joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cf94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48d1f4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x48cff7
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0048ca5c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040ccc4
cmp al, 1
jne 0x48cff7
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0048cd74
test al, al
je 0x48d183
cmp dword [ebp - 8], 0
jge 0x48d015
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0048ca5c
mov eax, dword [ebp - 0x210]
call fcn.00404878
cmp ebx, eax
jge 0x48d05f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0048ca5c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4c8f50]
and eax, 0xff
bt dword [edx], eax
jae 0x48d05f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x48d073
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0048cf70
cmp ebx, dword [ebp - 8]
je 0x48d175
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x48d09f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040398c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c73b8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x48d162
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040398c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c73b8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0044edac
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040398c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c73b8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0044edac
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d169
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x48d1d6
cmp dword [ebp - 8], 0
jge 0x48d18e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0048ca5c
mov eax, dword [ebp - 0x218]
call fcn.00404878
cmp eax, dword [ebp - 8]
jg 0x48d1c8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0048ca5c
mov eax, dword [ebp - 0x21c]
call fcn.00404878
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0048cf70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d1fb
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004045e4
ret
Function at 0x495dcc
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x495eed
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
mov edx, dword [0x4c8e34]
mov dword [edx], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x4c8e34]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x495f04
call fcn.00409aac
mov eax, dword [ebp - 4]
call fcn.004aac30
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4c8be4]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [0x4c8df4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x495f20
call fcn.00409aac
mov eax, dword [ebp - 0x10]
call fcn.004aac30
call sub.kernel32.dll_GetCurrentThreadId_1
mov esi, eax
push esi
push 0
push 0x495af8
push 5
call sub.user32.dll_SetWindowsHookExA
mov dword [ebx + 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x495f40
call fcn.00409aac
mov eax, dword [ebp - 0x24]
call fcn.004aac30
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x495f58
call fcn.00409aac
mov eax, dword [ebp - 0x28]
call fcn.004aac30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495ef4
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004045e4
lea eax, [ebp - 0x10]
call fcn.004045c0
lea eax, [ebp - 4]
call fcn.004045c0
ret

Function at 0x49cdc0
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x4c]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x49ce0e
mov edx, dword [ebx + 0x48]
cmp dword [edx + 0x140], 0
je 0x49ce0e
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x140]
mov eax, dword [eax + 0x14]
jmp 0x49ce1e
mov edx, dword [ebx + 0x48]
mov edx, dword [edx + 0x13c]
test edx, edx
je 0x49ce1e
mov eax, dword [edx + 0x14]
test eax, eax
je 0x49ce37
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.0049a7bc
jmp 0x49ce7a
mov edx, dword [edi + 0x10]
mov eax, dword [ebx + 0x34]
call fcn.0042a23c
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x14]
call fcn.00429888
mov esi, eax
mov eax, dword [ebx + 0x48]
mov edx, dword [eax + 0xa8]
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.00429590
mov edx, esp
mov eax, dword [ebx + 0x34]
call fcn.00429e0c
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
mov edx, esi
call fcn.00429590
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4a1d20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov edi, edx
mov ebp, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00460470
mov ebx, eax
mov dx, word [edi + 4]
mov eax, ebp
call fcn.004a1bcc
mov esi, eax
test esi, esi
je 0x4a1d6d
mov al, byte [0x4a1d80]
cmp al, bl
jne 0x4a1d6d
mov edx, esi
mov eax, ebp
call fcn.004a1b74
mov dword [edi + 0xc], 1
mov byte [ebp + 0x31], 1
jmp 0x4a1d75
mov edx, edi
mov eax, dword [ebp + 0x3c]
call dword [ebp + 0x38]
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a4e24
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00409530
add esp, 0x3ec
pop ebx
ret

Function at 0x4a6210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
mov eax, dword [ebx + 0xf4]
mov eax, dword [eax + 0x34]
call fcn.0045a3a8
mov edi, eax
dec edi
test edi, edi
jl 0x4a62c3
inc edi
xor esi, esi
mov eax, dword [ebx + 0xf4]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045a3b8
mov eax, dword [eax + 0xc]
sub eax, 1
jb 0x4a625a
je 0x4a627b
dec eax
je 0x4a629c
jmp 0x4a62bb
mov eax, dword [ebx + 0xf4]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045a3b8
cmp byte [ebx + 0x164], 0
setne dl
call fcn.0045a2d4
jmp 0x4a62bb
mov eax, dword [ebx + 0xf4]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045a3b8
cmp byte [ebx + 0x164], 1
setne dl
call fcn.0045a2d4
jmp 0x4a62bb
mov eax, dword [ebx + 0xf4]
mov eax, dword [eax + 0x34]
mov edx, esi
call fcn.0045a3b8
cmp byte [ebx + 0x164], 2
setne dl
call fcn.0045a2d4
inc esi
dec edi
jne 0x4a623b
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x88]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x8c]
cdq
cmp edx, dword [esp + 4]
jne 0x4a62e8
cmp eax, dword [esp]
pop edx
pop eax
jae 0x4a6349
jmp 0x4a62ec
pop edx
pop eax
jge 0x4a6349
mov esi, 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x88], eax
mov eax, dword [ebx + 0x138]
test byte [eax + 0x50], 2
je 0x4a6325
cmp byte [ebx + 0x161], 2
je 0x4a6325
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov eax, dword [ebx + 0xf4]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x4a636e
push 0
mov eax, dword [ebx + 0x12c]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebx + 0x104]
push eax
call sub.user32.dll_TrackPopupMenu
jmp 0x4a636e
cmp dword [ebx + 0x11c], 0
je 0x4a636e
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0043f83c
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4af54c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4af6bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x88], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4af6a2
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409530
mov dl, 1
mov eax, dword [0x46e5c4]
call fcn.0046e61c
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x41b7cc]
call fcn.00403760
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.0046e698
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4af69f
mov dl, 1
mov eax, dword [0x46f044]
call fcn.0046f0ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, 0x4af6d4
call fcn.0046e9e4
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004048c4
xor eax, eax
push ebp
push 0x4af698
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x10]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x40]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.0046f3ac
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004af6dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af69f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
call fcn.00403790
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
call fcn.00403790
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
call fcn.00403790
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af6c4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004045e4
ret
Function at 0x4c0258
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4c02f6
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4c7990]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4c7990]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4c7990]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4c7990]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4c0277
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4c030c
dec edx
je 0x4c0341
jmp 0x4c0392
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4c7990]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4c7990]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4c0392
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4c7990]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4c7990]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4c7990]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c03f4
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4c0413
add edx, 3
sar edx, 2
test edx, edx
jle 0x4c0520
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4c0449
je 0x4c0489
sub ecx, 0x2b
je 0x4c047f
sub ecx, 4
je 0x4c0484
dec ecx
sub ecx, 0xa
jb 0x4c0472
jmp 0x4c048c
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4c045b
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4c0465
jmp 0x4c048c
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4c048c
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4c048c
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4c048c
mov byte [eax], 0x3e
jmp 0x4c048c
mov byte [eax], 0x3f
jmp 0x4c048c
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4c042b
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x4c04dd
cmp byte [esp + 7], 0xff
jne 0x4c04dd
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4c0515
cmp dl, 0xff
je 0x4c0515
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4c0422
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4c26a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4c26ce
mov ecx, 0x4c272c
mov dl, 1
mov eax, dword [0x4c1d0c]
call fcn.0040c3d8
call fcn.00403f5c
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4c271b
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402980
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4c26de
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c2744
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4c276e
mov ecx, 0x4c27d4
mov dl, 1
mov eax, dword [0x4c1d0c]
call fcn.0040c3d8
call fcn.00403f5c
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4c27c3
mov dword [ebp - 0x10], eax
mov al, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
mov al, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402980
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4c2780
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c2d8c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c2e0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c2030]
mov eax, 0x14
call fcn.004053f4
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408894
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.00404614
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4c9f7c]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4c9f7c], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2e15
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045e4
ret
Function at 0x4c2e1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4c2e98
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4c2058]
mov eax, 0x10
call fcn.004053f4
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408894
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00404614
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x4c9f80]
mov dword [ebx], eax
mov dword [0x4c9f80], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2e9f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045e4
ret

Function at 0x4c2ef4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4c2f14
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4c2f02
pop edi
pop esi
pop ebx
ret
Function at 0x4c4c50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c4d07
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404a70
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4c4c92
call fcn.00404008
jmp 0x4c4d0e
mov eax, ebx
call fcn.00402784
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404a70
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4c4cbb
call fcn.00404008
jmp 0x4c4d0e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c4d18
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4c4cdc
call fcn.00404008
jmp 0x4c4d0e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4d0e
mov eax, dword [ebp - 8]
call fcn.004027a4
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
sub ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40b003
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x423bf0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x424100]
je 0x40b038
inc eax
cmp eax, 0x13
jb 0x40b029
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x424100]
jne 0x40b15e
mov eax, dword [0x42694c]
cmp eax, 1
je 0x40b136
cmp eax, edx
jne 0x40b068
cmp dword [0x423bec], 1
je 0x40b136
cmp ecx, 0xfc
je 0x40b15e
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b09e
lea eax, [ebp - 0x80]
push 0x41ed94
push eax
call fcn.00409450
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00406350
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40b0d2
mov eax, edi
push eax
call fcn.00406350
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x41ed90
push edi
call fcn.0040eb00
add esp, 0x10
push edi
call fcn.00406350
push dword [esi + 0x424104]
mov ebx, eax
call fcn.00406350
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00405030
mov ebx, esp
push 0x41ed74
push ebx
call fcn.00409450
push edi
push ebx
call fcn.00409460
push 0x41ed70
push ebx
call fcn.00409460
push dword [esi + 0x424104]
push ebx
call fcn.00409460
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040ea01
add esp, 0x2c
jmp 0x40b15e
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x424104]
push dword [esi]
call fcn.00406350
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040633e
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x4c5370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4c538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x4ee074
push ecx
mov edi, eax
call fcn.004d9198
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c53cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.004d902e
push esi
call fcn.004d8fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret