8
push 0x53dbc8
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x49cc38
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x49ce68
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x49ccbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x49ce68
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x49ccbb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x49ce84
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x49cd44
xor eax, eax
push ebp
push 0x49cd3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.0049ca80
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x49cd22
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x49cea4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x49cd22
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49cd44
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x49ce5e
cmp byte [ebp - 0xd], 0
jne 0x49cd8b
cmp byte [ebp - 0x12], 0
je 0x49ce5e
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x49cda4
dec ebx
cmp byte [ebx], 0x2e
je 0x49cdb3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x49cda3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x49ce5e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x49cdf0
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x49ce5e
cmp byte [ebp - 0xd], 0
je 0x49ce5e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x49ce5e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d610
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x5587fc], 1
jae 0x49d696
mov byte [0x53db7c], 2
mov dword [fcn.0055824c], sub.kernel32.dll_RaiseException
mov dword [0x558250], 0x5280f0
mov byte [0x55828a], 2
mov dword [0x558238], 0x49c268
call fcn.0049a5c0
test al, al
je 0x49d653
call fcn.0049a5f0
call fcn.0049a6b4
mov word [0x558290], 0xd7b0
mov word [0x55845c], 0xd7b0
mov word [0x558628], 0xd7b0
call fcn.0049c148
call sub.kernel32.dll_GetCommandLineA
mov dword [0x55827c], eax
call fcn.00498240
mov dword [0x558278], eax
call sub.kernel32.dll_GetCurrentThreadId
mov dword [0x558270], eax
ret

Function at 0x49e0ac
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x49dff8
call sub.user32.dll_EnumWindows
ret

Function at 0x49e1d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49e24d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0049dc1c
call sub.kernel32.dll_GetTickCount
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x49e1f5
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.0049d874
cmp dword [ebp - 4], 0
je 0x49e237
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0049b77c
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e254
lea eax, [ebp - 4]
call fcn.0049b2cc
ret
Function at 0x4ae520
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea ebx, [ebp - 4]
xor eax, eax
push ebp
push 0x4ae6e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
call fcn.004e7598
mov eax, dword [ebx]
cmp byte [eax + 0x210], 0
je 0x4ae6c5
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
sub eax, dword [edx + 0x220]
cmp eax, 0x1f4
jb 0x4ae583
mov eax, dword [ebx]
add eax, 0x21c
call fcn.0049b2cc
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebx]
mov dword [edx + 0x220], eax
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 8
je 0x4ae654
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [0x542e2c]
and eax, 0xff
bt dword [edx], eax
jae 0x4ae616
push 1
push 0x102
push 0x102
mov eax, dword [ebx]
call fcn.004e8610
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4ae694
mov eax, dword [ebx]
push dword [eax + 0x21c]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.0049b4ac
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.0049b4ac
push dword [ebp - 0x2c]
mov eax, dword [ebx]
add eax, 0x21c
mov edx, 3
call fcn.0049b644
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x4ae694
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.0049b4ac
mov edx, dword [ebp - 0x30]
mov eax, dword [ebx]
add eax, 0x21c
call fcn.0049b58c
jmp 0x4ae694
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0049b584
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.0049b81c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0049b584
mov edx, eax
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0048c4fc
cmp al, 2
je 0x4ae634
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0049b584
mov edx, eax
mov eax, dword [ebx]
add eax, 0x21c
mov ecx, 1
call fcn.0049b81c
mov eax, dword [ebx]
mov eax, dword [eax + 0x21c]
call fcn.0049b584
test eax, eax
jle 0x4ae6ae
push ebp
call fcn.004ae438
pop ecx
jmp 0x4ae6c5
xor edx, edx
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebx]
mov si, 0xffeb
call fcn.0049a97c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae6e7
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.0049b2f0
ret

Function at 0x4afbd8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0049b2cc
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4afc27
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.0049b534
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5b5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b5dbc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4b5bbf
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004b5624
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0048c4fc
cmp al, 1
jne 0x4b5bbf
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004b593c
test al, al
je 0x4b5d4b
cmp dword [ebp - 8], 0
jge 0x4b5bdd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004b5624
mov eax, dword [ebp - 0x210]
call fcn.0049b584
cmp ebx, eax
jge 0x4b5c27
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004b5624
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x542e2c]
and eax, 0xff
bt dword [edx], eax
jae 0x4b5c27
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4b5c3b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004b5b38
cmp ebx, dword [ebp - 8]
je 0x4b5d3d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4b5c67
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0049a97c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53dea8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4b5d2a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0049a97c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53dea8]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.004e8610
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0049a97c
and eax, 0x7f
movzx eax, word [eax*2 + 0x53dea8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004e8610
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5d31
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4b5d9e
cmp dword [ebp - 8], 0
jge 0x4b5d56
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004b5624
mov eax, dword [ebp - 0x218]
call fcn.0049b584
cmp eax, dword [ebp - 8]
jg 0x4b5d90
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004b5624
mov eax, dword [ebp - 0x21c]
call fcn.0049b584
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004b5b38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5dc3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0049b2f0
ret
Function at 0x4c0690
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4c0696
ret

Function at 0x4c30d0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4c3121
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4c3108
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4c30f8
jmp 0x4c3121
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4c3109
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cc190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4cc1e0]
test si, 4
je 0x4cc1a4
or bl, 1
test si, 8
je 0x4cc1ae
or bl, 4
test si, 1
je 0x4cc1b8
or bl, 8
test si, 2
je 0x4cc1c2
or bl, 0x10
test si, 0x10
je 0x4cc1cc
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cc1db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4cc1e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4cc21c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cc1fd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cc20c
or bl, 4
test esi, 0x20000000
je 0x4cc217
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4d2bfc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4d2c0e
add esp, 0xfffffff0
call fcn.0049aae4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004829d8
mov eax, dword [0x54301c]
mov dword [eax + 4], ebx
mov dword [eax], 0x4d2fa0
mov eax, dword [0x543020]
mov dword [eax + 4], ebx
mov dword [eax], 0x4d2fac
mov eax, ebx
call fcn.004d2fb8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.0049a750
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.0049a750
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.0049a750
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.0049a750
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4783fc]
call fcn.0049a750
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4cf3dc
push eax
push 0
push 0
mov eax, dword [0x543210]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4bfac4]
call fcn.004c11d8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4bfac4]
call fcn.004c11d8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4bfac4]
call fcn.004c11d8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004d3420
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4d32fc
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4d32fc
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4d32fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4d2d4b
call fcn.0049ab3c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret