joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47a94b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, byte [esi + 0xd]
je 0x47a935
mov eax, esi
call fcn.0047ae04
test al, al
je 0x47a7c8
mov al, byte [esi + 0xd]
dec eax
sub al, 3
jb 0x47a767
sub al, 4
jb 0x47a79c
sub al, 3
je 0x47a7a8
jmp 0x47a7c8
mov eax, esi
call fcn.004798b4
cmp byte [eax + 0x14c], 0
je 0x47a785
mov eax, esi
call fcn.004798b4
call fcn.0047bf30
jmp 0x47a7c8
mov eax, esi
call fcn.00479390
mov eax, esi
call fcn.004798b4
mov edx, esi
call fcn.0047bc50
jmp 0x47a7c8
mov edx, esi
mov eax, dword [esi + 4]
call fcn.0047b1fc
jmp 0x47a7c8
mov eax, dword [esi + 0x44]
mov al, byte [eax + 4]
cmp al, 7
ja 0x47a7bc
and eax, 0x7f
bt dword [0x53f030], eax
jae 0x47a7c8
mov edx, esi
mov eax, dword [esi + 4]
call fcn.0047b1fc
mov eax, ebx
mov byte [esi + 0xd], al
xor edx, edx
mov dl, al
cmp edx, 0xb
ja case.0x47a7e0.0
mov dl, byte [edx + 0x47a7e7]
jmp dword [edx*4 + 0x47a7f3]
and eax, 0x7f
mov edx, dword [eax*4 + 0x53f03c]
mov eax, esi
call fcn.0047a964
mov dl, 1
mov eax, esi
call fcn.0047a694
mov eax, esi
call fcn.0047ae04
test al, al
je 0x47a92e
mov eax, esi
call fcn.004798b4
cmp byte [eax + 0x14c], 0
je 0x47a86c
mov eax, esi
call fcn.004798b4
call fcn.0047bf7c
xor eax, eax
mov al, byte [esi + 0xd]
mov eax, dword [eax*4 + 0x53f030]
push eax
call sub.user32.dll_GetKeyState
and al, 1
mov byte [esi + 0xc], al
jmp 0x47a92e
mov eax, esi
call fcn.0047935c
mov eax, esi
call fcn.004798b4
mov edx, esi
call fcn.0047bc80
jmp 0x47a92e
xor edx, edx
mov eax, esi
call fcn.0047a694
mov eax, esi
call fcn.0047ae04
test al, al
je 0x47a8a4
mov edx, esi
mov eax, dword [esi + 4]
call fcn.0047b2f0
mov eax, esi
mov bx, 0xfffc
call fcn.004032a8
jmp 0x47a92e
xor edx, edx
mov eax, esi
call fcn.0047a694
lea edx, [ebp - 4]
mov eax, esi
call fcn.0047af74
cmp dword [ebp - 4], 0
jne 0x47a92e
lea eax, [esi + 0x30]
mov edx, 0x47a960
call fcn.00403d74
jmp 0x47a92e
mov dl, 1
mov eax, esi
call fcn.0047a694
jmp 0x47a92e
xor edx, edx
mov eax, esi
call fcn.0047a694
mov dl, 2
mov eax, esi
call fcn.0047a668
mov eax, dword [esi + 0x44]
mov al, byte [eax + 4]
cmp al, 7
ja 0x47a90a
and eax, 0x7f
bt dword [0x53f030], eax
jae 0x47a92e
xor edx, edx
mov eax, esi
call fcn.0047a700
xor eax, eax
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x44]
mov eax, dword [eax + 0x10]
mov dword [esi + 0x24], eax
jmp 0x47a92e
xor edx, edx
mov eax, esi
call fcn.0047a694
mov eax, esi
call fcn.004798cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a952
lea eax, [ebp - 4]
call fcn.00403d20
ret
Function at 0x47b098
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, eax
mov al, byte [ebx + 0xd]
dec eax
sub al, 3
jae 0x47b138
mov eax, ebx
call fcn.004798b4
cmp byte [eax + 0x14c], 0
je 0x47b0fc
mov eax, ebx
call fcn.0047ae04
test al, al
je 0x47b0fc
mov eax, ebx
call fcn.00479390
mov eax, ebx
call fcn.004798b4
mov edx, ebx
call fcn.0047bc50
mov eax, ebx
call fcn.004798b4
call fcn.0047bf7c
xor eax, eax
mov al, byte [ebx + 0xd]
mov eax, dword [eax*4 + 0x53f030]
push eax
call sub.user32.dll_GetKeyState
and al, 1
mov byte [ebx + 0xc], al
jmp 0x47b138
mov eax, ebx
call fcn.004798b4
cmp byte [eax + 0x14c], 0
jne 0x47b138
mov eax, ebx
call fcn.0047ae04
test al, al
je 0x47b138
mov eax, ebx
call fcn.004798b4
call fcn.0047bf30
mov eax, ebx
call fcn.0047935c
mov eax, ebx
call fcn.004798b4
mov edx, ebx
call fcn.0047bc80
pop ebx
ret

Function at 0x47c3b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, edx
dec eax
test eax, eax
jl 0x47c3de
inc eax
xor edx, edx
mov dl, byte [ebx]
mov esi, dword [ecx]
and esi, 0xff
xor edx, esi
mov edx, dword [edx*4 + 0x53f04c]
mov esi, dword [ecx]
shr esi, 8
xor edx, esi
mov dword [ecx], edx
inc ebx
dec eax
jne 0x47c3bc
pop esi
pop ebx
ret

Function at 0x47cb44
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47cbf5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403d20
mov dl, 1
mov eax, dword [0x45c058]
call fcn.0045c1ec
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47cbd8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0045c280
xor ecx, ecx
mov edx, 0x47cc0c
mov eax, dword [ebp - 4]
call fcn.0045c3dc
lea eax, [ebp - 8]
mov edx, esi
call fcn.00403f40
mov edx, dword [ebp - 8]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.0045c82c
mov eax, dword [ebp - 4]
call fcn.0045c250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cbdf
mov eax, dword [ebp - 4]
call fcn.00403174
ret

Function at 0x47cd20
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x11], 0x80
setne al
add esp, 0x100
ret

Function at 0x47cd3c
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x10], 0x80
setne al
add esp, 0x100
ret

Function at 0x47cd58
Capabilities:
Log keystrokes via polling

Disassembly:
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
test byte [esp + 0x12], 0x80
setne al
add esp, 0x100
ret
Function at 0x482494
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48262b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00481fb4
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040c89c
cmp al, 2
jne 0x4824da
dec esi
mov eax, ebx
call fcn.00482278
test al, al
je 0x4825cb
test esi, esi
jge 0x4824ef
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00481fb4
mov eax, dword [ebp - 0x204]
call fcn.00403f9c
cmp edi, eax
jge 0x482536
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00481fb4
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x541efc]
and eax, 0xff
bt dword [edx], eax
jae 0x482536
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x482544
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.00482470
cmp edi, esi
je 0x4825c3
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x48256a
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.00428dec
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.00428dec
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x482612
test esi, esi
jge 0x4825d1
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00481fb4
mov eax, dword [ebp - 0x204]
call fcn.00403f9c
cmp esi, eax
jl 0x482607
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.00481fb4
mov eax, dword [ebp - 0x204]
call fcn.00403f9c
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.00482470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482632
lea eax, [ebp - 0x204]
call fcn.00403d20
ret
Function at 0x48558c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
xor edx, edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x485757
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x34], 0
je 0x4855c7
cmp byte [ebx + 0x35], 0
jne 0x4855c7
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x4855f3
cmp byte [ebx + 0x35], 1
jne 0x4855e1
lea eax, [ebp - 0x24]
push eax
push 0x12
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004841e0
jmp 0x4855f3
lea eax, [ebp - 0x24]
push eax
push 0x11
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004841e0
xor edx, edx
push ebp
push 0x485732
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x3c]
mov edx, 0x104
call fcn.004042cc
mov eax, dword [ebx + 0x3c]
call fcn.00404160
mov dword [ebp - 0x20], eax
cmp dword [ebx + 0x38], 0
je 0x48562c
mov eax, dword [ebx + 0x38]
call fcn.00404160
mov dword [ebp - 0x1c], eax
jmp 0x485631
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp byte [ebx + 0x35], 1
jne 0x485640
mov dword [ebp - 0x18], 0x1000
jmp 0x485647
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x14], 0x4851bc
mov dword [ebp - 0x10], ebx
mov eax, dword [0x541d50]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00485768
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
setne byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x485717
xor eax, eax
push ebp
push 0x485710
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x35], 0
jne 0x4856dd
lea eax, [ebp - 0x12d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
call fcn.0040cf20
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x12d]
call fcn.00409810
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.004858c0
mov edx, dword [ebp - 0x134]
lea eax, [ebx + 0x44]
call fcn.00403d74
jmp 0x4856e8
lea eax, [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
call fcn.00403d74
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x44]
call fcn.00403d74
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x48], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485717
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485739
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x485731
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x485920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404150
xor eax, eax
push ebp
push 0x485971
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404160
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x485955
test al, 0x10
jne 0x485959
xor ebx, ebx
jmp 0x48595b
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485978
lea eax, [ebp - 4]
call fcn.00403d20
ret
Function at 0x48b09c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x48b103
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403f4c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408cb8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b10a
lea eax, [ebp - 0xc]
call fcn.00403d20
ret

Function at 0x48d8d4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x94], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48da56
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0048d134
mov eax, ebx
call fcn.00419848
dec al
je 0x48d918
dec al
je 0x48d91e
jmp 0x48d924
mov byte [ebp - 0x77], 2
jmp 0x48d928
mov byte [ebp - 0x77], 1
jmp 0x48d928
mov byte [ebp - 0x77], 0
mov eax, dword [ebp - 0x8c]
or eax, 0x80000000
or eax, 1
or eax, 2
or eax, 4
or eax, 8
or eax, 0x20000000
or eax, 0x40000000
mov dword [ebp - 0x8c], eax
mov eax, ebx
call fcn.004197d4
shl eax, 2
lea eax, [eax + eax*4]
mov dword [ebp - 0x84], eax
mov eax, ebx
call fcn.00419810
test al, 1
je 0x48d974
or dword [ebp - 0x88], 1
mov eax, ebx
call fcn.00419810
test al, 2
je 0x48d986
or dword [ebp - 0x88], 2
mov eax, ebx
call fcn.00419810
test al, 4
je 0x48d998
or dword [ebp - 0x88], 4
mov eax, ebx
call fcn.00419810
test al, 8
je 0x48d9aa
or dword [ebp - 0x88], 8
lea edx, [ebp - 0x94]
mov eax, ebx
call fcn.00419760
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x76]
mov ecx, 0x20
call fcn.004096a8
mov edi, dword [ebx + 0x14]
cmp edi, 0x80000008
je 0x48d9dd
cmp edi, 0x20000000
jne 0x48d9e9
mov dword [ebp - 0x88], 0x40000000
jmp 0x48d9f3
mov eax, edi
call fcn.00419038
mov dword [ebp - 0x7c], eax
or dword [ebp - 0x8c], 0x8000000
mov eax, ebx
call fcn.00419878
mov byte [ebp - 0x78], al
lea eax, [ebp - 0x3c]
push eax
push 0x3c
mov eax, ebx
call fcn.00419570
push eax
call sub.gdi32.dll_GetObjectA
test eax, eax
je 0x48da30
or dword [ebp - 0x8c], 0x400000
mov ax, word [ebp - 0x2c]
mov word [ebp - 0x56], ax
lea edx, [ebp - 0x90]
mov eax, esi
call fcn.0048d1a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48da5d
lea eax, [ebp - 0x94]
call fcn.00403d20
ret

Function at 0x494ec0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x494ef8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x494ed6
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x494ee5
or bl, 4
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x494ef4
or bl, 2
mov eax, ebx
pop ebx
ret
Function at 0x49fdba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x1c]
mov ebp, dword [eax + 0x20]
add ecx, edi
mov ebx, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 0x24]
add ecx, edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x49fe10
jmp 0x49fdfa
mov ecx, dword [ebp + esi*4]
add ecx, edi
call fcn.0049fd4a
cmp eax, dword [esp + 0x10]
je 0x49fe1a
inc esi
cmp esi, ebx
jb 0x49fdfa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x4b1808
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00428f84
test al, al
je 0x4b18ce
mov eax, dword [ebp - 4]
call fcn.004b17a4
test eax, eax
jle 0x4b18ce
xor edx, edx
push ebp
push 0x4b18c7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 1
mov eax, dword [eax + 0x40]
mov ebx, dword [eax + 8]
dec ebx
cmp ebx, 0
jl 0x4b188e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004af468
call fcn.004b1108
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov edx, ebx
call fcn.004af468
call fcn.00403174
dec ebx
cmp ebx, 0xffffffff
jne 0x4b185e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x40]
mov bx, 0xffff
call fcn.004032a8
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b18ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov byte [eax + 0x30], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0xd], 0
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b8790
Capabilities:
Create process on windows

Disassembly:
push 1
push 0
push 0
push 0x4b87a8
push 0x4b87d4
push 0
call sub.shell32.dll_ShellExecuteA
ret

Function at 0x4b88e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b89b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00402dc8
mov word [ebp - 0x28], 4
mov dword [ebp - 0x58], 0x44
test ebx, ebx
jne 0x4b892e
lea eax, [ebp - 4]
call fcn.004b87dc
jmp 0x4b8938
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00403db8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404160
push eax
call sub.kernel32.dll_CreateProcessA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4b896a
xor ebx, ebx
jmp 0x4b89a0
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4b897c
push 0xbb8
push eax
call sub.user32.dll_WaitForInputIdle
call fcn.004b89c4
mov ebx, eax
test ebx, ebx
jne 0x4b898b
xor ebx, ebx
jmp 0x4b89a0
push 0
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0xa002
push ebx
call sub.user32.dll_SendMessageA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b89bd
lea eax, [ebp - 4]
call fcn.00403d20
ret

Function at 0x4b9418
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov edi, eax
mov esi, 3
mov ebx, 0x53fe98
mov al, byte [ebx]
cmp al, 7
ja 0x4b943e
and eax, 0x7f
bt dword [ebp - 1], eax
jae 0x4b945b
push 0
push 0
push 0
xor eax, eax
mov al, byte [ebx + 1]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov al, byte [ebx + 1]
push eax
call sub.user32.dll_keybd_event
add ebx, 2
dec esi
jne 0x4b9431
cmp byte [ebp - 2], 0
je 0x4b946e
mov esi, 1
jmp 0x4b9470
xor esi, esi
push 0
push esi
push 0
movzx eax, di
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov ebx, edi
push ebx
call sub.user32.dll_keybd_event
or esi, 2
push 0
push esi
push 0
movzx eax, di
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
mov esi, 0xfffffffd
mov edi, 0x53fe9c
mov al, byte [edi]
cmp al, 7
ja 0x4b94b6
and eax, 0x7f
bt dword [ebp - 1], eax
jae 0x4b94d2
push 0
push 2
push 0
mov bl, byte [edi + 1]
xor eax, eax
mov al, bl
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
sub edi, 2
inc esi
jne 0x4b94a9
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b94e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
push esi
call sub.user32.dll_IsWindow
test eax, eax
je 0x4b964b
push 0
movzx eax, di
push eax
call sub.user32.dll_MapVirtualKeyA
mov edx, eax
xor eax, eax
call fcn.00407810
mov ebx, eax
cmp byte [ebp + 8], 0
je 0x4b9520
or ebx, 0x1000000
mov eax, 0x200
call fcn.00402710
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b9644
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
add eax, 0x100
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, pe_nt_image_headers32
call fcn.00402dc8
test byte [ebp - 1], 1
je 0x4b9565
mov eax, dword [ebp - 8]
mov byte [eax + 0x10], 0x80
test byte [ebp - 1], 2
je 0x4b9578
mov eax, dword [ebp - 8]
mov byte [eax + 0x12], 0x80
or ebx, 0x20000000
test byte [ebp - 1], 4
je 0x4b9585
mov eax, dword [ebp - 8]
mov byte [eax + 0x11], 0x80
test byte [ebp - 1], 8
je 0x4b9592
mov eax, dword [ebp - 8]
mov byte [eax + 1], 0x80
test byte [ebp - 1], 0x10
je 0x4b959f
mov eax, dword [ebp - 8]
mov byte [eax + 2], 0x80
test byte [ebp - 1], 0x20
je 0x4b95ac
mov eax, dword [ebp - 8]
mov byte [eax + 4], 0x80
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetKeyboardState
test byte [ebp - 1], 2
je 0x4b95e3
push ebx
movzx eax, di
push eax
push 0x104
push esi
call sub.user32.dll_PostMessageA
or ebx, 0xc0000000
push ebx
movzx eax, di
push eax
push 0x105
push esi
call sub.user32.dll_PostMessageA
jmp 0x4b9609
push ebx
movzx eax, di
push eax
push pe_nt_image_headers32
push esi
call sub.user32.dll_PostMessageA
or ebx, 0xc0000000
push ebx
movzx eax, di
push eax
push 0x101
push esi
call sub.user32.dll_PostMessageA
mov eax, dword [0x541d50]
mov eax, dword [eax]
call fcn.004361d0
mov eax, dword [ebp - 8]
add eax, 0x100
push eax
call sub.user32.dll_SetKeyboardState
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b964b
cmp dword [ebp - 8], 0
je 0x4b9643
mov edx, 0x200
mov eax, dword [ebp - 8]
call fcn.00402728
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x4bade0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4baed7
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebx + 0x24]
dec eax
sub al, 3
jae 0x4baeb8
lea ecx, [ebp - 8]
mov edx, dword [ebx + 0x28]
mov eax, dword [0x54455c]
call fcn.00409364
mov edx, dword [ebp - 8]
lea eax, [ebx + 0x2c]
call fcn.00403d74
cmp byte [ebx + 0x30], 0
jne 0x4bae35
mov eax, dword [ebx + 0x28]
call fcn.00408e88
test al, al
jne 0x4baeb8
cmp byte [0x54454c], 0
je 0x4baead
mov al, byte [0x544554]
sub al, 1
jb 0x4bae4b
je 0x4bae5e
jmp 0x4bae6f
lea ecx, [ebp - 4]
mov edx, dword [0x544550]
mov eax, dword [ebx + 0x28]
call fcn.00409078
jmp 0x4bae6f
lea eax, [ebp - 4]
mov ecx, dword [0x544550]
mov edx, dword [ebx + 0x28]
call fcn.00403fe8
cmp dword [0x544558], 0
je 0x4bae94
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004091d4
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, dword [0x544558]
call fcn.00403fe8
push 0
mov eax, dword [ebp - 4]
call fcn.00404160
push eax
mov eax, dword [ebx + 0x28]
call fcn.00404160
push eax
call sub.kernel32.dll_CopyFileA
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 4]
call fcn.004130ec
mov byte [ebx + 0x30], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4baede
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403d44
ret
Function at 0x4bd5e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4bd770
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x541e58]
movzx eax, byte [eax]
mov dword [ebp - 4], eax
push 0x4bd780
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
test ebx, ebx
jne 0x4bd640
push 0x4bd790
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
test ebx, ebx
je 0x4bd75a
mov dword [ebp - 4], 1
jmp 0x4bd75a
push 0x104
lea eax, [ebp - 0x121]
push eax
push ebx
call sub.kernel32.dll_GetModuleFileNameA_2
test eax, eax
je 0x4bd75a
lea eax, [ebp - 8]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.00403f4c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404160
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4bd75a
mov eax, dword [ebp - 0x10]
call fcn.00402710
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4bd753
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x121]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4bd6c9
call fcn.00403818
jmp 0x4bd75a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4bd7a0
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4bd6ea
call fcn.00403818
jmp 0x4bd75a
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 8]
mov eax, ecx
sub eax, 1
jb 0x4bd704
sub eax, 0x1d
je 0x4bd70d
sub eax, 0xa
je 0x4bd716
jmp 0x4bd71f
mov dword [ebp - 4], 2
jmp 0x4bd73a
mov dword [ebp - 4], 3
jmp 0x4bd73a
mov dword [ebp - 4], 4
jmp 0x4bd73a
cmp ecx, 0x28
jle 0x4bd733
mov eax, ecx
mov ecx, 0xa
cdq
idiv ecx
mov dword [ebp - 4], eax
jmp 0x4bd73a
mov dword [ebp - 4], 3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd75a
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.00402728
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd777
lea eax, [ebp - 8]
call fcn.00403d20
ret