joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4690f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x577760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x240]
push edi
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x102]
push edx
mov word [ebp - 0x104], cx
call fcn.004c5420
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004692c0
xor ecx, ecx
push 0xfe
push ecx
lea edx, [ebp - 0x202]
push edx
mov word [ebp - 0x204], cx
call fcn.004c5420
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push esi
call fcn.004691d0
cmp dword [esi + 0x364], 0
mov edi, dword [0x5929d4]
je 0x469199
test edi, edi
jne 0x469180
xor eax, eax
jmp 0x469186
lea eax, [edi + 0x15c]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
add ecx, dword [esi + 0x36c]
cmp ecx, 4
jb 0x4691ab
lea edx, [ebp - 0x104]
push edx
lea ecx, [ebp - 0x204]
call fcn.00425b70
mov ecx, esi
call fcn.0047d668
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004be8b8
mov esp, ebp
pop ebp
ret

Function at 0x469db0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d6c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x577760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryW]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
push ebx
mov dword [ebp - 0x14], ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x469ea7
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004bf80b
add esp, 4
lea edx, [ebp - 0x14]
mov esi, eax
push edx
push esi
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
xor bl, bl
test bl, bl
jne 0x469e90
lea ecx, [ebp - 0x14]
push ecx
push esi
push edi
call dword [sym.imp.WININET.dll_FindNextUrlCacheEntryW]
test eax, eax
je 0x469e47
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
jmp 0x469e27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x469e56
mov bl, 1
jmp 0x469e27
push esi
call fcn.004bf0cc
mov eax, dword [ebp - 0x14]
add esp, 4
push eax
call fcn.004bf80b
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
jmp 0x469e27
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.004bf0cc
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46a3a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
add esi, 4
push edi
mov ecx, esi
call fcn.0046b1f0
mov edx, str.progtxt
mov ecx, esi
mov edi, eax
call fcn.0046ae20
mov ebx, eax
test edi, edi
je 0x46a3d2
mov eax, dword [ebp + 0xc]
push eax
mov ecx, edi
call fcn.0048125d
test ebx, ebx
je 0x46a3e3
mov edx, dword [ebx]
mov eax, dword [ebp + 0x10]
mov edx, dword [edx + 0x30]
push eax
mov ecx, ebx
call edx
cmp dword [ebp + 0xc], 0x64
jne 0x46a464
cmp dword [0x5929bc], 0
je 0x46a3fb
cmp dword [0x5929d0], 0
je 0x46a448
mov edi, dword [ebp + 8]
cmp byte [edi + 0xb78], 1
jne 0x46a438
push 0xffffffffffffffff
push str.page_ctrl
mov ecx, esi
call fcn.0046abb0
mov dword [edi + 0x360], eax
test eax, eax
je 0x46a464
mov ecx, dword [str.finish]
push 1
push ecx
mov ecx, eax
call fcn.004864ca
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov ecx, edi
call fcn.0047d668
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov edx, dword [ebp + 8]
mov dword [0x5929cc], 1
mov eax, dword [edx + 0x240]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x483469
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
lea eax, [esi + 0x168]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, esi
test eax, eax
jne 0x48348f
call fcn.00476a7e
jmp 0x4834bb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0047acc7
mov eax, dword [esi + 0x178]
xor ecx, ecx
cmp dword [eax - 8], ecx
je 0x4834bb
push 1
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebp
ret 0xc

Function at 0x486f60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x560c00
push dword [ebp + 8]
call fcn.004c04e5
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x486f7c
pop edi
pop ebp
ret
push esi
push edi
call fcn.004c86b0
push eax
call fcn.004c85ba
mov esi, eax
pop ecx
pop ecx
cmp esi, dword [ebp + 0x10]
jbe 0x486fa8
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
push edi
call fcn.004c0fc7
pop ecx
mov eax, esi
pop esi
jmp 0x486f79
push edi
push esi
push 1
push dword [ebp + 0xc]
call fcn.004c0a34
xor ecx, ecx
add esp, 0x10
cmp esi, eax
sete cl
mov esi, ecx
jmp 0x486f9c

Function at 0x48dfcf
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xd
push esi
mov esi, ecx
jne 0x48dfff
test dword [esi + 0x35c], 0x1000
jne 0x48dfff
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48dfff
and dword [esi + 0xc], 0
jmp 0x48e01a
mov eax, dword [esi + 0x36c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x60]
mov edx, dword [ecx]
push 0
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop esi
pop ebp
ret 0xc

Function at 0x48e01f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edi
sub eax, 9
mov esi, ecx
je 0x48e07e
dec eax
je 0x48e060
sub eax, 3
je 0x48e060
test dword [esi + 0x35c], 0x2000
je 0x48e099
push edi
call fcn.004c2e41
pop ecx
test eax, eax
jne 0x48e099
cmp edi, 0x2d
je 0x48e099
cmp edi, 0x2e
je 0x48e099
cmp edi, 0x2c
jne 0x48e0b4
jmp 0x48e099
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x48e099
test dword [esi + 0x35c], 0x1000
jmp 0x48e097
test byte [esi + 0x360], 0x80
jne 0x48e099
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x48e0b4
mov eax, dword [esi + 0x36c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x60]
mov edx, dword [ecx]
push 0
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x498f3a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 9
je 0x498f47
xor eax, eax
jmp 0x498f72
push dword [ecx + 4]
call fcn.0048bf36
pop ecx
test eax, eax
je 0x498f5f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
test al, 2
jne 0x498f43
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
xor eax, 0x8000
shr eax, 0xf
pop ebp
ret 4
Function at 0x499d50
Capabilities:
Log keystrokes via polling

Disassembly:
push 4
mov eax, 0x52b1e8
call fcn.004c52ce
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
push edi
call fcn.00498f3a
test eax, eax
je 0x499d8e
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
call fcn.004998e7
xor eax, eax
inc eax
jmp 0x499e91
push dword [esi + 4]
call fcn.0048bf36
mov ebx, eax
pop ecx
test ebx, ebx
je 0x499e37
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x48]
test eax, eax
je 0x499e37
cmp edi, 0x25
je 0x499dc4
cmp edi, 0x27
je 0x499dd2
cmp edi, 0x26
je 0x499dc4
cmp edi, 0x28
jne 0x499e37
cmp edi, 0x27
je 0x499dd2
cmp edi, 0x28
je 0x499dd2
push 2
jmp 0x499dd4
push 3
pop edi
mov ecx, ebx
jmp 0x499de6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov ecx, esi
test eax, eax
jne 0x499e22
push edi
call fcn.00476afc
mov esi, eax
test esi, esi
jne 0x499dd9
cmp edi, 3
setne al
mov ecx, ebx
push eax
call fcn.004764d8
mov ecx, eax
jmp 0x499e12
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x48]
mov ecx, esi
test eax, eax
jne 0x499e22
push edi
call fcn.00476afc
mov esi, eax
test esi, esi
jne 0x499e04
jmp 0x499d86
push 0
call fcn.004764d4
mov ecx, dword [ebp - 0x10]
push eax
call fcn.004991e9
jmp 0x499d86
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x12
call esi
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push 0x11
call esi
lea ecx, [ebp + 8]
shr eax, 0xf
and al, 1
movzx eax, al
push eax
push edi
call fcn.0049a6df
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 8]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.00499c6f
test al, al
je 0x499e83
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0049a72c
mov eax, esi
call fcn.004c53a6
ret 4
Function at 0x49ab3d
Capabilities:
Log keystrokes

Disassembly:
push 4
mov eax, 0x52b242
call fcn.004c52ce
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x577024]
mov dword [esi], eax
mov edx, dword [ebp + 0xc]
and dword [ebp - 4], 0
movzx eax, dx
mov dword [ebp - 0x10], 1
cmp eax, 0x24
jg 0x49abc2
je 0x49abb8
mov ecx, eax
sub ecx, 0xd
je 0x49abae
sub ecx, 0xe
je 0x49aba4
sub ecx, 6
je 0x49ab9a
dec ecx
je 0x49ab90
dec ecx
jne 0x49abeb
push 0x53b89c
jmp 0x49ad00
push str.PageDown
jmp 0x49ad00
push str.PageUp
jmp 0x49ad00
push 0x53b870
jmp 0x49ad00
push str.Enter
jmp 0x49ad00
push str.Home
jmp 0x49ad00
mov ecx, eax
sub ecx, 0x25
je 0x49acfb
dec ecx
je 0x49acf4
dec ecx
je 0x49aced
dec ecx
je 0x49ace6
sub ecx, 5
je 0x49acdf
cmp dx, 0x30
jb 0x49abf7
cmp dx, 0x39
jbe 0x49ac00
lea ecx, [edx - 0x41]
cmp cx, 0x19
ja 0x49ac18
movzx eax, dx
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 1
mov ecx, esi
call fcn.0041bdf0
jmp 0x49ad07
lea ecx, [edx - 0x60]
cmp cx, 9
ja 0x49ac2c
add eax, 0xffffffa0
push eax
push str.Num__d
jmp 0x49ac6e
cmp dx, 0x6a
jne 0x49ac3c
push str.Num_
jmp 0x49ad00
cmp dx, 0x6b
jne 0x49ac4c
push 0x53b830
jmp 0x49ad00
cmp dx, 0x6e
jne 0x49ac5c
push str.Num_Del
jmp 0x49ad00
add edx, 0xffffff90
cmp dx, 0xb
ja 0x49ac90
add eax, 0xffffff91
push eax
push 0x53b818
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.00484617
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff4
add esp, 0x10
cmp ecx, dword [0x577020]
je 0x49ad07
call fcn.00419c70
jmp 0x49ad07
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movsx ecx, al
cmp ecx, 0x3d
jg 0x49acb9
je 0x49acc8
cmp ecx, 0x27
je 0x49acc8
cmp ecx, 0x2b
jle 0x49ad07
cmp ecx, 0x2f
jle 0x49acc8
cmp ecx, 0x3b
je 0x49acc8
jmp 0x49ad07
cmp ecx, 0x5b
jl 0x49ad07
cmp ecx, 0x5d
jle 0x49acc8
cmp ecx, 0x60
jne 0x49ad07
cbw
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push 1
mov ecx, esi
call fcn.0046a870
jmp 0x49ad07
push str.Insert
jmp 0x49ad00
push str.Down
jmp 0x49ad00
push str.Right
jmp 0x49ad00
push 0x53b7e8
jmp 0x49ad00
push 0x53b7dc
mov ecx, esi
call fcn.0046c250
mov eax, esi
call fcn.004c53a6
ret 8

Function at 0x4a11f1
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x577760]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
push esi
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.004c5420
add esp, 0xc
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
test eax, eax
jne 0x4a124c
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x114
call esi
test eax, eax
je 0x4a125d
xor eax, eax
inc eax
cmp byte [ebp - 6], al
jne 0x4a125d
cmp dword [ebp - 0x11c], 6
je 0x4a125f
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004be8b8
leave
ret
Function at 0x4ab1aa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x58
mov eax, 0x52c072
call fcn.004c52ce
mov esi, ecx
push esi
lea ecx, [ebp - 0x64]
call fcn.004aa963
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x40], eax
mov eax, dword [esi]
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], edi
call dword [eax + 0x70]
cmp dword [ebp - 0x3c], ebx
jne 0x4ab372
cmp dword [ebp + 0x10], ebx
je 0x4ab206
mov eax, edi
imul eax, eax, 0xc
add eax, dword [esi + 0x248]
xor ecx, ecx
cmp dword [eax + 8], ebx
sete cl
mov dword [eax + 8], ecx
jmp 0x4ab335
cmp dword [esi + 0x240], ebx
jne 0x4ab216
cmp dword [esi + 0x23c], ebx
je 0x4ab22e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ab22e
cmp edi, 0xffffffff
je 0x4ab343
jmp 0x4ab1eb
cmp dword [esi + 0x240], ebx
jne 0x4ab242
cmp dword [esi + 0x23c], ebx
je 0x4ab2d5
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4ab2d5
cmp edi, 0xffffffff
je 0x4ab343
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x4ab269
mov dword [ebp + 8], ebx
mov eax, ebx
cmp eax, edi
jle 0x4ab272
mov dword [ebp - 0x10], eax
jmp 0x4ab279
mov dword [ebp - 0x10], edi
cmp edi, eax
jne 0x4ab27e
mov dword [ebp + 0x10], edi
jmp 0x4ab281
mov dword [ebp + 0x10], eax
mov ecx, esi
call fcn.004a9e0e
test eax, eax
jle 0x4ab343
and dword [ebp + 0xc], ebx
mov eax, dword [esi + 0x248]
add eax, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
cmp ebx, dword [ebp + 0x10]
jl 0x4ab2b2
cmp ebx, dword [ebp - 0x10]
jg 0x4ab2b2
mov dword [eax + 8], 1
jmp 0x4ab2b6
and dword [eax + 8], 0
cmp ecx, dword [eax + 8]
je 0x4ab2c3
push ebx
mov ecx, esi
call fcn.004aa18b
add dword [ebp + 0xc], 0xc
mov ecx, esi
inc ebx
call fcn.004a9e0e
cmp ebx, eax
jl 0x4ab293
jmp 0x4ab343
or dword [esi + 0x1fc], 0xffffffff
mov ecx, esi
call fcn.004a9e0e
test eax, eax
jle 0x4ab31e
and dword [ebp + 0xc], ebx
mov eax, dword [esi + 0x248]
add eax, dword [ebp + 0xc]
cmp ebx, edi
je 0x4ab30e
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4ab30e
and dword [eax + 8], 0
test ecx, ecx
je 0x4ab30e
push ebx
mov ecx, esi
call fcn.004aa18b
add dword [ebp + 0xc], 0xc
mov ecx, esi
inc ebx
call fcn.004a9e0e
cmp ebx, eax
jl 0x4ab2ea
cmp edi, 0xffffffff
je 0x4ab343
mov eax, edi
imul eax, eax, 0xc
add eax, dword [esi + 0x248]
mov dword [eax + 8], 1
push edi
mov ecx, esi
mov dword [esi + 0x1fc], edi
call fcn.004aa18b
push esi
lea ecx, [ebp - 0x38]
call fcn.004786ce
mov dword [ebp - 0x38], 0x53d94c
mov dword [ebp - 0x34], 0x53d93c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], edi
call dword [eax + 0x70]
call fcn.004c53a6
ret 0xc
Function at 0x4ad5e6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x12
mov dword [ebp - 4], ecx
call esi
movzx ebx, ax
mov edi, 0x8000
push 0x11
and ebx, edi
call esi
push 0x10
and eax, edi
mov dword [ebp - 8], eax
call esi
xor ecx, ecx
and eax, edi
pop edi
pop esi
cmp ebx, ecx
pop ebx
jne 0x4ad62b
cmp dword [ebp - 8], ecx
jne 0x4ad63c
cmp eax, ecx
jne 0x4ad650
xor eax, eax
inc eax
jmp 0x4ad68a
cmp dword [ebp - 8], ecx
jne 0x4ad65c
cmp eax, ecx
jne 0x4ad657
push 8
xor ecx, ecx
pop eax
inc ecx
jmp 0x4ad68a
cmp eax, ecx
jne 0x4ad647
push 4
pop eax
push 2
jmp 0x4ad689
cmp dword [ebp - 8], ecx
jne 0x4ad677
cmp eax, ecx
je 0x4ad682
push 2
pop eax
push 4
jmp 0x4ad689
cmp dword [ebp - 8], ecx
je 0x4ad66c
cmp eax, ecx
jne 0x4ad667
push 0x40
pop eax
push 3
jmp 0x4ad689
cmp dword [ebp - 8], ecx
jne 0x4ad682
cmp eax, ecx
je 0x4ad682
push 0x20
pop eax
push 5
jmp 0x4ad689
cmp eax, ecx
je 0x4ad682
push 0x10
pop eax
push 6
jmp 0x4ad689
mov eax, 0x80
push 7
pop ecx
mov edx, dword [ebp - 4]
mov word [edx + 0x168], cx
mov ecx, edx
test word [ecx + 0x16c], ax
je 0x4ad6ad
mov ax, word [ecx + 0x16e]
mov word [ecx + 0x168], ax
leave
ret

Function at 0x4adc50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x12
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4adc7a
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004adb35
jmp 0x4adc7e
and dword [esi + 0xc], 0
pop esi
pop ebp
ret 0xc

Function at 0x4adc83
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0x12
push esi
mov esi, ecx
je 0x4adca7
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4adca7
and dword [esi + 0xc], 0
jmp 0x4adcb7
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004adbc8
pop esi
pop ebp
ret 0xc

Function at 0x4be8b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x577760]
jne 0x4be8c2
repz ret
jmp fcn.004c924d

Function at 0x4c32f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4c331c
call fcn.004c93a8
mov dword [eax], esi
call fcn.004c9395
push 0x16
pop esi
mov dword [eax], esi
call fcn.004ca473
mov eax, esi
jmp 0x4c3371
test dword [ebp + 0xc], 0xfffffff9
jne 0x4c3302
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4c3349
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004c93bb
pop ecx
call fcn.004c9395
mov eax, dword [eax]
jmp 0x4c3371
test al, 0x10
jne 0x4c336f
test al, 1
je 0x4c336f
test byte [ebp + 0xc], 2
je 0x4c336f
call fcn.004c93a8
mov dword [eax], 5
call fcn.004c9395
mov dword [eax], 0xd
jmp 0x4c3340
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4e1ded
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x577760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004c9847
and dword [ebp - 0x14], 0
cmp dword [0x57c170], 0
mov dword [ebp - 0x18], eax
jne 0x4e1ea0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4e1f48
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x545d40
push ebx
call edi
test eax, eax
je 0x4e1f48
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x545d30
push ebx
mov dword [0x57c170], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x57c174], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x57c178], eax
call edi
push eax
call esi
mov dword [0x57c180], eax
test eax, eax
je 0x4e1ea0
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x57c17c], eax
mov eax, dword [0x57c17c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4e1ef9
cmp dword [0x57c180], ecx
je 0x4e1ef9
push eax
call esi
push dword [0x57c180]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4e1ef9
test ebx, ebx
je 0x4e1ef9
call edi
test eax, eax
je 0x4e1ef0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4e1ef0
test byte [ebp - 8], 1
jne 0x4e1ef9
or dword [ebp + 0x10], 0x200000
jmp 0x4e1f2c
mov eax, dword [0x57c174]
cmp eax, dword [ebp - 0x18]
je 0x4e1f2c
push eax
call esi
test eax, eax
je 0x4e1f2c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4e1f2c
mov eax, dword [0x57c178]
cmp eax, dword [ebp - 0x18]
je 0x4e1f2c
push eax
call esi
test eax, eax
je 0x4e1f2c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x57c170]
call esi
test eax, eax
je 0x4e1f48
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4e1f4a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004be8b8
leave
ret
Function at 0x4f7205
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4f722a
cmp eax, edi
jge 0x4f7222
mov eax, esi
call fcn.004f6abe
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edi, dword [esi + 8]
xor ecx, ecx
test edi, edi
jle 0x4f7257
mov eax, dword [esi + 0xc]
push ebx
mov dl, byte [esi + 0xc]
sub edi, 8
mov byte [ebp + ecx - 4], dl
shr eax, 8
mov ebx, edi
inc ecx
mov dword [esi + 0xc], eax
test ebx, ebx
jg 0x4f7237
mov dword [esi + 8], ebx
pop ebx
cmp ecx, 4
jge 0x4f7273
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4f7264
xor dl, dl
jmp 0x4f7269
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x4f725a
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x4f72a7
mov dword [0x57c210], str.zlib_corrupt
xor eax, eax
jmp 0x4f72e7
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4f72bc
mov dword [0x57c210], str.read_past_buffer
jmp 0x4f72a3
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x4f72d1
mov ecx, edi
call fcn.004f6bf1
test eax, eax
je 0x4f72a3
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.004c4af0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x5088d6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x5088f6
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x5089a1
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
call fcn.005040a9
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
je 0x508924
push dword [ebp + 0x10]
call fcn.004c0fc7
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax + 8], edi
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x5089a0
push ebx
mov ebx, dword [ebp - 4]
cmp ebx, edi
jbe 0x508930
mov eax, ebx
jmp 0x508933
xor eax, eax
inc eax
push eax
call dword [0x578dd4]
mov esi, eax
pop ecx
push dword [ebp + 0x10]
cmp esi, edi
jne 0x508954
call fcn.004c0fc7
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x508980
push ebx
push 1
push esi
call fcn.004c0a34
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call fcn.004c0fc7
add esp, 0x14
cmp dword [ebp - 4], ebx
je 0x508989
push esi
call dword [0x578dd8]
mov eax, dword [ebp + 8]
mov dword [eax], 2
mov dword [eax + 8], edi
pop ecx
mov dword [eax + 4], edi
jmp 0x50899f
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push ebx
push esi
push dword [ebp + 8]
call fcn.0050853b
mov eax, dword [ebp + 8]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x508bc5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.00507e7a
mov edi, eax
test edi, edi
je 0x508c02
push esi
mov ecx, dword [ebp + 0xc]
push edi
mov esi, edi
call fcn.00507f14
push dword [esi]
mov edi, eax
call fcn.004c4acb
push dword [ebp + 8]
inc eax
push eax
push 2
push dword [esi]
call fcn.004c0ba8
add esp, 0x14
test edi, edi
jne 0x508bd8
pop esi
pop edi
pop ebp
ret

Function at 0x508c05
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push dword [edi + 4]
call fcn.005050d8
and dword [ebp + 8], 0
add esp, 4
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
mov ebx, eax
call fcn.0046a580
mov esi, dword [ebp - 4]
cmp dword [esi - 8], 0
je 0x508c44
push dword [ebp + 0xc]
mov ecx, edi
call fcn.005086be
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push ebx
push 1
push eax
call fcn.004c0ba8
add esp, 0x10
pop edi
lea ecx, [esi - 0xc]
pop esi
pop ebx
cmp ecx, dword [0x577020]
je 0x508c69
call fcn.00419c70
leave
ret