joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad7bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r13, rcx
mov r12d, edx
lea rcx, [0x00861bd0]
xor edx, edx
xor ebx, ebx
call fcn.006a45f4
lea r14d, [rbx + 1]
mov ebp, r14d
jmp 0x4ad8a2
test rbx, rbx
jne 0x4ad8ae
mov eax, r12d
lea edx, [rbx + 6]
xor r9d, r9d
shr eax, 4
mov rcx, rsi
add ax, r14w
movzx r8d, ax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
mov rbx, rax
test rax, rax
je 0x4ad891
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x4ad83e
xor ebx, ebx
jmp 0x4ad88c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x4ad83a
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, r12d
mov r11d, eax
add r11, rdi
and ecx, 0xf
jbe 0x4ad87b
cmp rdi, r11
jae 0x4ad83a
add ecx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x4ad869
cmp rdi, r11
jae 0x4ad83a
movzx eax, word [rdi]
neg ax
sbb rbx, rbx
and rbx, rdi
test rbx, rbx
jne 0x4ad8b0
lea rcx, [0x00861bd0]
mov edx, ebp
call fcn.006a45f4
add ebp, r14d
mov rsi, rax
test rax, rax
jne 0x4ad7fb
xor esi, esi
test rsi, rsi
jne 0x4ad8b9
xor eax, eax
jmp 0x4ad8c7
mov r8d, r12d
mov rdx, rsi
mov rcx, r13
call fcn.004ad624
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x4af4f0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x250
mov edi, dword [rcx + 8]
xor eax, eax
mov rsi, rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [r11 + 0x18], rax
lea rax, [r11 + 0x18]
or edi, 0x2001f
xor r8d, r8d
mov r9d, edi
mov rbp, rdx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x4af657
test rcx, rcx
je 0x4af553
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rcx, qword [rsp + 0x280]
and edi, 0x300
mov dword [rsp + 0x48], edi
xor edi, edi
mov qword [rsp + 0x40], rcx
cmp ebx, edi
jmp 0x4af588
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.004af4f0
mov rcx, qword [rsp + 0x40]
mov ebx, eax
cmp eax, edi
jne 0x4af659
lea rax, [rsp + 0x288]
lea r9, [rsp + 0x270]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x270], 0x100
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x4af570
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x4af5e3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], edi
cmp byte [0x008bb5a8], dil
jne 0x4af62b
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rdi
je 0x4af61b
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x008bb5b0], rax
jmp 0x4af622
mov rax, qword [0x008bb5b0]
mov byte [0x008bb5a8], 1
jmp 0x4af632
mov rax, qword [0x008bb5b0]
mov rcx, qword [rsi]
mov rdx, rbp
cmp rax, rdi
je 0x4af648
mov r8d, dword [rsi + 8]
xor r9d, r9d
call rax
jmp 0x4af64e
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
jmp 0x4af659
xor edi, edi
cmp rcx, rdi
je 0x4af664
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
pop rsi
pop rbp
ret
Function at 0x4b03e4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x470
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rdi, r9
mov r12, r8
mov rax, rdx
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x60], rbx
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x498], rax
cmp rax, rbx
jne 0x4b0449
call fcn.004ae8a8
mov ebx, eax
jmp 0x4b0593
mov r8, rdi
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
jne 0x4b046c
call fcn.004ae8a8
mov ebx, eax
jmp 0x4b0589
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x30], rax
cmp rax, rbx
jne 0x4b0491
call fcn.004ae8a8
mov ebx, eax
jmp 0x4b0589
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [rsp + 0x490], eax
inc eax
cmp eax, edi
jae 0x4b04cd
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x4b04c3
lea rcx, [rsp + 0x60]
call fcn.004aefcc
nop
mov eax, 0x8007000e
jmp 0x4b05ac
mov ecx, eax
cmp rcx, rbx
je 0x4b050b
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x4b0501
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x4b050b
lea rcx, [rsp + 0x60]
call fcn.00444f84
mov rax, qword [rsp + 0x60]
jmp 0x4b0515
mov ecx, 0x80070057
call fcn.00401c88
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x4b0532
cmp rax, rbx
jne 0x4b053e
mov ebx, 0x8007000e
jmp 0x4b0589
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jne 0x4b0565
call fcn.004ae8a8
mov ebx, eax
jmp 0x4b0589
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], bx
mov r8d, dword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.004b0234
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x4b05aa
lea rcx, [rsp + 0x60]
call fcn.004aefcc
nop
mov eax, ebx
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x470
pop r12
pop rdi
pop rsi
ret
Function at 0x4b4d3c
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xf8
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x2e92], 0
jne 0x4b4d74
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x4b4d74
mov edx, reloc.WS2_32.dll_select
call fcn.004083bc
jmp 0x4b4d7a
add rax, 0x420
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.004029b4
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0058904c
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.00401f00
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r11, [rsp + 0x68]
mov rcx, qword [rsp + 0xb0]
cmp rcx, r11
je 0x4b4e00
test rcx, rcx
je 0x4b4e00
mov rax, qword [rsp + 0x68]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x4b4dfa
call fcn.006a4944
jmp 0x4b4e00
call fcn.006a3610
nop
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x4b4e31
test rcx, rcx
je 0x4b4e31
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, 0x100
jbe 0x4b4e2c
call fcn.006a4944
jmp 0x4b4e31
call fcn.006a3610
xor eax, eax
add rsp, 0xf8
ret
Function at 0x4ba394
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov ebx, edx
mov rdi, rcx
xor esi, esi
cmp edx, 0x102
jne 0x4ba3d3
cmp r8, 8
jne 0x4ba3cc
mov byte [rcx + 0x9d0], 1
jmp 0x4ba3df
mov byte [rcx + 0x9d0], sil
cmp r8, 0xd
je 0x4ba40c
cmp r8, 0x2e
je 0x4ba3ee
mov rax, qword [rsp + 0xd0]
mov dword [rax], esi
jmp 0x4ba596
cmp edx, 0x100
jne 0x4ba3fd
mov byte [rcx + 0x9d0], 1
mov rax, qword [rsp + 0xd0]
mov dword [rax], esi
jmp 0x4ba596
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x8000
test bp, ax
ja 0x4ba58c
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
ja 0x4ba58c
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
ja 0x4ba58c
cmp ebx, 0x100
jne 0x4ba596
mov rcx, qword [rdi + 0x928]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov word [rsp + 0xc0], si
inc eax
movsxd rbx, eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.0040234c
nop
mov rcx, qword [rsp + 0x88]
lea rbx, [rcx + rbx*2]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0xc0]
mov rdx, rbx
call fcn.00477098
mov qword [rsp + 0x80], rbx
mov word [rbx], si
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
sub r8, rdx
sar r8, 1
mov rcx, qword [rdi + 0x928]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, qword [rsp + 0x80]
sub rdx, qword [rsp + 0x88]
sar rdx, 1
dec rdx
lea rcx, [rsp + 0x40]
call fcn.004c5348
mov rcx, qword [rsp + 0x88]
call fcn.0058e09c
cmp al, sil
je 0x4ba53c
mov r9d, 8
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0050f6dc
jmp 0x4ba550
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x40]
call fcn.0050f6dc
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x4ba596
cmp rcx, rsi
je 0x4ba596
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x4ba585
call fcn.006a4944
jmp 0x4ba596
call fcn.006a3610
jmp 0x4ba596
mov rax, qword [rsp + 0xd0]
mov dword [rax], esi
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x4ba5ac
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rax, qword [0x00862cb8]
mov rsi, rcx
cmp byte [rax + 0x31b6], 0
jne 0x4ba5ef
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x4ba5ef
mov edx, 0x336
call fcn.0041024c
jmp 0x4ba5f5
mov al, byte [rax + 0x2dd7]
test al, al
je 0x4ba757
mov rdi, qword [rsi + 0x920]
and dword [rsp + 0x20], 0
and dword [rsp + 0x24], 0
xor r9d, r9d
mov rcx, rdi
xor r8d, r8d
lea edx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, 0xffffffffffffffff
lea rbx, [rax + 1]
mov r12, rax
mov eax, 2
mul rbx
cmovo rax, r14
mov rcx, rax
call fcn.006a43c4
lea edx, [r14 + 0xe]
mov r8, rbx
mov r9, rax
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x20]
mov edx, 0x140
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rsi + 0x9d0], 0
jne 0x4ba743
mov ecx, dword [rsp + 0x20]
cmp ecx, dword [rsp + 0x24]
jne 0x4ba743
cmp rcx, r12
jne 0x4ba743
mov r9, rbp
mov r8, r14
mov edx, 0x14c
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rsi, rax
cmp rax, r14
je 0x4ba743
xor r9d, r9d
mov r8, rax
mov edx, 0x149
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r14
je 0x4ba743
lea rcx, [rax + 1]
lea eax, [r14 + 3]
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.006a43c4
mov r8, rsi
mov edx, 0x148
mov r9, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, [r12 + r12]
mov rdx, rbp
mov rcx, rbx
call fcn.006a4bf0
lea edx, [r14 + 0xd]
mov r9, rbx
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 0xffff0000
movzx r9d, r12w
xor r8d, r8d
mov edx, 0x142
mov rcx, rdi
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.006a5088
mov rcx, rbp
call fcn.006a5088
mov r11, qword [rsp + 0x70]
mov dword [r11], 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x4beac0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
cmp r8, 1
jne 0x4bec05
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffffffff
mov rcx, rax
mov r8, rdx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
mov rsi, qword [0x00862cb8]
cmp byte [rsi + 0x30ef], 0
jne 0x4beb16
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x4beb16
mov edx, 0x26f
call fcn.0041024c
jmp 0x4beb1c
mov al, byte [rsi + 0x2d10]
test al, al
je 0x4beb7f
cmp byte [rdi + 0x9d3], 0
jne 0x4beb7f
cmp byte [0x008669f3], 1
jne 0x4beb3b
mov byte [rdi + 0x9d2], 0
jmp 0x4beb7f
mov cl, 1
mov byte [rdi + 0x9d2], 1
call fcn.00589af0
mov rcx, qword [0x008668d8]
mov edx, 0x402
mov rcx, qword [rcx + 0x840]
lea r8d, [rdx + 2]
mov r9d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x00862ca0]
call fcn.00598b88
mov rsi, qword [0x00862cb8]
mov byte [rdi + 0x9d3], 1
cmp byte [rsi + 0x313c], 0
jne 0x4bebaa
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x4bebaa
mov edx, 0x2bc
call fcn.0041024c
mov sil, al
jmp 0x4bebb1
mov sil, byte [rsi + 0x2d5d]
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov rcx, rdi
seta al
cmp sil, al
je 0x4bebe4
mov dl, 1
call fcn.004be9c4
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4bebeb
xor edx, edx
call fcn.004be9c4
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
setg al
mov byte [rdi + 0x9f4], al
jmp 0x4becc2
test r8, r8
je 0x4bec14
cmp r8, 2
jne 0x4becc2
mov rsi, qword [0x00862cb8]
cmp byte [rsi + 0x30ef], 0
jne 0x4bec3c
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x4bec3c
mov edx, 0x26f
call fcn.0041024c
jmp 0x4bec42
mov al, byte [rsi + 0x2d10]
test al, al
je 0x4bec97
cmp byte [rdi + 0x9d2], 1
jne 0x4bec97
mov rcx, qword [0x008668d8]
mov byte [rdi + 0x9d2], 0
mov byte [rsi + 0x2d44], 0
mov edx, 0x402
mov byte [rsi + 0x3123], 1
mov rcx, qword [rcx + 0x840]
lea r8d, [rdx + 2]
xor r9d, r9d
mov byte [0x008669f3], 0
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x00862ca0]
call fcn.00598b88
cmp byte [rdi + 0x9d4], 0
je 0x4becbb
cmp qword [rdi + 0x360], 0
je 0x4becbb
xor edx, edx
mov rcx, rdi
call fcn.004c46a8
mov byte [rdi + 0x9d4], 0
mov byte [rdi + 0x9d3], 0
mov rax, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x30]
and dword [rax], 0
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x4c4614
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x90
mov rbx, qword [rcx + 0x58]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40c
mov rcx, rbx
mov dword [rax - 0x78], 0x70
mov dword [rax - 0x74], 1
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
cmp eax, esi
jle 0x4c4692
mov edi, eax
lea r9, [rsp + 0x20]
mov r8, rsi
mov edx, 0x41c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
xor dword [rsp + 0x28], 0x180
lea r9, [rsp + 0x20]
mov r8, rsi
mov edx, 0x40b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
inc rsi
sub rdi, 1
jne 0x4c4655
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x4c4e94
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movzx ecx, r8w
mov edi, 1
sub ecx, 0x8b6
je 0x4c4f1c
sub ecx, edi
je 0x4c4f15
sub ecx, edi
je 0x4c4f0e
sub ecx, edi
je 0x4c4f07
sub ecx, edi
je 0x4c4f00
sub ecx, edi
je 0x4c4ef9
sub ecx, edi
je 0x4c4ef5
lea ebx, [rdi + 0xa]
sub ecx, ebx
je 0x4c4eee
cmp ecx, edi
je 0x4c4f21
xor eax, eax
jmp 0x4c5068
mov ebx, 9
jmp 0x4c4f21
mov ebx, edi
jmp 0x4c4f21
mov ebx, 8
jmp 0x4c4f21
mov ebx, 7
jmp 0x4c4f21
mov ebx, 6
jmp 0x4c4f21
mov ebx, 2
jmp 0x4c4f21
mov ebx, 3
jmp 0x4c4f21
mov ebx, 4
mov r8d, ebx
lea rdx, [rsp + 0x88]
mov rcx, qword [0x00862cd0]
call fcn.004d0f18
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.00401f00
nop
lea rax, [rsp + 0x88]
mov esi, 0x100
mov rcx, qword [rsp + 0xb0]
cmp rcx, rax
je 0x4c4f81
test rcx, rcx
je 0x4c4f81
mov rdx, qword [rsp + 0x88]
sub rdx, rcx
cmp rdx, rsi
jbe 0x4c4f7c
call fcn.006a4944
jmp 0x4c4f81
call fcn.006a3610
cmp ebx, edi
jne 0x4c4fd8
lea rcx, [rsp + 0x30]
call fcn.00595310
cmp eax, edi
je 0x4c4fd8
lea rcx, [rsp + 0x30]
call fcn.00566c1c
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x4c4fd1
test rcx, rcx
je 0x4c4fd1
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rsi
jbe 0x4c4fcc
call fcn.006a4944
jmp 0x4c4fd1
call fcn.006a3610
xor eax, eax
jmp 0x4c5068
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x30b4], 0
jne 0x4c5000
mov rcx, qword [rax + 0xb8]
test rcx, rcx
je 0x4c5000
mov edx, 0x234
call fcn.0041024c
jmp 0x4c5006
mov al, byte [rax + 0x2cd5]
test al, al
jne 0x4c5028
mov dword [rsp + 0x28], edi
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x78]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4c5033
lea rcx, [rsp + 0x30]
call fcn.0052d6f8
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x78]
cmp rcx, rax
je 0x4c5066
test rcx, rcx
je 0x4c5066
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rsi
jbe 0x4c5061
call fcn.006a4944
jmp 0x4c5066
call fcn.006a3610
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x4c6fc4
Capabilities:
Check os version

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x160
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rcx
xor esi, esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov qword [rcx + 0x20], rsi
mov dword [rcx + 0x28], esi
mov dword [rcx + 0x2c], esi
mov qword [rcx + 0x30], rsi
mov dword [rcx + 0x38], 0x522
cmp byte [0x00862d11], sil
jne 0x4c70b6
mov rdi, qword [0x00862cb0]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x00862d11], sil
jne 0x4c70ab
mov dword [rsp + 0x170], 8
mov dword [rsp + 0x174], 0x404
lea rcx, [rsp + 0x170]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x34]
call fcn.006aba40
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, esi
je 0x4c7095
cmp dword [rsp + 0x34], 5
jae 0x4c7091
cmp dword [rsp + 0x34], 4
jne 0x4c7095
cmp dword [rsp + 0x38], 0x5a
jb 0x4c7095
mov eax, esi
jmp 0x4c709a
mov eax, 1
cmp al, sil
sete byte [0x00862d10]
mov byte [0x00862d11], 1
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [rbx + 0x58], rsi
mov qword [rbx + 0x60], rsi
mov dword [rbx + 0x68], esi
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rbx + 0x70], rax
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], esi
mov dword [rbx + 0x94], esi
mov dword [rbx + 0x98], reloc.WS2_32.dll_inet_addr
mov qword [rbx + 0xa0], rsi
mov qword [rbx + 0xc0], rsi
mov qword [rbx + 0xc8], rsi
mov qword [rbx + 0xd0], rax
mov qword [rbx + 0xd8], rbx
mov dword [rbx + 0xe0], 1
mov qword [rbx + 0xe8], rsi
mov byte [rbx + 0xf0], 0x84
mov byte [rbx + 0xf1], 8
and byte [rbx + 0xf2], 0xfe
or eax, 0xffffffff
mov dword [rbx + 0xf4], eax
mov dword [rbx + 0xf8], eax
mov dword [rbx + 0x10c], 0xc0c0c0
mov qword [rbx + 0x110], rsi
mov dword [rbx + 0x118], esi
mov qword [rbx + 0x120], rsi
mov dword [rbx + 0x128], esi
mov rcx, qword [rbx + 0x80]
cmp rcx, rsi
je 0x4c719a
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
cmp eax, esi
jne 0x4c71c2
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.COMCTL32.dll_ImageList_Destroy]
mov qword [rbx + 0x80], rsi
mov dword [rbx + 0xfc], reloc.WS2_32.dll_recv
mov dword [rbx + 0x100], reloc.WS2_32.dll_ntohs
mov dword [rbx + 0x104], reloc.WS2_32.dll_shutdown
mov dword [rbx + 0x108], reloc.WS2_32.dll_setsockopt
mov rax, rbx
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x4cc56c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rsp + 0x50]
mov eax, dword [rcx + 0x118]
mov rsi, r8
and dword [rdi], 0
mov rbx, rcx
cmp eax, 0x12
je 0x4cc5b3
cmp eax, 0x79
jne 0x4cc5a6
lea ecx, [rax - 0x69]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x4cc5b3
cmp dword [rbx + 0x118], 0x20
jne 0x4cc69c
cmp rsi, 0xf100
jne 0x4cc69c
mov rsi, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rsi
jne 0x4cc5f2
mov rcx, rbx
call fcn.004cf2d0
mov rcx, qword [rbx + 8]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov edx, 0x448
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4cc69c
mov eax, dword [rbx + 0x118]
cmp eax, 0x20
je 0x4cc69c
test byte [rbx + 0xf0], 0x40
jne 0x4cc691
mov al, byte [rbx + 0xf1]
test al, 2
je 0x4cc665
test al, 4
jne 0x4cc665
test al, 8
je 0x4cc665
or al, 4
mov r8d, 0x100000
mov edx, 0x446
movzx eax, al
mov rcx, rsi
mov byte [rbx + 0xf1], al
shl eax, 0x12
mov r9d, eax
not r9d
and r9, r8
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 8]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_UpdateWindow]
test byte [rbx + 0x98], 4
je 0x4cc685
cmp qword [rbx + 0x120], 0
jne 0x4cc685
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rbx + 0x120], rax
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x4cc696
cmp eax, 0x20
je 0x4cc69c
mov dword [rdi], 1
and byte [rbx + 0xf0], 0xbf
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x4dad14
Capabilities:
Extract resource via kernel32 functions
Get file size

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
xor r12d, r12d
mov qword [rsp + 0xd0], r12
cmp rdx, r12
je 0x4dae91
cmp word [rdx], r12w
je 0x4dae91
lea r8, [rax + 0x10]
lea rcx, [rax - 0x78]
call fcn.004023b4
nop
lea r13, [0x007955b8]
mov qword [rsp + 0x28], r13
lea r14, [0x007955c8]
mov qword [rsp + 0x30], r14
lea r9d, [r12 + 1]
mov r8d, 0x80000000
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.0059436c
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x4dadcd
cmp rcx, r12
je 0x4dadcd
mov rax, qword [rsp + 0x40]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x4dadc8
call fcn.006a4944
jmp 0x4dadcd
call fcn.006a3610
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
or edx, 0xffffffff
cmp eax, edx
jne 0x4dadf9
lea rcx, [rsp + 0xc8]
call fcn.00594950
mov rdi, rax
jmp 0x4dae09
mov edi, dword [rsp + 0xc8]
shl rdi, 0x20
mov eax, eax
or rdi, rax
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
mov qword [rsp + 0xd0], rax
cmp rax, r12
je 0x4dae70
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp rax, r12
je 0x4dae70
mov qword [rsp + 0xc8], rdi
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.00594a94
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov r11d, esi
cmp r11, rdi
cmovne rbx, r12
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x28]
call fcn.0059492c
nop
jmp 0x4daf24
mov edx, 0x4f5
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
cmp rax, r12
jne 0x4daebc
xor eax, eax
jmp 0x4daf27
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp eax, r12d
jne 0x4daed2
xor eax, eax
jmp 0x4daf27
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdi, rbx
mov rdx, rbx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
cmp rax, r12
jne 0x4daefb
xor eax, eax
jmp 0x4daf27
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp rax, r12
jne 0x4daf0d
xor eax, eax
jmp 0x4daf27
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.006a4bf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rax, rbx
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret