joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x46437a
cmp dword [ebx + 0x64], 0
jne 0x46437a
cmp dword [ebx + 0x6c], 0
jne 0x46437a
mov esi, edi
jmp 0x464408
cmp esi, 0xffffffff
jne 0x464385
dec esi
jmp 0x464408
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x464408
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.00460198
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x4643d0
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x4643d5
mov word [edx], 0
dec eax
test eax, eax
jne 0x4643b6
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x4643fc
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x464401
mov word [edx], 0
dec eax
test eax, eax
jne 0x4643e2
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x464466
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.004640e4
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x464451
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x464466
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x46435a
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.004683a0
mov ebx, eax
mov eax, esi
call fcn.004680d8
mov edi, eax
dec edi
test edi, edi
jl 0x4681b6
inc edi
mov eax, dword [esi + 8]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, ebx
xor ecx, ecx
call fcn.00403034
add ebx, dword [esi + 8]
dec edi
jne 0x46819d
pop edi
pop esi
pop ebx
ret
Function at 0x46ca14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov edi, eax
mov eax, dword [0x4cde78]
mov eax, dword [eax]
cmp byte [eax + 0x9d], 0
jne 0x46ca69
mov eax, dword [0x46cca0]
mov dword [edi + 0x338], eax
mov eax, dword [0x46cca0]
mov dword [edi + 0x33c], eax
mov eax, dword [0x46cca0]
mov dword [edi + 0x340], eax
mov eax, dword [0x46cca0]
mov dword [edi + 0x344], eax
mov eax, dword [0x46cca0]
mov dword [edi + 0x348], eax
jmp 0x46cc95
mov ebp, dword [edi + 0x338]
mov eax, dword [0x46cca0]
mov dword [edi + 0x338], eax
mov eax, esp
xor ecx, ecx
mov edx, 0x10
call fcn.00403034
cmp byte [edi + 0x36c], 0
jne 0x46cba9
push esp
mov eax, dword [edi + 4]
push eax
jmp 0x4e7d75
push 0x12
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x46cc01
xor ebx, ebx
xor esi, esi
xor eax, eax
mov al, bl
shl eax, 2
lea eax, [edi + eax*8]
mov eax, dword [eax + esi*4 + 0xc]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x46cbf5
mov edx, ebx
lea eax, [esp + 0x10]
mov cl, 4
call fcn.00403280
mov eax, dword [esp + 0x10]
or eax, dword [edi + 0x338]
mov dword [edi + 0x338], eax
inc esi
cmp esi, 8
jne 0x46cbbc
inc ebx
cmp bl, 0x19
jne 0x46cbba
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x46cc21
mov eax, dword [0x46ccc0]
or eax, dword [edi + 0x338]
mov dword [edi + 0x338], eax
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x46cc41
mov eax, dword [0x46ccc4]
or eax, dword [edi + 0x338]
mov dword [edi + 0x338], eax
push 0x10
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x46cc61
mov eax, dword [0x46ccbc]
or eax, dword [edi + 0x338]
mov dword [edi + 0x338], eax
push 0x11
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x46cc81
mov eax, dword [0x46ccc8]
or eax, dword [edi + 0x338]
mov dword [edi + 0x338], eax
not ebp
and ebp, dword [edi + 0x338]
or ebp, dword [edi + 0x33c]
mov dword [edi + 0x33c], ebp
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x46f954
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
test dl, dl
je 0x46f971
add esp, 0xfffffff0
call fcn.00403ac4
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x46fb21
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x46fb48
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
mov dword [edi + 4], esi
test esi, esi
jne 0x46f9b7
lea edx, [ebp - 0x2c]
mov eax, 0x46f76c
call fcn.0040672c
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x46f54c]
call fcn.0040c338
call fcn.00403f2c
push 0x46fb54
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov dword [edi + 8], esi
test esi, esi
jne 0x46f9ef
lea edx, [ebp - 0x30]
mov eax, 0x46f76c
call fcn.0040672c
mov ecx, dword [ebp - 0x30]
mov dl, 1
mov eax, dword [0x46f54c]
call fcn.0040c338
call fcn.00403f2c
push 0
lea eax, [edi + 0xc]
push eax
push 0
call dword [edi + 8]
call fcn.0046f844
push 1
call sub.user32.dll_GetDesktopWindow
push eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
call fcn.0046f844
lea eax, [ebp - 0x12]
xor ecx, ecx
mov edx, 0x12
call fcn.00403034
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x14
call fcn.00403034
mov dword [ebp - 0x28], 0x14
mov dword [ebp - 0x24], 0x80ea
mov dword [ebp - 0x20], 0x5622
lea eax, [ebp - 0x12]
mov dword [ebp - 0x18], eax
mov word [ebp - 0x12], 1
mov word [ebp - 0x10], 2
mov dword [ebp - 0xe], 0x5622
mov dword [ebp - 0xa], 0xac44
mov word [ebp - 6], 2
mov word [ebp - 4], 8
mov word [ebp - 2], 0x12
push 0
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.0046f844
push 0xffffd8f0
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
call fcn.0046f844
push 1
push 0
push 0
mov eax, dword [edi + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.0046f844
mov ecx, edi
mov dl, 1
mov eax, dword [0x46f6f8]
call fcn.0046fcc0
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x415098]
call fcn.00403730
mov dword [edi + 0x18], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x42d7bc]
call fcn.0042e52c
mov esi, eax
mov dword [edi + 0x1c], esi
mov eax, esi
mov edx, 0x32
call fcn.0042e6c4
push edi
push 0x46fc8c
mov eax, dword [edi + 0x1c]
call fcn.0042e6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46fb28
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.00404510
ret
Function at 0x472808
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x472971
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404584
mov eax, dword [ebp - 0x10]
call fcn.00472458
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x47285a
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404a3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00472f60
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47292f
xor eax, eax
push ebp
push 0x472928
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00472604
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.004729a0
test al, al
je 0x472906
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.004045dc
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x472906
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.0040499c
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x472900
mov eax, dword [ebp - 0x14]
call fcn.0040499c
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004046dc
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.00472808
dec ebx
cmp ebx, 0xffffffff
jne 0x4728b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47292f
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00472604
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.0040499c
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.004725f0
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472978
lea eax, [ebp - 0x3c]
call fcn.004044ec
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404510
ret

Function at 0x4729a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00403034
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4ce070]
cmp byte [edx + 0xc], 0
je 0x472a04
mov edx, dword [0x4ce064]
cmp dword [edx], 2
jne 0x472a04
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x472a08
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x472ac0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004729a0
test al, al
je 0x472aa2
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004045dc
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x472aa2
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040499c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.0040499c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004046dc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x472a5b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472ac7
lea eax, [ebp - 0x2c]
call fcn.004044ec
lea eax, [ebp - 0xc]
call fcn.004044ec
ret

Function at 0x472ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x472b88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.004729a0
test al, al
je 0x472b6a
mov ecx, dword [ebp - 0x1c]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.004045dc
mov ebx, dword [ebp - 0x20]
dec ebx
test ebx, ebx
jl 0x472b6a
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040499c
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumValueA
mov eax, dword [ebp - 0xc]
call fcn.0040499c
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.004046dc
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x472b23
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472b8f
lea eax, [ebp - 0x2c]
call fcn.004044ec
lea eax, [ebp - 0xc]
call fcn.004044ec
ret
Function at 0x472e74
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047246c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040499c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x472ed2
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4cddf0]
mov dl, 1
mov eax, dword [0x472240]
call fcn.0040c430
call fcn.00403f2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x472edc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040499c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x472f34
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4ce080]
mov dl, 1
mov eax, dword [0x472240]
call fcn.0040c430
call fcn.00403f2c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047249c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47423c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
xor edx, edx
mov dword [ebp - 0x108], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4742ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x108]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404754
mov eax, dword [ebp - 0x108]
mov edx, ebx
call fcn.004741f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4742b2
lea eax, [ebp - 0x108]
call fcn.004044ec
ret
Function at 0x4742b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47436f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.00457f30
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [0x4cde78]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.00457f30
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
cmp dword [ebp - 8], 0
je 0x47432b
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x10c]
mov ecx, 0x104
call fcn.00404754
mov eax, dword [ebp - 0x110]
mov edx, esi
call fcn.004741f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474376
lea eax, [ebp - 0x110]
call fcn.004044ec
lea eax, [ebp - 4]
call fcn.00406244
ret

Function at 0x4934b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4935a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx + 0x24]
mov esi, dword [edi + 0x7c]
mov edx, dword [edi + 0x78]
mov eax, dword [0x4cdb14]
mov eax, dword [eax]
call fcn.0047e020
mov edx, dword [eax + 0x14]
imul edx, esi
mov eax, dword [0x4cdb74]
mov eax, dword [eax]
call fcn.004a4aec
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x78]
mov eax, dword [0x4cdb74]
mov eax, dword [eax]
mov ecx, esi
call fcn.004a4594
mov byte [ebx + 0xc], 3
mov eax, dword [ebx + 0x14]
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [0x4cdcb4]
mov eax, dword [eax]
mov edx, dword [ebx + 0x38]
call fcn.00478514
mov esi, eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x20]
mov ecx, dword [ebx + 0x50]
mov edx, 1
call fcn.004049fc
mov eax, dword [ebp - 4]
push eax
push 0
push 1
mov ecx, 8
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x14]
mov esi, dword [eax]
call dword [esi + 0x38]
mov eax, dword [ebx + 0x30]
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [ebx + 0x24]
mov edx, dword [eax + 0x78]
mov eax, ebx
call fcn.00492c78
mov eax, dword [ebx + 0x1c]
mov edx, dword [eax]
call dword [edx + 0x24]
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x493577
mov byte [eax], 0
mov eax, dword [ebx + 0x24]
xor edx, edx
mov dword [eax + 0x78], edx
mov edx, dword [eax]
call dword [edx + 0x24]
mov dword [ebx + 0x44], 0x1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4935a8
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x4a2904
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, eax
mov ebp, dword [0x4cdd74]
cmp byte [edi + 0xc], 0
jne 0x4a2928
push 0x40240000
push 0
mov eax, edi
call fcn.0048cd48
mov byte [edi + 0xc], 1
mov eax, dword [0x4cdef4]
mov eax, dword [eax]
cmp dword [eax + 0x5c], 0
jle 0x4a2943
mov eax, dword [0x4cdef4]
mov eax, dword [eax]
mov byte [eax + 0xbc], 0
mov eax, dword [ebp]
call fcn.004a6b38
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4a2967
inc ebx
xor esi, esi
mov eax, dword [ebp]
mov edx, esi
call fcn.004a6b90
mov byte [eax + 0x74], 0
inc esi
dec ebx
jne 0x4a2955
mov eax, dword [0x4cdfb4]
mov eax, dword [eax]
call fcn.00475714
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4a2994
inc ebx
xor esi, esi
mov eax, dword [0x4cdfb4]
mov eax, dword [eax]
mov edx, esi
call fcn.004a523c
call fcn.004a507c
inc esi
dec ebx
jne 0x4a297d
mov eax, dword [ebp]
call fcn.004a6b38
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x4a29b9
inc ebx
xor esi, esi
mov eax, dword [ebp]
mov edx, esi
call fcn.004a6b90
mov edx, dword [eax]
call dword [edx + 0x4c]
inc esi
dec ebx
jne 0x4a29a6
mov eax, dword [0x4cdef4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x30]
mov eax, dword [0x4cdb74]
mov eax, dword [eax]
call fcn.004a4b94
mov eax, dword [0x4cdda8]
mov eax, dword [eax]
call fcn.004c3348
push 0
call fcn.004e79f0
jmp 0x4a29e9
mov eax, dword [0x4cdb1c]
mov eax, dword [eax]
call fcn.004bb574
mov eax, dword [0x4cdbbc]
mov eax, dword [eax]
call fcn.004a54d0
mov eax, dword [0x4cdc1c]
mov eax, dword [eax]
call fcn.004a37bc
mov eax, dword [0x4cdef4]
mov eax, dword [eax]
cmp dword [eax + 0x5c], 7
jne 0x4a2a1e
mov byte [edi + 0x1c], 1
mov eax, dword [0x4cdc7c]
mov eax, dword [eax]
cmp byte [eax + 4], 0
je 0x4a2a3f
push 0x40240000
push 0
mov eax, edi
call fcn.0048cdc0
mov byte [edi + 0xc], 0
jmp 0x4a2a63
mov eax, dword [0x4cdd50]
cmp byte [eax], 0
je 0x4a2a63
push 0x78
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
je 0x4a2a63
mov eax, dword [0x4cdc7c]
mov eax, dword [eax]
mov byte [eax + 4], 8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a5410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040498c
xor eax, eax
push ebp
push 0x4a54a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [esi + 0x18]
mov edx, dword [ebp - 4]
call fcn.00404540
mov byte [esi + 0x1c], bl
mov al, byte [ebp + 0x34]
mov byte [esi + 0x1d], al
mov al, byte [ebp + 0x30]
mov byte [esi + 0x1e], al
mov al, byte [ebp + 0x2c]
mov byte [esi + 0x1f], al
mov al, byte [ebp + 0x28]
mov byte [esi + 0x20], al
mov al, byte [ebp + 0x24]
mov byte [esi + 0x22], al
mov al, byte [ebp + 0x20]
mov byte [esi + 0x21], al
mov eax, dword [esi + 0xc]
mov dl, byte [ebp + 0x1c]
mov byte [eax + 0x610], dl
mov al, byte [ebp + 0x18]
mov byte [esi + 0x23], al
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a54ac
lea eax, [ebp - 4]
call fcn.004044ec
ret
Function at 0x4c90dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [0x4cdb24]
call fcn.00471edc
call fcn.00471fbc
mov eax, dword [esi]
mov eax, dword [eax + 0x40]
call fcn.00468180
mov eax, dword [esi]
mov eax, dword [eax + 0x40]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [esi]
call fcn.0046bc2c
mov eax, dword [0x4cdf20]
mov eax, dword [eax]
call fcn.004c4920
mov eax, dword [0x4cdc30]
mov eax, dword [eax]
call fcn.004c88f8
mov eax, dword [0x4cdef4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x28]
mov eax, dword [0x4cdc1c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cdc60]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cdd38]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cde4c]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cdbf4]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cdfcc]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4cdb94]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
mov eax, dword [0x4ce008]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 4]
jmp 0x4c9199
mov eax, dword [esi]
call fcn.0046bd44
push 0x7b
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x4c9192
mov ebx, 0x14
mov eax, dword [esi]
call fcn.0046bd44
dec ebx
jne 0x4c91ad
mov eax, dword [0x4cdcb8]
cmp byte [eax], 0
je 0x4c91ca
mov eax, edi
call fcn.004c91dc
jmp 0x4c91d5
mov eax, dword [0x4cdc7c]
mov eax, dword [eax]
mov byte [eax + 4], 6
pop edi
pop esi
pop ebx
ret

Function at 0x4e7596
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0
push esi
mov edx, esp
push 0x4e6c50
xor ecx, ecx
mov eax, 0x4e75bf
call fcn.00409924
add esp, 8
popal
mov eax, dword [0x4e6c50]
ret
Function at 0x401300
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x878], eax
xor eax, eax
mov ax, word [esi + 0x1c]
mov word [esp + 4], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 6], ax
cmp dword [esi + 0x18], 0x10
jb 0x40133c
mov eax, dword [esi + 4]
jmp 0x40133f
lea eax, [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edx, dword [esi + 0x878]
push 0x10
lea ecx, [esp + 8]
push ecx
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
setne al
pop esi
add esp, 0x10
ret