joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000171e
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp]
mov dword [0x1001230e], 0xffbbf938
push ebx
pop dword [0x10012337]
shr eax, 0x10
push eax
pop dword [0x10012676]
shl eax, 0x10
push 0x58309d49
pop dword [0x10012039]
sbb dword [0x10012467], 0x189f87c
mov ecx, dword [eax]
or dword [0x1001264e], 0x6497e78b
mov byte [0x10012295], 0x26
jmp 0x1000179f
sub eax, 0x1000
mov dword [0x100120cb], 0xd55e6ab9
push eax
pop dword [0x100125a8]
mov ecx, dword [eax]
sub byte [0x100122a7], 0x98
push 0xe1813144
pop dword [0x100121ca]
cmp cx, 0x5a4d
jne 0x10001775
or dword [0x10012311], 0x5bdecf3
mov ecx, eax
sbb byte [0x100121dd], 0xae
and word [0x100123f5], 0x29e5
add ecx, dword [eax + 0x3c]
mov dword [0x100124d7], 0xbd2ff2c8
sub dword [0x10012644], 0x2bddaf47
cmp word [ecx], 0x4550
jne 0x10001754
push eax
pop dword [0x10012535]
ret

Function at 0x100017fb
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push 0x5f09d86a
pop dword [0x10012157]
xor eax, eax
push esi
pop dword [0x10012654]
and word [0x10012510], 0xfb0d
push dword fs:[eax + 0x30]
push edx
pop dword [0x10012154]
pop eax
and dword [0x10012445], 0xd9aa813c
or dword [0x1001226c], 0xddc5974b
lea eax, [eax + 0xc]
and word [0x10012060], 0x33e6
xor word [0x1001250d], 0xc17d
or eax, eax
push 0xaa7ec140
pop dword [0x10012023]
mov eax, dword [eax]
sub dword [0x100120d3], 0xa4cdca1f
mov esi, dword [eax + 0x1c]
xor word [0x1001249a], 0xd3ca
lodsd eax, dword [esi]
sbb byte [0x10012320], 0xb1
xor dword [0x10012347], 0xef9703ed
mov eax, dword [eax + 8]
add word [0x10012553], 0xfa70
mov dword [0x10012625], 0xd503790f
pop esi
sbb word [0x10012570], 0xc37a
ret
Function at 0x427790
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x4278b5
cmp byte [eax], 0
je 0x4278b5
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
lea ecx, [ebp - 0x108]
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4277d1
sub ecx, edx
push ebx
lea ebx, [ecx + 1]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x24c], ebx
dec ecx
jmp 0x4277f0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4277f0
mov eax, dword [str..]
mov dword [ecx], eax
mov al, byte [0x4d7bbc]
mov byte [ecx + 4], al
lea eax, [ebp - 0x248]
push edi
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x42788e
mov ecx, ebx
lea eax, [ebp - 0x21c]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub ecx, eax
push esi
lea esi, [ebp - 0x108]
add esi, ecx
mov edi, edi
lea eax, [ebp - 0x21c]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x427846
push 0x80
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x248]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x427840
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0x24c]
pop esi
cmp byte [ebp + 0xc], 0
pop edi
je 0x4278b4
lea eax, [ebx - 1]
cmp eax, 0x104
jae 0x4278c5
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
call fcn.004beea8
int3
Function at 0x433720
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
push edi
mov edi, dword [ebp + 0xc]
sub eax, 0x5c9
je 0x433983
sub eax, 0xc8
je 0x4338f2
sub eax, 3
je 0x433778
push dword [ebp + 0x10]
push edi
push ecx
mov ecx, esi
call fcn.0040c1f0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 0xc
push 0xff
lea eax, [ebp - 0x123]
mov byte [ebp - 0x124], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
push dword [ebp + 0x10]
push edi
call fcn.0042f6e0
test eax, eax
jle 0x43398a
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x24]
push 0x1f
push eax
call fcn.00432310
lea eax, [ebp - 0x24]
push eax
call fcn.0042f2f0
add esp, 0x10
test eax, eax
jns 0x43398a
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov edi, 0x8000
test di, ax
je 0x4338a4
mov ecx, dword [0x504d88]
mov dword [ebp - 0x170], 0xffffffff
test ecx, ecx
je 0x433825
mov eax, dword [ecx]
lea edx, [ebp - 0x170]
push edx
lea edx, [ebp - 0x164]
push edx
lea edx, [ebp - 0x24]
push edx
call dword [eax + 0x34]
test eax, eax
je 0x433825
cmp dword [ebp - 0x170], 1
je 0x433860
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.MSVCR120.dll_strncpy]
add esp, 0xc
mov byte [ebp - 0x145], 0
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x140], 0
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.004687e0
push 1
push dword [ebp - 0x16c]
lea eax, [ebp - 0x164]
push dword [ebp - 0x168]
push eax
call fcn.00499870
add esp, 0x18
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 0xc
push 0x12
call esi
test di, ax
je 0x43398a
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.004687e0
push 1
push dword [ebp - 0x168]
lea eax, [ebp - 0x24]
push dword [ebp - 0x16c]
push eax
call fcn.00499700
add esp, 0x18
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 0xc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x43398a
push 0xff
lea eax, [ebp - 0x123]
mov byte [ebp - 0x124], 0
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
push dword [ebp + 0x10]
push edi
call fcn.0042f6e0
test eax, eax
jle 0x43398a
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x24]
push 0x1f
push eax
call fcn.00432310
add esp, 0xc
lea eax, [ebp - 0x24]
push 1
push eax
push eax
call fcn.0042f2f0
xor ecx, ecx
add esp, 4
test eax, eax
setns cl
push ecx
call fcn.0042fa80
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.00431240
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004becb4
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44c3d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push str.guildtemp.dat
mov ecx, 0x4fa160
call fcn.004287c0
push eax
lea eax, [ebp - 0x84]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.MSVCR120.dll_remove]
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret

Function at 0x44c7b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x4fa2d0]
test ecx, ecx
je 0x44c807
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40]
dec eax
cmp eax, 4
ja case.default.0x44c7c9
jmp dword [eax*4 + 0x44c810]
push dword [ebp + 0xc]
push edx
call fcn.0044c700
pop ebp
ret
push dword [ebp + 0xc]
push edx
call fcn.0044c6e0
pop ebp
ret
push dword [ebp + 0xc]
push edx
call fcn.0044c790
pop ebp
ret
push dword [ebp + 0xc]
push edx
call fcn.0044c5a0
pop ebp
ret
push dword [ebp + 0xc]
push edx
call fcn.0044c4b0
pop ebp
ret
pop ebp
jmp fcn.0044c3d0

Function at 0x457500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x4a
jne 0x457532
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x457530
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x457530
mov eax, dword [eax + 8]
test eax, eax
je 0x457530
cmp byte [eax + ecx - 1], 0
jne 0x457530
push eax
call fcn.00422c80
add esp, 4
pop ebp
ret
cmp eax, 0x1c
je 0x457540
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004689d0
cmp dword [ebp + 0xc], 0
je 0x457530
pop ebp
jmp fcn.00469100

Function at 0x459db0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x459e1e
cmp byte [edi], 0
je 0x459e1e
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x459dc6
sub ecx, edx
cmp ecx, 0x104
jae 0x459e1e
mov esi, edi
lea ecx, [esi + 1]
lea esp, [esp]
mov al, byte [esi]
inc esi
test al, al
jne 0x459de0
sub esi, ecx
push esi
push edi
push 0x4fe848
call sub.MSVCR120.dll_memcpy
add esp, 0xc
cmp byte [esi + edi - 1], 0x5c
jne 0x459e14
cmp esi, 0x104
jae 0x459e6f
pop edi
mov byte [esi + 0x4fe848], 0
mov al, 1
pop esi
pop ebp
ret
mov byte [esi + 0x4fe848], 0x5c
inc esi
jmp 0x459dff
push 0
push 0x10
push 0x4fe848
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x459e39
pop edi
xor al, al
pop esi
pop ebp
ret
mov ecx, 0x4fe848
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x459e40
mov eax, dword [str.ScreenShot_]
mov dword [ecx], eax
mov eax, dword [0x4db08c]
mov dword [ecx + 4], eax
mov eax, dword [0x4db090]
mov dword [ecx + 8], eax
mov al, byte [0x4db094]
pop edi
mov byte [ecx + 0xc], al
mov al, 1
pop esi
pop ebp
ret
call fcn.004beea8
int3
Function at 0x45e610
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x45e64b
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x45e639
push 0xffffffffffffffff
push eax
mov ecx, edi
call fcn.0045dd30
mov esi, eax
test byte [edi + 0x78], 0x10
je 0x45e645
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
ret
Function at 0x476d40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cb258
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4f8194]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00465a30
lea ecx, [esi + 0x15c]
mov dword [ebp - 4], 0
mov dword [esi], vtable.KUiStatusPage.0
call fcn.0045eae0
lea ecx, [esi + 0x2b4]
mov byte [ebp - 4], 1
call fcn.0045c170
lea ecx, [esi + 0x49c]
mov byte [ebp - 4], 2
call fcn.0045c170
lea ecx, [esi + 0x684]
mov byte [ebp - 4], 3
call fcn.0046a670
lea ecx, [esi + 0x740]
mov byte [ebp - 4], 4
call fcn.0046a670
lea ecx, [esi + 0x7fc]
mov byte [ebp - 4], 5
call fcn.0046a670
lea ecx, [esi + 0x8b8]
mov byte [ebp - 4], 6
call fcn.0046a670
lea ecx, [esi + 0x974]
mov byte [ebp - 4], 7
call fcn.0046a670
lea ecx, [esi + 0xa30]
mov byte [ebp - 4], 8
call fcn.0046a670
lea ecx, [esi + 0xaec]
mov byte [ebp - 4], 9
call fcn.0046a670
lea ecx, [esi + 0xba8]
mov byte [ebp - 4], 0xa
call fcn.0046a670
lea ecx, [esi + 0xc64]
mov byte [ebp - 4], 0xb
call fcn.0046a670
lea ecx, [esi + 0xd20]
mov byte [ebp - 4], 0xc
call fcn.0046a670
lea ecx, [esi + 0xddc]
mov byte [ebp - 4], 0xd
call fcn.0046a670
lea ecx, [esi + 0xe98]
mov byte [ebp - 4], 0xe
call fcn.0046a670
lea ecx, [esi + 0xf54]
mov byte [ebp - 4], 0xf
call fcn.0046a670
lea ecx, [esi + 0x1010]
mov byte [ebp - 4], 0x10
call fcn.0046a670
lea ecx, [esi + 0x10cc]
mov byte [ebp - 4], 0x11
call fcn.0046a670
lea ecx, [esi + 0x1188]
mov byte [ebp - 4], 0x12
call fcn.0046a670
mov byte [ebp - 4], 0x13
lea ecx, [esi + 0x1244]
call fcn.0046a670
lea ecx, [esi + 0x1300]
mov byte [ebp - 4], 0x14
call fcn.0046a670
lea ecx, [esi + 0x13bc]
mov byte [ebp - 4], 0x15
call fcn.0046a670
lea ecx, [esi + 0x1478]
mov byte [ebp - 4], 0x16
call fcn.0046a670
lea ecx, [esi + 0x1534]
mov byte [ebp - 4], 0x17
call fcn.0046a670
lea ecx, [esi + 0x15f0]
mov byte [ebp - 4], 0x18
call fcn.0046a670
lea ecx, [esi + 0x16ac]
mov byte [ebp - 4], 0x19
call fcn.0046a670
lea ecx, [esi + 0x1768]
mov byte [ebp - 4], 0x1a
call fcn.0046a670
lea ecx, [esi + 0x1824]
mov byte [ebp - 4], 0x1b
call fcn.0046a670
lea ecx, [esi + 0x18e0]
mov byte [ebp - 4], 0x1c
call fcn.0045c170
lea ecx, [esi + 0x1ac8]
mov byte [ebp - 4], 0x1d
call fcn.0045c170
lea ecx, [esi + 0x1cb0]
mov byte [ebp - 4], 0x1e
call fcn.0045c170
lea ecx, [esi + 0x1e98]
mov byte [ebp - 4], 0x1f
call fcn.0045c170
lea ecx, [esi + 0x2080]
mov byte [ebp - 4], 0x20
call fcn.0045c170
lea ecx, [esi + 0x2268]
mov byte [ebp - 4], 0x21
call fcn.0045c170
lea ecx, [esi + 0x2450]
mov byte [ebp - 4], 0x22
call fcn.0045c170
lea ecx, [esi + 0x2638]
mov byte [ebp - 4], 0x23
call fcn.0045c170
lea ecx, [esi + 0x2820]
mov byte [ebp - 4], 0x24
call fcn.0045c170
lea ecx, [esi + 0x2a08]
mov byte [ebp - 4], 0x25
call fcn.0045c170
lea ecx, [esi + 0x2bf0]
mov byte [ebp - 4], 0x26
call fcn.0045c170
lea ecx, [esi + 0x2dd8]
mov byte [ebp - 4], 0x27
call fcn.0045c170
lea ecx, [esi + 0x2fc0]
mov byte [ebp - 4], 0x28
call fcn.0045c170
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47e960
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, 0x4fa160
push 1
call fcn.00428950
test eax, eax
jne 0x47ea31
call fcn.004830e0
test eax, eax
jne 0x47ea31
mov ecx, edi
call fcn.0047d650
test eax, eax
jne 0x47ea10
test esi, esi
je 0x47ea31
mov ecx, dword [esi]
lea eax, [ebp - 0x20]
push eax
call fcn.00463eb0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x47e9f2
cmp dword [ebp - 0x1c], 0
jbe 0x47e9f2
cmp dword [ebp - 0x20], 5
jne 0x47e9f2
lea eax, [ebp - 0x20]
push eax
call fcn.00432a70
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push esi
mov ecx, edi
call fcn.0047f830
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0047d810
test eax, eax
je 0x47ea31
push 0
push 0
push esi
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0047f980
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8

Function at 0x47eaf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, 0x4fa160
push 0
call fcn.00428950
test eax, eax
jne 0x47eb2f
push 1
mov ecx, 0x4fa160
call fcn.00428950
test eax, eax
je 0x47ec19
mov ecx, dword [0x504d88]
push 0
push 0
push 0x51
mov eax, dword [ecx]
call dword [eax + 0x8c]
test eax, eax
jne 0x47ec19
mov ecx, edi
call fcn.0047d6a0
test eax, eax
jne 0x47ebee
test esi, esi
je 0x47ec19
push dword [esi + 8]
mov ecx, dword [esi]
lea eax, [ebp - 0x20]
push dword [esi + 4]
push eax
call fcn.00463ef0
cmp dword [ebp - 0x1c], 0
jbe 0x47ebcf
cmp dword [ebp - 0x20], 5
jne 0x47ebcf
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
mov ecx, 0x8000
test cx, ax
je 0x47ebb2
lea eax, [ebp - 0x20]
push eax
call fcn.00432a70
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
push 0x10
call ebx
mov ecx, 0x8000
test cx, ax
je 0x47ebcf
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.0047f370
test eax, eax
jne 0x47ec19
push 0
push 0
push esi
mov ecx, edi
call fcn.0047f8e0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
push 0
push 0
push ebx
mov ecx, edi
call fcn.0047d8d0
test eax, eax
je 0x47ec19
push 1
mov ecx, 0x4fa160
call fcn.00428950
test eax, eax
jne 0x47ec19
push eax
push eax
push esi
push ebx
mov ecx, edi
call fcn.0047fa50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004becb4
mov esp, ebp
pop ebp
ret 8
Function at 0x480c70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0x100
je 0x480ce7
lea eax, [ecx - 0x201]
cmp eax, 1
ja 0x480cd4
push edi
mov edi, dword [ebp + 0x10]
mov eax, edi
shr eax, 0x10
cwde
sub eax, dword [esi + 0x1c]
movsx edx, di
dec eax
sub edx, dword [esi + 0x18]
cmp eax, 8
ja 0x480cc5
test edx, edx
jle 0x480cc5
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0x18]
cmp edx, eax
jge 0x480cc5
push edi
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.0046d5f0
pop edi
pop esi
pop ebp
ret 0xc
mov ecx, esi
call fcn.00480860
pop edi
xor eax, eax
pop esi
pop ebp
ret 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
mov ecx, esi
call fcn.0046d5f0
pop esi
pop ebp
ret 0xc
cmp dword [ebp + 0xc], 0x44
jne 0x480d1a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x480d1a
cmp dword [esi + 0x15f0], 0
jle 0x480d1a
lea ecx, [esi + 0x19c]
call fcn.00467c60
mov ecx, esi
call fcn.00480c20
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x494280
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [0x4ded80]
movq xmm0, qword [str.chrome.exe]
mov word [ebp - 0x14], ax
movzx eax, byte [0x4ded82]
mov byte [ebp - 0x12], al
mov eax, dword [0x4ded94]
mov dword [ebp - 0x24], eax
movzx eax, word [0x4ded98]
mov word [ebp - 0x20], ax
mov eax, dword [str.open]
push esi
mov esi, dword [sym.imp.MSVCR120.dll_sprintf]
mov dword [ebp - 0xc], eax
movzx eax, byte [0x4deda0]
push edi
movq qword [ebp - 0x1c], xmm0
movdqu xmm0, xmmword [str.https:__fsthoidai.com]
mov byte [ebp - 8], al
lea eax, [ebp - 0x74]
push str.C:Program_Files__x86_GoogleChromeApplication_
push eax
mov dword [ebp - 0x11], 0
mov byte [ebp - 0xd], 0
movdqu xmmword [ebp - 0x34], xmm0
call esi
mov edi, dword [sym.imp.MSVCR120.dll__access]
lea eax, [ebp - 0x74]
push 0
push eax
call edi
add esp, 0x10
cmp al, 0xff
jne 0x4943c1
lea eax, [ebp - 0x74]
push str.C:Program_FilesGoogleChromeApplication_
push eax
call esi
lea eax, [ebp - 0x74]
push 0
push eax
call edi
add esp, 0x10
cmp al, 0xff
jne 0x4943c1
lea eax, [ebp - 0x74]
push str.C:Program_Files__x86_Mozilla_Firefox
push eax
call esi
lea eax, [ebp - 0x1c]
push str.firefox.exe
push eax
call esi
lea eax, [ebp - 0x74]
push 0
push eax
call edi
add esp, 0x18
cmp al, 0xff
jne 0x4943c1
lea eax, [ebp - 0x74]
push str.C:Program_FilesMozilla_Firefox
push eax
call esi
lea eax, [ebp - 0x74]
push 0
push eax
call edi
add esp, 0x10
cmp al, 0xff
jne 0x4943c1
lea eax, [ebp - 0x74]
push str.C:Program_FilesInternet_Explorer
push eax
call esi
lea eax, [ebp - 0x1c]
push str.iexplore.exe
push eax
call esi
lea eax, [ebp - 0x74]
push 0
push eax
call edi
add esp, 0x18
cmp al, 0xff
jne 0x4943c1
push 0x10
push str.Fengshen
push str.Khong_tim_thay_trinh_duyet_web
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret
push 0xa
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004becb4
mov esp, ebp
pop ebp
ret
Function at 0x4a4650
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push str.ranktempdata.ini
mov ecx, 0x4fa160
call fcn.004287c0
push eax
lea eax, [ebp - 0x84]
push str._s_s
push eax
call dword [sym.imp.MSVCR120.dll_sprintf]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.Engine.dll_void___cdecl_g_GetFullPath_char___char__]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.MSVCR120.dll_remove]
mov ecx, dword [ebp - 4]
add esp, 0x1c
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret
Function at 0x4bb070
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
cmp dword [ebx + 0x424], 0
je 0x4bb0e2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x424]
cmp eax, dword [ebx + 0x428]
jb 0x4bb0e2
mov dword [0x4fa4b8], 1
mov dword [ebx + 0x420], 1
cmp dword [0x504d6c], 3
jne 0x4bb0bc
push 1
call fcn.004723e0
jmp 0x4bb0d1
cmp dword [0x504d6c], 4
jne 0x4bb0e2
call fcn.00489370
push 1
call fcn.00487770
push 0
push 0x3e9
push 5
call fcn.0046e330
add esp, 0x10
cmp dword [ebx + 0x420], 0
je 0x4bb155
cmp dword [0x504d6c], 5
jne 0x4bb132
call fcn.0046eef0
test al, al
jne 0x4bb128
mov ecx, 0x4fa160
call fcn.004294e0
mov ecx, dword [0x504d88]
push 0
push 0
push 0x34
mov eax, dword [ecx]
call dword [eax + 0x18]
push dword [ebx + 0x430]
call fcn.0046ef00
add esp, 4
jmp 0x4bb132
mov ecx, 0x505548
call fcn.004bcd10
mov ecx, 0x505548
mov dword [ebx + 0x420], 0
mov dword [ebx + 0x430], 0
call fcn.004bd760
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0x418], 0
je 0x4bb19d
cmp dword [ebx + 0x10], 0
je 0x4bb19d
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
mov edx, eax
test edx, edx
je 0x4bb19d
cmp dword [ebp - 4], 0
je 0x4bb19d
mov al, byte [edx]
lea ecx, [eax - 0x31]
cmp cl, 0xcc
ja 0x4bb197
movzx eax, al
mov ecx, dword [ebx + eax*4 + 0x18]
test ecx, ecx
je 0x4bb197
mov eax, dword [ecx]
push edx
call dword [eax]
cmp dword [ebx + 0x10], 0
jne 0x4bb164
cmp dword [ebx + 0x41c], 0
je 0x4bb258
cmp dword [ebx + 0x14], 0
je 0x4bb258
cmp dword [ebx + 0x42c], 0
je 0x4bb258
push esi
push edi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x4bb256
mov eax, dword [ecx]
lea edx, [ebp - 4]
push edx
push ecx
call dword [eax + 0x20]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4bb256
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x4bb256
add ecx, eax
mov esi, eax
cmp eax, ecx
jae 0x4bb249
mov edi, edi
mov al, byte [esi]
mov byte [ebp - 8], al
cmp al, 0x35
je 0x4bb241
mov ecx, dword [0x504d88]
test ecx, ecx
je 0x4bb235
sub al, 0x41
cmp al, 0xbc
ja 0x4bb235
mov eax, dword [ecx]
push dword [ebp - 8]
call dword [eax + 0x10]
mov edi, eax
test edi, edi
je 0x4bb235
mov ecx, dword [0x504d88]
push esi
mov edx, dword [ecx]
call dword [edx + 0xa8]
test edi, edi
jle 0x4bb22e
add esi, edi
jmp 0x4bb235
movzx eax, word [esi + 1]
inc esi
add esi, eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
cmp esi, eax
jb 0x4bb1f0
jmp 0x4bb249
push esi
mov ecx, ebx
call fcn.004bb6c0
cmp dword [ebx + 0x42c], 0
jne 0x4bb1c3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc270
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4f8194]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x4bc2b2
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004becb4
mov esp, ebp
pop ebp
ret
push esi
call sub.WS2_32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.WS2_32.dll_inet_ntoa
push eax
push 0x4d6824
push edi
call dword [sym.imp.MSVCR120.dll_sprintf]
add esp, 0xc
call sub.WS2_32.dll_WSACleanup
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004becb4
mov esp, ebp
pop ebp
ret

Function at 0x4be910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004be920