joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4ea0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x6b0]
cmp eax, 0xffffffff
push ebp
push esi
mov esi, edx
je 0x4c4ebf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b0], 0xffffffff
mov eax, dword [0x598910]
test eax, eax
je 0x4c4edd
lea ecx, [ebx + 0x4a0]
call fcn.004c4c70
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [ebx + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4c4f0f
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret
push 2
push 0
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test esi, esi
je 0x4c5030
push 0
call fcn.00563e36
add esp, 4
mov ecx, eax
call fcn.00520af0
push eax
xor edx, edx
mov ecx, 0xe75
call fcn.0041c9e0
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x1c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c4f58
sub eax, edx
push 0
lea edx, [esp + 0x10]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 0x10]
mov ecx, 0xe7d
call fcn.0041c9e0
cmp dword [ebx + 0x700], 2
jne 0x4c4fb5
mov eax, dword [ebx + 0x704]
cmp eax, 3
je 0x4c4f9c
cmp eax, 4
jne 0x4c4fb5
lea esi, [ebx + 8]
push 0x20
push esi
call fcn.00563730
add esp, 8
test eax, eax
jne 0x4c4fb2
mov eax, esi
jmp 0x4c4fb8
inc eax
jmp 0x4c4fb8
lea eax, [ebx + 8]
mov edx, eax
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c4fc0
push edi
lea edi, [esp + 0x14]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4c4fd0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4c4ff0
mov cx, word [0x574b0c]
mov dl, byte [0x574b0e]
mov word [edi], cx
mov byte [edi + 2], dl
lea eax, [esp + 0x14]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c5013
push 0
lea ecx, [esp + 0x10]
push ecx
sub eax, edx
push eax
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x598900]
test eax, eax
jne 0x4c5041
mov dword [ebx + 0x6b0], ebp
jmp 0x4c5052
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x6b0], 0xffffffff
pop esi
mov eax, 1
pop ebp
mov dword [ebx + 0x6a8], eax
pop ebx
add esp, 0x108
ret
Function at 0x4c5070
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
push esi
mov esi, ecx
cmp dword [esi + 0x6b0], 0xffffffff
push edi
mov edi, edx
mov dword [esi + 0x6a8], 0
jne 0x4c50ca
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
lea eax, [esi + 0x4a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x6b0], eax
je 0x4c513c
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x4c5125
push 0
call fcn.00563e36
add esp, 4
mov ecx, eax
call fcn.00520af0
push eax
xor edx, edx
mov ecx, 0xe76
call fcn.0041c9e0
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x18]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c5102
mov ecx, dword [esi + 0x6b0]
sub eax, edx
push 0
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [esi + 0x6b0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x6b0], 0xffffffff
pop edi
pop esi
add esp, 0x108
ret
Function at 0x4c6020
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x528
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x14b
mov esi, ecx
push 0x6d
push esi
call edi
mov eax, dword [0x59b070]
test eax, eax
mov byte [esp + 0x148], 0
je 0x4c6071
lea ecx, [esp + 0x148]
push ecx
push 0x180
push 0xd
push 0x198
push eax
call edi
mov al, byte [esp + 0x148]
test al, al
jne 0x4c6092
xor eax, eax
jmp 0x4c6080
mov cl, byte [eax + 0x598920]
mov byte [esp + eax + 0x148], cl
inc eax
test cl, cl
jne 0x4c6080
push ebp
lea edx, [esp + 0x14c]
push edx
push str._s.
push 0x59b078
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.Main_folder
push 0
push 0x143
push 0x6d
push esi
call edi
lea eax, [esp + 0xc]
push eax
push 0x59b078
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4c614b
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
test byte [esp + 0x10], 0x10
je 0x4c6137
cmp byte [esp + 0x3c], 0x2e
je 0x4c6137
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [eax + 0x59b078], cl
inc eax
test cl, cl
jne 0x4c60f0
push 0x59b078
push 0
push 0x158
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
jne 0x4c6130
push 0x59b078
push 0
push 0x143
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
je 0x4c6143
cmp eax, 0xfffffffe
je 0x4c6143
lea ecx, [esp + 0x10]
push ecx
jmp 0x4c613c
lea edx, [esp + 0x10]
push edx
push ebp
call ebx
test eax, eax
jne 0x4c60e0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push 0
push 0
push 0x146
push 0x6d
push esi
call edi
cmp eax, 0xffffffff
pop ebp
jne 0x4c6161
xor eax, eax
mov ecx, dword [0x598a28]
test ecx, ecx
jl 0x4c616f
cmp ecx, eax
jle 0x4c6177
xor ecx, ecx
mov dword [0x598a28], ecx
push 0
push ecx
push 0x14e
push 0x6d
push esi
call edi
pop edi
pop esi
add esp, 0x528
ret
Function at 0x4c64d0
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov eax, dword [0x598a40]
push ebx
push esi
mov dword [esp + 8], edx
xor edx, edx
test eax, eax
push edi
mov esi, ecx
je 0x4c659f
mov ecx, 0xe89
call fcn.0041c9e0
push eax
push 0
push 0xc
push 0x68
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 0
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x6d
push esi
call edi
push eax
call ebx
push 0
push 0x65
push esi
call edi
push eax
call ebx
push 0
push 0x66
push esi
call edi
push eax
call ebx
push 0
push 0x6e
push esi
call edi
push eax
call ebx
push 0
push 0x67
push esi
call edi
push eax
call ebx
push 0
push 0x6f
push esi
call edi
push eax
call ebx
push 0
push 1
push esi
call edi
push eax
call ebx
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push ebp
mov ecx, 0xe88
call fcn.0041c9e0
mov ebp, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
push 0
push 0xc
push 0x68
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push 0x69
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 5
push 0x69
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0x6d
push esi
call edi
push eax
call ebx
push 1
push 0x65
push esi
call edi
push eax
call ebx
push 1
push 0x66
push esi
call edi
push eax
call ebx
push 1
push 0x6e
push esi
call edi
push eax
call ebx
push 1
push 0x67
push esi
call edi
push eax
call ebx
push 1
push 0x6f
push esi
call edi
push eax
call ebx
push 1
push 1
push esi
call edi
push eax
call ebx
push 0
push 0
push 0x190
push 0x67
push esi
call ebp
cmp eax, 0xffffffff
pop ebp
je 0x4c66dc
test eax, eax
jne 0x4c6657
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 0
jmp 0x4c66bc
cmp eax, 1
jne 0x4c66a6
push eax
push 0x6a
push esi
call edi
push eax
call ebx
push 0
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 1
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4c66dc
push 0
push 0x6a
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push 0x6a
push esi
call edi
push eax
call ebx
push 1
push 0x6b
push esi
call edi
push eax
call ebx
push 1
push 0x6c
push esi
call edi
push eax
call ebx
push 0
push 0x70
push esi
call edi
push eax
call ebx
cmp dword [esp + 0xc], 2
jne 0x4c66dc
xor ecx, ecx
call fcn.0041c8e0
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4c8fb0
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
ret
Function at 0x4d0950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, ecx
mov ecx, dword [edx + 0x1df0]
push esi
call fcn.005366c0
mov esi, eax
test esi, esi
je 0x4d0b2a
push edi
mov edi, dword [esi + 0xbb4]
mov ecx, edi
call fcn.004dbea0
test eax, eax
je 0x4d0b29
cmp ebx, 0x1b58
jne 0x4d09cd
mov eax, dword [esi + 0x86c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push eax
call ebx
cmp eax, 0xffffffff
je 0x4d0a70
mov ecx, dword [esi + 0x86c]
push 0x5994c8
push eax
push 0x189
push ecx
call ebx
mov edx, edi
mov ecx, 0x5994c8
call fcn.004c3370
jmp 0x4d0a68
cmp ebx, 0x1b59
jne 0x4d0a7a
mov edx, dword [esi + 0x86c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x188
push edx
call edi
cmp eax, 0xffffffff
je 0x4d0a70
push 0x5990e0
push eax
mov eax, dword [esi + 0x86c]
push 0x189
push eax
call edi
mov al, byte [0x5990e0]
test al, al
je 0x4d0b29
cmp al, 9
mov ecx, 0x5990e0
jne 0x4d0a28
mov al, byte [ecx + 1]
inc ecx
cmp al, 9
je 0x4d0a20
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4d0a30
sub eax, esi
inc eax
push eax
push ecx
push 0x5990e0
call fcn.005641d0
push 0x20
push 0x5990e0
call fcn.00563730
add esp, 0x14
test eax, eax
je 0x4d0a5c
mov byte [eax], 0
xor edx, edx
mov ecx, 0x5990e0
call fcn.0041d160
test eax, eax
jne 0x4d0b29
pop edi
pop esi
xor ecx, ecx
pop ebx
jmp fcn.0041c8e0
cmp ebx, 0x1b5a
jne 0x4d0ab1
mov ecx, dword [esi + 0x86c]
push 0
push 0
push 0x184
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [edi]
push edi
push 0
push 0
push 0
push 0
mov edx, str.__.links
call fcn.0043bba0
pop edi
pop esi
pop ebx
ret
cmp ebx, 0x1b5b
jne 0x4d0b29
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x598248
push str._slinks.ini
push 0x59edb0
call edi
add esp, 0xc
push 4
push 0
xor edx, edx
mov ecx, 0x13ef
call fcn.0041c9e0
mov ecx, dword [esi]
push eax
mov edx, 3
call fcn.00512110
test eax, eax
je 0x4d0b29
push 0x59ef30
push 0x59edb0
push 0x574904
push 0x5994c8
call edi
mov ecx, dword [esi + 0x6c8]
add esp, 0x10
push 0x5994c8
push 0
push 0x574d20
mov edx, str.links
call fcn.004aca10
pop edi
pop esi
pop ebx
ret
Function at 0x4d0b30
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x7d0
push esi
push 0
push 0x104
lea eax, [esp + 0x3f4]
push eax
mov esi, edx
push esi
push ecx
call dword [sym.imp.USER32.dll_GetMenuStringA]
test eax, eax
jg 0x4d0b60
xor eax, eax
pop esi
add esp, 0x7d0
ret 4
cmp esi, 0x64
jne 0x4d0bb6
mov eax, dword [0x59b070]
test eax, eax
jne 0x4d0bce
call fcn.0050f7b0
mov ecx, dword [0x59e7d0]
push 0
mov edx, 1
call fcn.00517550
xor ecx, ecx
mov dword [0x59e7d0], eax
call fcn.0050f910
push 0x598350
push 0
mov edx, str.host
mov ecx, 0x575370
call fcn.004ac220
mov eax, 1
pop esi
add esp, 0x7d0
ret 4
cmp esi, 0x1b57
jne 0x4d0be4
mov ecx, dword [esp + 0x7d8]
call fcn.004de290
test eax, eax
jne 0x4d0bd5
xor ecx, ecx
call fcn.0041c8e0
mov eax, 1
pop esi
add esp, 0x7d0
ret 4
push edi
call fcn.0050f7b0
mov edi, dword [0x59e7d0]
test edi, edi
je 0x4d0c85
mov ecx, dword [edi]
lea edx, [esp + 8]
mov edi, edi
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4d0c00
lea ecx, [esp + 8]
push 0x576e00
push ecx
call fcn.00563db0
add esp, 8
test eax, eax
je 0x4d0c7a
lea edx, [esp + 8]
push 0x3a
push edx
mov byte [eax], 0
call fcn.00563730
add esp, 8
test eax, eax
je 0x4d0c4c
mov byte [eax], 0x2c
lea eax, [esp + 8]
push 0x3a
push eax
call fcn.00563730
add esp, 8
test eax, eax
jne 0x4d0c36
cmp byte [esp + 8], 0x2e
lea eax, [esp + 8]
jne 0x4d0c60
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x2e
je 0x4d0c57
cmp byte [eax], 0
je 0x4d0c7a
lea ecx, [esp + 0x3f0]
push ecx
push eax
call fcn.00572b46
add esp, 8
test eax, eax
je 0x4d0c92
mov edi, dword [edi + 0x40]
test edi, edi
jne 0x4d0bf8
pop edi
xor eax, eax
pop esi
add esp, 0x7d0
ret 4
mov esi, dword [esp + 0x7dc]
mov ecx, esi
call fcn.004dbea0
test eax, eax
je 0x4d0cce
mov edx, dword [edi]
push edx
mov edx, 0x3e7
lea ecx, [esp + 0xc]
call fcn.0041e120
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x4d0ce5
mov ecx, esi
call fcn.004de290
mov esi, eax
test esi, esi
jne 0x4d0ce5
xor ecx, ecx
call fcn.0041c8e0
pop edi
mov eax, 1
pop esi
add esp, 0x7d0
ret 4
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.004c29d0
push 0
lea edx, [esp + 0xc]
xor ecx, ecx
call fcn.004c2560
mov edx, esi
lea ecx, [esp + 8]
mov dword [edi], eax
call fcn.0050feb0
mov ecx, esi
mov dword [esi + 0x14], 0xc
call fcn.004536e0
pop edi
mov eax, 1
pop esi
add esp, 0x7d0
ret 4
Function at 0x4d0f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp ecx, 0xd
jl 0x4d1176
cmp ecx, 0xf
jg 0x4d1176
cmp edx, 0x1b6c
jne 0x4d0fbd
mov eax, dword [0x5a1b00]
push 0
push 0x9f
push 0x111
push eax
mov dword [0x59bd18], 6
call dword [sym.imp.USER32.dll_PostMessageA]
ret
cmp ecx, 0xd
jne 0x4d1010
mov eax, dword [0x5900b0]
test eax, eax
je 0x4d1176
cmp edx, 0x1b58
mov ecx, dword [eax]
jne 0x4d0fde
jmp fcn.0041ac60
cmp edx, 0x1b59
jne 0x4d0feb
jmp fcn.0041adf0
add edx, 0xffffe4a6
call fcn.0041aeb0
mov eax, dword [0x5900b0]
mov ecx, dword [eax + 0x940]
test ecx, ecx
je 0x4d1176
mov ecx, dword [eax]
jmp fcn.00419ae0
cmp ecx, 0xe
push ebx
jne 0x4d1031
cmp edx, 0x1b58
je 0x4d102a
cmp edx, 0x1b59
jne 0x4d116d
mov ebx, 0x59f6a8
jmp 0x4d106a
cmp ecx, 0xf
jne 0x4d116d
cmp edx, 0x1b58
je 0x4d1065
cmp edx, 0x1b59
je 0x4d1065
cmp edx, 0x1b62
je 0x4d105e
cmp edx, 0x1b63
jne 0x4d116d
mov ebx, 0x5a1090
jmp 0x4d106a
mov ebx, 0x5a0f78
cmp edx, 0x1b58
je 0x4d109b
cmp edx, 0x1b62
je 0x4d109b
cmp edx, 0x1b59
je 0x4d108e
cmp edx, 0x1b63
jne 0x4d116d
mov ecx, ebx
mov edx, 1
pop ebx
jmp fcn.00420c10
mov cl, byte [ebx + 0x10]
test cl, cl
lea eax, [ebx + 0x10]
je 0x4d10bc
mov edx, 0x59edb0
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4d10b0
jmp 0x4d10d4
push 0x5918b0
push str._s.bmp
push 0x59edb0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x1e
push 0
xor edx, edx
mov ecx, 0x13ed
call fcn.0041c9e0
mov ecx, dword [ebx]
push eax
mov edx, 6
call fcn.00512110
test eax, eax
je 0x4d1175
xor eax, eax
jmp 0x4d1100
mov cl, byte [eax + 0x59edb0]
mov byte [eax + 0x5918b0], cl
inc eax
test cl, cl
jne 0x4d1100
xor eax, eax
mov cl, byte [eax + 0x59edb0]
mov byte [eax + 0x5990e0], cl
inc eax
test cl, cl
jne 0x4d1113
mov eax, 0x59ef30
mov edx, eax
jmp 0x4d1130
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d1130
push esi
push edi
mov edi, 0x5990e0
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4d1141
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 1
mov edx, 0x5990e0
mov ecx, ebx
call fcn.00420d10
test eax, eax
pop edi
pop esi
jne 0x4d1175
xor ecx, ecx
pop ebx
jmp fcn.0041c8e0
pop ebx
ret
Function at 0x4d3da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
mov ebx, edx
test ebx, ebx
mov dword [esp + 4], ecx
jl 0x4d3fc8
cmp ebx, 2
jg 0x4d3fc8
push ebp
call fcn.004ce790
mov ebp, dword [sym.imp.USER32.dll_CreatePopupMenu]
call ebp
test eax, eax
mov dword [0x598b88], eax
jne 0x4d3ddc
pop ebp
xor ecx, ecx
pop ebx
add esp, 4
jmp fcn.0041c8e0
push esi
push edi
call ebp
mov esi, dword [sym.imp.USER32.dll_AppendMenuA]
mov edi, eax
test edi, edi
je 0x4d3ef4
xor edx, edx
mov ecx, 0x17dd
call fcn.0041c9e0
push eax
push 0x1b58
push 0
push edi
call esi
xor edx, edx
mov ecx, 0x17de
call fcn.0041c9e0
push eax
push 0x1b59
push 0
push edi
call esi
test ebx, ebx
jne 0x4d3e9e
push 0x574b10
push ebx
push 0x800
push edi
call esi
xor edx, edx
mov ecx, 0x17e1
call fcn.0041c9e0
push eax
push 0x1b5a
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e2
call fcn.0041c9e0
push eax
push 0x1b5b
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e3
call fcn.0041c9e0
push eax
push 0x1b5c
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e4
call fcn.0041c9e0
push eax
push 0x1b5d
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e5
call fcn.0041c9e0
push eax
push 0x1b5e
push ebx
push edi
call esi
xor edx, edx
mov ecx, 0x17e7
call fcn.0041c9e0
push eax
mov eax, dword [0x598b88]
push edi
push 0x10
push eax
call esi
test ebx, ebx
jne 0x4d3ef8
mov eax, dword [0x5900b0]
test eax, eax
push 8
je 0x4d3ee1
mov ecx, dword [eax + 0x954]
mov edx, dword [0x598b88]
add ecx, 0x1b5a
push ecx
push edx
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4d3f44
mov eax, dword [0x598b88]
push 0x1b5c
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x4d3f44
test ebx, ebx
je 0x4d3f44
cmp ebx, 1
je 0x4d3f44
call ebp
mov edi, eax
test edi, edi
je 0x4d3f44
xor edx, edx
mov ecx, 0x17dd
call fcn.0041c9e0
push eax
push 0x1b62
push 0
push edi
call esi
xor edx, edx
mov ecx, 0x17de
call fcn.0041c9e0
push eax
push 0x1b63
push 0
push edi
call esi
mov ecx, dword [0x598b88]
push str.Buttons
push edi
push 0x10
push ecx
call esi
mov edx, dword [0x598b88]
push 0x574b10
push 0
push 0x800
push edx
call esi
xor edx, edx
mov ecx, 0xefc
call fcn.0041c9e0
push eax
mov eax, dword [0x598b88]
push 0x1b6c
push 0
push eax
call esi
test ebx, ebx
pop edi
pop esi
jne 0x4d3f94
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [0x5a1b00]
mov edx, 0xd
call fcn.004ce2d0
pop ebp
pop ebx
pop ecx
ret
cmp ebx, 1
jne 0x4d3fb2
mov edx, dword [esp + 8]
mov ecx, dword [0x5a0f50]
push edx
mov edx, 0xe
call fcn.004ce2d0
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 8]
mov ecx, dword [0x59f690]
push eax
mov edx, 0xf
call fcn.004ce2d0
pop ebp
pop ebx
pop ecx
ret
Function at 0x4d43f0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebx, edx
xor edx, edx
push esi
mov dword [esp + 0x14], ecx
xor ebp, ebp
xor eax, eax
xor ecx, ecx
xor esi, esi
cmp ebx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], edx
jl 0x4d44b0
push edi
mov edi, dword [esp + 0x20]
jmp 0x4d4421
mov ebx, dword [esp + 0x10]
test edx, edx
jne 0x4d4433
cmp ebp, ebx
jge 0x4d4433
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx + ebp]
inc ebp
jmp 0x4d4443
xor bl, bl
inc ebp
test ecx, ecx
mov edx, 1
mov dword [esp + 0x14], ecx
je 0x4d444e
movzx ebx, bl
shl esi, 8
add ecx, 8
or esi, ebx
cmp ecx, 6
jl 0x4d447f
sub ecx, 6
mov ebx, esi
shr ebx, cl
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi], bl
inc eax
cmp eax, 0x3c
jge 0x4d44ab
cmp eax, dword [esp + 0x24]
jge 0x4d4495
test edx, edx
jne 0x4d447d
cmp ecx, 6
jge 0x4d4453
jmp 0x4d447f
xor ecx, ecx
cmp ebp, dword [esp + 0x10]
jle 0x4d441d
mov ecx, dword [esp + 0x14]
cmp ecx, 2
jne 0x4d449d
mov byte [eax + edi], 0x3d
inc eax
jmp 0x4d44a2
or eax, 0xffffffff
or ebp, 0xffffffff
jmp 0x4d44af
cmp ecx, 4
jne 0x4d44a7
mov byte [eax + edi], 0x3d
inc eax
test eax, eax
je 0x4d44af
mov byte [eax + edi], 0
pop edi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop esi
mov dword [ecx], ebp
pop ebp
mov dword [edx], eax
pop ebx
add esp, 0xc
ret 0x10
Function at 0x4d49a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x400
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
mov edi, ecx
push eax
xor ebx, ebx
push edi
mov dword [esp + 0x28], edx
mov byte [edx], bl
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x4d49d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
push ebp
push esi
call fcn.005635a3
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x4d4aa2
mov ecx, dword [esp + 0x20]
push ebp
push esi
push ecx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4d4a99
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
push str.VarFileInfoTranslation
push ebp
mov dword [esp + 0x20], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4d4a99
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4d4a99
mov ecx, dword [esp + 0x10]
shr ecx, 2
xor esi, esi
test ecx, ecx
jle 0x4d4a99
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x4d4a40
mov eax, dword [esp + 0x1c]
jmp 0x4d4a40
movzx edx, word [eax + esi*4 + 2]
movzx eax, word [eax + esi*4]
push edx
push eax
lea ecx, [esp + 0x30]
push str.StringFileInfo_04x_04xFileVersion
push ecx
call edi
add esp, 0x10
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4d4a8d
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4d4a8d
cmp byte [eax], bl
je 0x4d4a8d
cmp dword [esp + 0x14], ebx
jne 0x4d4aaf
mov edx, dword [esp + 0x10]
inc esi
shr edx, 2
cmp esi, edx
jl 0x4d4a37
push ebp
call fcn.005635b5
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x400
ret
mov edx, dword [esp + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4d4ab5
push ebp
call fcn.005635b5
add esp, 4
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x400
ret
Function at 0x4d4c20
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
mov eax, dword [0x5990c4]
test eax, eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push edi
je 0x4d4c40
push 0x46
push eax
call esi
mov dword [0x5990a0], eax
mov eax, dword [0x5990c4]
mov ecx, dword [0x5990a0]
test ecx, ecx
jne 0x4d4c5e
mov eax, dword [0x5a1afc]
push 0x46
push eax
call esi
mov dword [0x5990a0], eax
mov eax, dword [0x5990c4]
test eax, eax
je 0x4d4c6c
push 0x47
push eax
call esi
mov dword [0x5990a4], eax
mov eax, dword [0x5990a4]
test eax, eax
jne 0x4d4c85
mov ecx, dword [0x5a1afc]
push 0x47
push ecx
call esi
mov dword [0x5990a4], eax
mov edx, dword [0x5a1b00]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push edx
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
mov eax, dword [0x5a1afc]
push eax
push 0x4929e0
push 2
call edi
mov ecx, dword [0x5a1b00]
push 0
push ecx
mov dword [0x59777c], eax
call esi
mov edx, dword [0x5a1afc]
push eax
push edx
push 0x4938b0
push 3
call edi
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push str.MSWHEEL_ROLLMSG
mov dword [0x597788], eax
call esi
push str.TaskbarCreated
mov dword [0x5990d4], eax
call esi
pop edi
mov dword [0x5990d8], eax
pop esi
ret