joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7cb4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b7d1e
mov eax, ebx
call fcn.004ba01c
test al, al
jne 0x4b7d1e
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405698
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4b7d0b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b7d2b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004055fc
jmp 0x4b7d2b
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004055fc
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4b911c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b918a
mov eax, esi
call fcn.004a2350
test al, al
je 0x4b918a
mov eax, dword [ebx + 0x84]
call fcn.004a1fcc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b918a
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x4b917e
push 0
mov eax, dword [ebx + 0x84]
call fcn.004a1fcc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00499ee4
jmp 0x4b918a
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b8f58
pop esi
pop ebx
ret
Function at 0x4bbba4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4bbbd1
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4bbc50
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004ba2fc
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4bbc1e
mov cx, word [esp]
sub cx, si
jmp 0x4bbc20
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4bbc07
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4bbc46
mov cx, word [esp]
sub cx, si
jmp 0x4bbc48
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4bbc2f
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4bbcad
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004bb878
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4bbc98
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4bbcad
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4bbbae
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c177c
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], dl
mov edi, eax
lea eax, [esp + 1]
xor ecx, ecx
mov edx, 8
call fcn.00403c30
xor edx, edx
mov esi, 0x5c15f0
movzx eax, byte [esp]
add eax, eax
add eax, eax
add eax, eax
movzx eax, byte [esi + eax*8]
dec eax
movzx ecx, al
shr ecx, 3
movzx ecx, byte [edi + ecx]
and al, 7
movzx eax, al
and cl, byte [eax + 0x5c18f0]
test cl, cl
je 0x4c17dd
mov eax, edx
and al, 7
movzx eax, al
movzx eax, byte [eax + 0x5c18f0]
movzx ecx, dl
shr ecx, 3
or byte [esp + ecx + 1], al
inc edx
inc esi
cmp dl, 0x40
jne 0x4c179d
mov edx, edi
lea eax, [esp + 1]
mov ecx, 8
call fcn.00403304
add esp, 0xc
pop edi
pop esi
ret

Function at 0x4c17fc
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov esi, eax
mov edi, 0x5c18f0
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 8
call fcn.00403c30
lea eax, [esp + 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00403c30
xor ecx, ecx
mov ebx, 0x5c18a0
movzx eax, byte [ebx]
add eax, 0x1f
mov edx, eax
shr edx, 3
movzx edx, byte [esi + edx]
and eax, 7
and dl, byte [edi + eax]
test dl, dl
je 0x4c1872
movzx ebp, cl
mov eax, ebp
push ecx
mov ecx, 6
xor edx, edx
div ecx
pop ecx
movzx eax, byte [edi + edx]
push eax
mov eax, ebp
mov ebp, 6
xor edx, edx
div ebp
pop edx
or byte [esp + eax + 4], dl
inc ecx
inc ebx
cmp cl, 0x30
jne 0x4c1834
mov cl, 8
mov eax, dword [esp]
lea edx, [esp + 4]
movzx ebx, byte [eax]
xor byte [edx], bl
inc edx
inc eax
dec cl
jne 0x4c1882
xor ecx, ecx
lea eax, [esp + 4]
movzx edx, cl
mov ebx, edx
and ebx, 1
test bl, bl
je 0x4c18c4
movzx ebx, byte [eax]
shr ebx, 2
mov ebp, edx
add ebp, 2
add ebp, ebp
add ebp, ebp
add ebp, ebp
lea ebp, [ebp*8 + 0x5c15f0]
movzx ebx, byte [ebp + ebx]
shr edx, 1
add byte [esp + edx + 0xc], bl
jmp 0x4c18ea
movzx ebx, byte [eax]
shr ebx, 2
mov ebp, edx
add ebp, 2
add ebp, ebp
add ebp, ebp
add ebp, ebp
lea ebp, [ebp*8 + 0x5c15f0]
movzx ebx, byte [ebp + ebx]
shl ebx, 4
shr edx, 1
mov byte [esp + edx + 0xc], bl
inc ecx
inc eax
cmp cl, 8
jne 0x4c1893
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 8
call fcn.00403c30
xor ecx, ecx
mov edx, 0x5c18d0
movzx eax, byte [edx]
dec eax
mov ebx, eax
shr ebx, 3
movzx ebx, byte [esp + ebx + 0xc]
and eax, 7
and bl, byte [edi + eax]
test bl, bl
je 0x4c1935
mov eax, ecx
and al, 7
movzx eax, al
movzx eax, byte [edi + eax]
movzx ebx, cl
shr ebx, 3
or byte [esp + ebx + 4], al
inc ecx
inc edx
cmp cl, 0x20
jne 0x4c1908
movzx eax, byte [esp + 4]
xor byte [esi], al
movzx eax, byte [esp + 5]
xor byte [esi + 1], al
movzx eax, byte [esp + 6]
xor byte [esi + 2], al
movzx eax, byte [esp + 7]
xor byte [esi + 3], al
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4c232c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor ebx, ebx
mov ecx, 0x5d0ed8
mov eax, ebx
mov edx, 8
mov esi, eax
and esi, 1
cmp esi, 1
jne 0x4c234f
shr eax, 1
xor eax, 0xedb88320
jmp 0x4c2351
shr eax, 1
dec edx
jne 0x4c233c
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x4c2335
pop esi
pop ebx
ret
Function at 0x4c2368
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ecx, eax
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0x4c239d
inc ebx
mov eax, edx
mov edx, ecx
shr edx, 8
and edx, 0xffffff
movzx esi, byte [eax]
xor ecx, esi
and ecx, 0xff
xor edx, dword [ecx*4 + 0x5d0ed8]
mov ecx, edx
inc eax
dec ebx
jne 0x4c237a
mov eax, ecx
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4d9004
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405a28
xor eax, eax
push ebp
push 0x4d906b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405a38
call fcn.004572a4
mov ebx, 0x1505
test eax, eax
jle 0x4d9055
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
shl ebx, 5
add ebx, esi
add ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4d903e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9072
lea eax, [ebp - 4]
call fcn.004055a8
ret
Function at 0x4e4d8c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x42bda4]
call fcn.00406364
xor eax, eax
push ebp
push 0x4e4f2d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5c1bbc], 0
jne 0x4e4de7
mov ecx, dword [0x5ca26c]
mov dl, 1
mov eax, dword [0x454f0c]
call fcn.0045b798
call fcn.00404edc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403c30
mov eax, ebx
call fcn.00405f80
mov dword [ebp - 0x24], eax
mov esi, 0x4e4f3c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00407834
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405f90
test eax, eax
jle 0x4e4ed0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e4ebc
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405818
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x4e4e62
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00405830
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4e4e78
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00405830
mov eax, dword [ebp - 0x54]
call fcn.00405a38
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00405818
mov eax, dword [ebp - 0x58]
call fcn.00405a38
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x4e4ebe
xor eax, eax
test al, al
je 0x4e4ec9
mov ebx, 0x15
jmp 0x4e4ed5
mov ebx, 0x10
jmp 0x4e4ed5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x5c1bbc]
call fcn.004e4c0c
mov eax, dword [ebp - 4]
call fcn.004e4c0c
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040784c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4f34
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004055cc
lea eax, [ebp - 0xc]
mov edx, dword [0x42bda4]
call fcn.00406434
ret
Function at 0x4f5af8
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push ebx
push esi
test dl, dl
je 0x4f5b11
add esp, 0xfffffff0
call fcn.004048c8
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4f5b86
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0046c148
xor edx, edx
mov eax, esi
call fcn.004f5cf8
xor edx, edx
mov eax, esi
call fcn.004f5d1c
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
call fcn.004666a8
lea edx, [ebp - 0x10]
lea eax, [esi + 0x18]
call fcn.0045f6b0
mov byte [esi + 0x39], 0
mov byte [esi + 0x30], 1
lea eax, [esi + 0x10]
call fcn.004055a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f5b8d
lea eax, [ebp - 0x10]
call fcn.0045f39c
ret

Function at 0x50557c
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x50558b
or edx, 0x200
test eax, 0x20000000
je 0x5055bf
test eax, 0x40000000
je 0x5055aa
test eax, 0x80000000
je 0x5055a5
or edx, 0x40
jmp 0x5055e6
or edx, 0x20
jmp 0x5055e6
test eax, 0x80000000
je 0x5055b9
or edx, 0x80
jmp 0x5055e6
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x5055d7
test eax, 0x80000000
je 0x5055d2
or edx, 4
jmp 0x5055e6
or edx, 2
jmp 0x5055e6
test eax, 0x80000000
je 0x5055e3
or edx, 8
jmp 0x5055e6
or edx, 1
mov eax, edx
ret
Function at 0x507358
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp]
mov edi, dword [eax + 8]
dec edi
test edi, edi
jl 0x507434
inc edi
xor ebp, ebp
mov edx, ebp
mov eax, dword [esp]
call fcn.00476768
mov esi, eax
mov dl, 1
mov eax, dword [0x50f6fc]
call fcn.0050fa44
mov ebx, eax
movzx eax, byte [esi + 4]
mov byte [ebx + 4], al
movzx eax, byte [esi + 5]
mov byte [ebx + 5], al
movzx eax, byte [esi + 6]
mov byte [ebx + 6], al
movzx eax, byte [esi + 7]
mov byte [ebx + 7], al
movzx eax, byte [esi + 8]
mov byte [ebx + 8], al
movzx eax, byte [esi + 9]
mov byte [ebx + 9], al
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x10]
mov edx, dword [esi + 0x10]
call fcn.004055fc
lea eax, [ebx + 0x14]
mov edx, dword [esi + 0x14]
call fcn.004055fc
lea eax, [ebx + 0x18]
mov edx, dword [esi + 0x18]
call fcn.004055fc
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov edx, dword [esi + 0x24]
call fcn.004055fc
lea eax, [ebx + 0x28]
mov edx, dword [esi + 0x28]
call fcn.004055fc
movzx eax, byte [esi + 0x2c]
mov byte [ebx + 0x2c], al
movzx eax, byte [esi + 0x2d]
mov byte [ebx + 0x2d], al
movzx eax, byte [esi + 0x2e]
mov byte [ebx + 0x2e], al
movzx eax, byte [esi + 0x2f]
mov byte [ebx + 0x2f], al
mov edx, ebx
mov eax, dword [esp + 4]
call fcn.004766cc
inc ebp
dec edi
jne 0x507378
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x51d318
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x51d32d
add esp, 0xfffffff0
call fcn.004048c8
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.004078a8
xor eax, eax
push ebp
push 0x51d3d7
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
mov byte [ebx + 0x14], 0
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0xffffffff
lea eax, [ebx + 0x20]
call fcn.00407834
mov byte [ebx + 0x24], 0
xor eax, eax
mov dword [ebx + 0x28], eax
mov byte [ebx + 0x2c], 0
mov byte [ebx + 0x2d], 0
lea eax, [ebx + 0x30]
call fcn.004055a8
lea eax, [ebx + 0x38]
mov edx, dword [ebp - 4]
call fcn.0040784c
mov dl, 1
mov eax, dword [0x469464]
call fcn.00404534
mov dword [ebx + 0x34], eax
mov dl, 1
mov eax, dword [0x469464]
call fcn.00404534
mov edi, eax
mov dword [ebx + 0x3c], edi
test esi, esi
je 0x51d3c1
mov eax, edi
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x40]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51d3de
lea eax, [ebp - 4]
call fcn.00407834
ret
Function at 0x51f9a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x51f9bd
add esp, 0xfffffff0
call fcn.004048c8
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004078a8
mov eax, dword [ebp + 0xc]
call fcn.004078a8
mov eax, dword [ebp + 8]
call fcn.004078a8
xor eax, eax
push ebp
push 0x51fa71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
call fcn.0050b29c
lea eax, [edi + 0x34]
mov edx, dword [ebp - 4]
call fcn.0040784c
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x30], eax
xor eax, eax
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
test esi, esi
jle 0x51fa4b
mov ebx, 1
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x10]
test al, al
je 0x51fa47
mov edx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x48]
add al, 0xfe
sub al, 4
jae 0x51fa47
mov dword [edi + 0x38], ebx
jmp 0x51fa4b
inc ebx
dec esi
jne 0x51fa24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fa78
lea eax, [ebp - 4]
call fcn.00407834
lea eax, [ebp + 8]
call fcn.00407834
lea eax, [ebp + 0xc]
call fcn.00407834
ret

Function at 0x547600
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x5ca390]
cmp byte [eax], 0
jne 0x54762e
mov ecx, 0xaf
mov edx, 0x54767c
mov eax, 0x5476a0
call fcn.004054d4
mov eax, ebx
call fcn.00405db0
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x54766c
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405f54
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5476b4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [0x5ca390]
cmp byte [eax], 0
jne 0x5476d7
mov ecx, 0xbd
mov edx, 0x547718
mov eax, 0x54773c
call fcn.004054d4
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x54770a
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x54770a
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x54770a
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x54828c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x54841e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x5482cd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x5482ea
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x5482e0
mov eax, edi
call fcn.0048f04c
mov dword [ebp - 4], eax
jmp 0x5482ea
mov eax, esi
call fcn.0048f04c
mov dword [ebp - 4], eax
mov eax, dword [0x5ca390]
cmp byte [eax], 0
je 0x548403
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x548403
test ebx, ebx
je 0x548403
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x54842c]
movzx edx, word [0x548430]
cmp dx, ax
jne 0x548403
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x548403
push ebp
call fcn.005480d0
pop ecx
test al, al
je 0x548403
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00547ee4
mov eax, dword [ebp - 8]
call fcn.00490b98
test eax, eax
jne 0x5483b1
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x5483b1
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x54838a
cmp dword [esi + 0x64], 0
jne 0x54838a
mov eax, dword [esi + 4]
mov edx, dword [0x48d9c4]
call fcn.004046f0
test al, al
jne 0x5483b1
push dword [ebp - 0xc]
push 0x548438
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.00547750
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040606c
push ebp
lea eax, [ebp - 0x14]
call fcn.0054812c
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004060b4
je 0x548403
push ebp
mov eax, dword [ebp - 0xc]
call fcn.005481fc
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x5483e3
cmp dword [esi + 0x6c], 0
je 0x548403
mov eax, ebx
mov edx, dword [0x48d9c4]
call fcn.004046f0
test al, al
je 0x548403
cmp dword [ebx + 0x38], 0
je 0x548403
mov eax, dword [ebx + 0x38]
push eax
call sub.user32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548425
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405dc8
ret

Function at 0x54b908
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x5cad68]
cmp dword [eax], 2
je 0x54b926
mov ecx, 0x35f
mov edx, 0x54b958
mov eax, 0x54b97c
call fcn.004054d4
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x54b8a8
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5d16ec], eax
cmp dword [0x5d16ec], 0
jne 0x54b94d
call fcn.0045ce24
ret
Function at 0x54c238
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x54c29c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00405818
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.00456a44
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54c2a3
lea eax, [ebp - 0xc]
call fcn.004055a8
ret

Function at 0x54c318
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x54c374
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x54c343
call fcn.0045ce24
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00403304
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x54c374
call fcn.0045ce24
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x55628c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x5562bb
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x55633a
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00554b48
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x556308
mov cx, word [esp]
sub cx, si
jmp 0x55630a
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x5562f1
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x556330
mov cx, word [esp]
sub cx, si
jmp 0x556332
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x556319
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x556397
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.00555f60
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x556382
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x556397
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x556296
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x55c7d0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x5d1a70
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x55c7f2
shr eax, 1
xor eax, 0xedb88320
jmp 0x55c7f4
shr eax, 1
dec edx
jne 0x55c7e0
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x55c7d9
mov byte [0x5d1e70], 1
pop esi
pop ebx
ret

Function at 0x55c810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x5d1e70], 0
jne 0x55c827
call fcn.0055c7d0
mov eax, edi
dec eax
test eax, eax
jl 0x55c84f
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5d1a70]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x55c831
mov eax, ebx
pop edi
pop esi
pop ebx
ret