joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b53e1
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, ecx
cmp dword [esi + 0x34], 2
jne 0x4b5449
lea ecx, [esi + 0x28]
call fcn.004a0ff9
push eax
lea eax, [ebp - 4]
push 0x530074
push eax
call fcn.004a1618
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4b5437
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x30], eax
jmp 0x4b543f
and dword [esi + 0x2c], 0
and dword [esi + 0x30], 0
lea ecx, [ebp - 4]
call fcn.004a0c7d
jmp 0x4b5451
and dword [esi + 0x2c], 0
and dword [esi + 0x30], 0
pop esi
leave
ret

Function at 0x4b5454
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push esi
mov esi, ecx
cmp dword [esi + 0x34], 2
jne 0x4b546e
xor eax, eax
inc eax
jmp 0x4b5555
push ebx
movzx ebx, word [ebp + 8]
push ebx
lea eax, [ebp - 4]
push 0x53008c
push eax
call fcn.004a1618
push ebx
lea eax, [ebp + 8]
push 0x530080
push eax
call fcn.004a1618
add esp, 0x18
mov eax, 0x104
push eax
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp + 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop ebx
test eax, eax
je 0x4b553d
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x1c]
call fcn.004a101e
mov ecx, dword [ebp + 0xc]
call fcn.004a0ff9
push eax
lea ecx, [esi + 0x20]
call fcn.004a101e
mov ecx, dword [ebp + 0x10]
call fcn.004a0ff9
push eax
lea ecx, [esi + 0x24]
call fcn.004a101e
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea ecx, [esi + 0x28]
call fcn.004a101e
mov ecx, esi
mov dword [esi + 0x34], 2
call fcn.004b53e1
push 7
push esi
call fcn.0043a9b2
mov ecx, eax
call fcn.0043a8c0
lea ecx, [ebp + 8]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
jmp 0x4b5466
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp + 8]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
xor eax, eax
pop esi
leave
ret 0xc
Function at 0x4b55ae
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push 0x41
pop eax
push 0x3a
mov word [ebp - 8], ax
pop eax
mov word [ebp - 6], ax
push 0x5c
pop eax
mov word [ebp - 4], ax
xor eax, eax
mov word [ebp - 2], ax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, eax
xor esi, esi
test ebx, ebx
jne 0x4b55f2
lea ecx, [ebp + 8]
call fcn.004a0c7d
mov eax, esi
pop esi
pop ebx
leave
ret 8
test bl, 1
je 0x4b564e
lea eax, [esi + 0x41]
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x4b564e
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
test eax, eax
je 0x4b564e
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xc]
call fcn.004a0fd9
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.004082d7
test al, al
jne 0x4b565a
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
shr ebx, 1
inc esi
cmp esi, 0x1a
jl 0x4b55f2
xor esi, esi
jmp 0x4b55e2
mov cx, word [ebp - 8]
mov eax, dword [ebp + 0xc]
mov word [eax], cx
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
xor esi, esi
inc esi
jmp 0x4b55e2
Function at 0x4b659c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x88e208], ecx
xor ecx, ecx
inc ecx
mov eax, 0x88e208
push esi
mov edx, dword [eax]
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, ecx
mov dword [eax + 4], esi
add eax, 4
inc ecx
cmp eax, 0x88ebc4
jl 0x4b65ab
mov dword [0x559d1c], ecx
pop esi
ret

Function at 0x4b668f
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [0x559d1c]
cmp eax, 0x270
jl 0x4b674e
push esi
push edi
xor edx, edx
mov esi, 0x7fffffff
mov ecx, edx
shl ecx, 2
mov eax, dword [ecx + 0x88e20c]
xor eax, dword [ecx + 0x88e208]
and eax, esi
xor eax, dword [ecx + 0x88e208]
mov edi, eax
shr eax, 1
and edi, 1
xor eax, dword [edi*4 + 0x559d20]
xor eax, dword [ecx + 0x88e83c]
inc edx
cmp edx, 0xe3
mov dword [ecx + 0x88e208], eax
jl 0x4b66a8
cmp edx, 0x26f
jge 0x4b6720
lea ecx, [edx*4 + 0x88e208]
mov eax, dword [ecx]
lea edx, [ecx + 4]
xor eax, dword [edx]
and eax, esi
xor eax, dword [ecx]
mov edi, eax
and edi, 1
mov edi, dword [edi*4 + 0x559d20]
xor edi, dword [edx - 0x390]
shr eax, 1
xor edi, eax
mov dword [ecx], edi
mov ecx, edx
cmp ecx, 0x88ebc4
jl 0x4b66f3
mov ecx, dword [0x88ebc4]
mov eax, dword [0x88e208]
xor eax, ecx
and eax, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
xor eax, dword [ecx*4 + 0x559d20]
pop edi
xor eax, dword [0x88e838]
pop esi
mov dword [0x88ebc4], eax
xor eax, eax
mov ecx, dword [eax*4 + 0x88e208]
inc eax
mov dword [0x559d1c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x4b6dc0
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x4b764e
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xc0
mov eax, dword [ebp + 0x78]
and dword [eax], 0
push ebx
push esi
push dword [ebp + 0x7c]
mov esi, edx
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], ecx
call fcn.004b93d7
mov ebx, eax
test ebx, ebx
je 0x4b777a
cmp byte [ebx], 0x64
push edi
jne 0x4b7777
cmp dword [esi], 0x39
jb 0x4b7777
push 0x11
pop ecx
mov edi, 0x5310f0
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4b76b2
push 0x11
pop ecx
mov edi, 0x5310dc
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4b7777
push 0xa
pop ecx
lea esi, [ebx + 0x11]
lea edi, [ebp + 0x28]
rep movsd dword es:[edi], dword [esi]
push 1
push 0x28
lea edx, [ebp + 0x28]
lea ecx, [ebp + 0x54]
mov byte [ebp + 0x50], 0
call fcn.00428acd
test al, al
jne 0x4b76db
mov eax, 0x5310bc
jmp 0x4b7738
mov esi, dword [ebp + 0x68]
add dword [esi], 0xffffffc8
mov eax, dword [esi]
dec eax
push eax
lea eax, [ebx + 0x39]
push eax
lea eax, [ebx + 1]
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
lea ecx, [ebp - 0x50]
call fcn.00501c46
push dword [esi]
lea ecx, [ebp - 0x50]
push ebx
call fcn.00502f43
push 5
mov edi, eax
pop ecx
lea esi, [ebp + 0x54]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4b772b
push dword [ebp + 0x6c]
call fcn.00466ca2
add esp, 4
lea ecx, [ebp - 0x50]
call fcn.00501c70
jmp 0x4b7777
lea ecx, [ebp - 0x50]
call fcn.00501c70
mov eax, 0x531094
push dword [ebp + 0x6c]
push eax
push 0x531038
call fcn.004263e6
push 0x530fb8
call fcn.004263e6
mov ecx, dword [ebp + 0x6c]
add esp, 0x10
mov edx, 0x530fac
call fcn.004b7368
push 0
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp + 0x78]
call fcn.004a0cb3
mov eax, ebx
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x4b7926
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push esi
push edi
mov esi, edx
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4b795b
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x4b7941
inc ecx
cmp dword [esp + 0x14], 0
je 0x4b794b
or ecx, 2
test eax, ecx
je 0x4b795b
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
pop esi
ret 0xc

Function at 0x4b7c53
Capabilities:
Get common file path

Disassembly:
cmp byte [0x88f8a3], 0
je 0x4b7c93
cmp byte [0x88f7d0], 0
je 0x4b7c7e
mov ecx, dword [0x88f8ac]
call fcn.004b82dc
test al, al
je 0x4b7c7e
mov ecx, 0x88f8ac
call fcn.004b7b38
mov ecx, dword [0x88f8ac]
test ecx, ecx
je 0x4b7c93
cmp word [ecx], 0
sete al
test al, al
je 0x4b7c98
jmp fcn.00482281
jmp fcn.0042876e
Function at 0x4b8147
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
push edi
push 0x53191c
push 0x51497c
mov edi, edx
mov dword [ebp - 8], ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
test eax, eax
je 0x4b8207
push dword [0x88c8e0]
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
push eax
push edi
push 0x531908
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0049f973
push edi
push 0x5312cc
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0049f973
add esp, 0x28
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push 0
push 2
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call dword [ebp - 4]
mov esi, eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4b8207
push 4
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
leave
ret

Function at 0x4b8d06
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x180
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, 0x52efb4
mov ecx, 0x52efa8
stosd dword es:[edi], eax
call fcn.004b878f
or ecx, 0xffffffff
test eax, eax
je 0x4b8d4d
lea ecx, [ebp + 0x60]
push ecx
call eax
mov ecx, eax
test ecx, ecx
jne 0x4b8d4d
lea esi, [ebp + 0x6a]
lea edi, [ebx + 4]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4b8d5a
push ecx
push 0x53199c
call fcn.004263aa
pop ecx
pop ecx
xor edi, edi
push edi
push edi
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
lea eax, [ebx + 0xa]
push eax
push edi
push edi
push 0x531998
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea ecx, [ebp - 0x108]
call fcn.00501c46
push 0xe
push ebx
lea ecx, [ebp - 0x108]
call fcn.00502f43
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00501c46
push 0xa
push esi
lea ecx, [ebp - 0x18]
call fcn.00502f43
lea esi, [ebx + 4]
push eax
mov ecx, esi
call fcn.004ba47e
lea ecx, [ebp - 0x90]
call fcn.00501c46
push 4
push ebx
lea ecx, [ebp - 0x90]
call fcn.00502f43
xor ecx, ecx
mov edx, dword [ecx + eax]
add dword [esi + ecx], edx
add ecx, 4
cmp ecx, 0x14
jne 0x4b8dcb
lea ecx, [ebp - 0x90]
call fcn.00501c70
lea ecx, [ebp - 0x18]
call fcn.00501c70
lea ecx, [ebp - 0x108]
call fcn.00501c70
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x4b900f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x43c
push ebx
push esi
push edi
push 0x21c
lea eax, [ebp - 0x43c]
push eax
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebx, eax
call fcn.004b8fc2
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
test al, al
je 0x4b907e
mov eax, 0x5319e0
lea edx, [ebp + ebx*2 - 0x43c]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x4b9051
push 1
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x43c]
push eax
push edi
push edi
call esi
xor ecx, ecx
cmp eax, 0x20
setle cl
mov eax, ecx
cmp eax, edi
je 0x4b90b5
mov eax, 0x5319c4
lea edx, [ebp + ebx*2 - 0x43c]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x4b908c
push 1
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x43c]
push eax
push edi
push edi
call esi
xor ecx, ecx
cmp eax, 0x20
setle cl
mov eax, ecx
xor ecx, ecx
cmp eax, edi
pop edi
sete cl
pop esi
mov al, cl
pop ebx
leave
ret

Function at 0x4b91a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
mov esi, ecx
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x4b91e4
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x531a18
call fcn.004263aa
add esp, 0xc
push 0x512d58
jmp 0x4b91e8
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.004a0fd9
mov eax, esi
pop esi
leave
ret

Function at 0x4b9462
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, ecx
call fcn.00482110
movzx ebx, al
mov eax, 0x517834
test ebx, ebx
je 0x4b948d
mov eax, 0x531a90
push eax
push edi
push 0x510a5c
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0049f973
add esp, 0x14
push 0
push 0x80
push 7
pop edx
lea ecx, [ebp - 0x210]
call fcn.00482361
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b94c8
xor al, al
jmp 0x4b9530
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.004b8410
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp ebx, esi
je 0x4b951b
mov edx, edi
lea ecx, [ebp - 0x210]
call fcn.004b8147
movzx eax, al
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x4b951b
push esi
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 8], esi
jne 0x4b952e
cmp dword [ebp - 4], esi
jne 0x4b9529
cmp ebx, esi
jne 0x4b952e
xor eax, eax
inc eax
jmp 0x4b9530
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4b9537
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4b9545
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [edi + 1]
test eax, eax
js 0x4b9569
lea eax, [edi + edi + 2]
call fcn.00401000
mov esi, esp
jmp 0x4b957c
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [0x89444c], eax
mov dword [0], esi
lea eax, [edi + edi + 2]
push eax
push ebx
push esi
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0x5c
pop ebx
cmp word [esi], bx
jne 0x4b95ae
cmp word [esi + 2], bx
jne 0x4b95ae
lea eax, [esi + 4]
cmp word [eax], 0x3f
jne 0x4b95c1
cmp word [esi + 6], bx
jne 0x4b95c1
add esi, 8
cmp edi, 3
jl 0x4b95bd
cmp word [esi + 2], 0x3a
jne 0x4b95bd
add esi, 6
mov ecx, esi
jmp 0x4b9607
push 2
pop ecx
mov esi, eax
movzx eax, word [esi]
inc esi
inc esi
cmp ax, bx
jne 0x4b95d3
dec ecx
je 0x4b95bd
test ax, ax
jne 0x4b95c6
xor al, al
jmp 0x4b9616
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4b95f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b95d8
cmp word [esi], 0
mov eax, ebx
mov word [esi - 2], ax
je 0x4b9614
lea ecx, [esi + 2]
mov edx, ebx
call fcn.00428816
mov esi, eax
test esi, esi
jne 0x4b95dc
mov al, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4b9a44
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push 0
mov esi, edx
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4b9a5a
xor al, al
jmp 0x4b9aaa
push edi
add esi, esi
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
xor ecx, ecx
push ebx
push eax
mov word [esi + eax], cx
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4bc9f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
lea esi, [ebx + 0x2c]
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 8]
call fcn.00482110
test al, al
jne 0x4bca21
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
jmp 0x4bcb34
push edi
xor eax, eax
lea edi, [ebx + 8]
mov ecx, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
call fcn.004a0ff9
push eax
lea ecx, [ebp - 0x18]
call fcn.004a02d0
push 0x5320d4
lea ecx, [ebp - 0x18]
call fcn.004a02d0
lea ecx, [ebp - 8]
call fcn.004a0e93
lea ecx, [ebp - 0x18]
call fcn.004a04df
push eax
lea ecx, [ebp - 8]
call fcn.004a0c86
mov ecx, ebx
call fcn.004bc80b
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
mov ecx, edi
call fcn.004a0ff9
push eax
call fcn.00466ca2
add esp, 8
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
mov ecx, edi
call fcn.004a0ff9
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
test eax, eax
mov ecx, edi
setne byte [ebp - 1]
call fcn.004a0ff9
push eax
push dword [ebp + 8]
call fcn.00466ca2
add esp, 8
mov ecx, edi
call fcn.004a0ff9
push eax
push dword [ebp + 8]
call esi
test eax, eax
setne byte [ebp + 0xb]
cmp byte [ebp + 0xb], 0
jne 0x4bcb03
cmp byte [ebp - 1], 0
je 0x4bcb03
mov ecx, edi
call fcn.004a0ff9
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
call fcn.00466ca2
add esp, 8
mov ecx, edi
call fcn.004a0ff9
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
call esi
mov ecx, ebx
call fcn.004bc82e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 1], 0
pop edi
je 0x4bcb29
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 8]
call fcn.004a0c7d
mov al, byte [ebp + 0xb]
pop esi
pop ebx
leave
ret 4

Function at 0x4bd9f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
push 0x27
movsx ebx, ax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
cwde
mov dword [ebp - 4], eax
jne 0x4bda6e
test bl, 1
je 0x4bda3e
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.004bd32d
test byte [ebp - 8], 1
je 0x4bda4f
push 0
push 1
mov ecx, edi
call fcn.004bd32d
test byte [ebp - 0xc], 1
je 0x4bda5e
push 1
mov ecx, edi
call fcn.004bd2f4
test byte [ebp - 4], 1
jne 0x4bda6a
cmp dword [ebp - 4], 0
jge 0x4bda6e
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x4bda88
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x4bda88
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.004bd95f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4be2b8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call fcn.004b850a
push dword [esi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x2c], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10]
mov edi, eax
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x24]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esi + 0xec], 0
je 0x4be34f
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x4be32b
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x4be32b
xor byte [esi + 0x10a], 1
lea ecx, [esi + 0xf4]
call fcn.004bd9f8
mov ecx, dword [esi + 0x10c]
lea eax, [esi + 0xf0]
cmp ecx, dword [eax]
je 0x4be34f
mov dword [eax], ecx
mov ecx, esi
call fcn.004bdd4d
pop edi
pop esi
leave
ret 4

Function at 0x4be592
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x88f2d0]
test eax, eax
je 0x4be5a5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x1b0
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4be5c0
mov ecx, eax
call fcn.004be52e
mov esi, eax
jmp 0x4be5c2
xor esi, esi
push 0
push 0x1e
mov ecx, esi
call fcn.00476bc9
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x4beb70
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0x51a358
call fcn.0049e604
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4bebf1
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4bebf1
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4bebeb
push 4
push 0x510208
push esi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x4bebcd
push 4
push 0x5101c8
push esi
call sub.msvcrt.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4bebeb
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4bebd2
sub eax, edx
cmp eax, 0x12c
jae 0x4bebeb
mov ecx, esi
call fcn.0049e604
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0xffffffffffffffff
push edi
call fcn.004beb07
pop edi
pop esi
ret

Function at 0x4c05e6
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0xa4
mov esi, edx
mov edi, ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4c0610
push dword [esp + 0x10]
mov ecx, eax
push dword [esp + 0x10]
push esi
push edi
call fcn.004c050c
mov esi, eax
jmp 0x4c0612
xor esi, esi
mov al, byte [esp + 0x14]
push 0
push 0x29
mov ecx, esi
mov byte [esi + 0x87], al
call fcn.00476bc9
mov eax, dword [esi]
push 0x88faec
mov ecx, esi
call dword [eax + 0x40]
push 0x88faf4
mov ecx, esi
call fcn.004769bb
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 0xc
Function at 0x4c0ce0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x38
mov edi, ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4c0d00
push edi
mov ecx, eax
call fcn.004c0c00
mov ecx, eax
jmp 0x4c0d02
xor ecx, ecx
push 0
push 0x134
mov dword [0x88f3d0], ecx
call fcn.00476bc9
push 0
push dword [0x890598]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov eax, dword [0x88f3d0]
push 5
push dword [eax + 4]
call esi
mov eax, dword [0x88f3d0]
push 3
push dword [eax + 4]
call esi
mov eax, dword [edi]
push 0x512da8
lea ecx, [eax + 0x24]
call fcn.004a0ff9
push eax
lea eax, [ebp - 4]
push 0x532894
push eax
call fcn.004a1618
mov eax, dword [0x88f3d0]
mov esi, dword [eax + 4]
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x88f3d0]
mov esi, dword [eax + 0x30]
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x4c1b01
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x4c1b2c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4c1b28
mov byte [ebp - 4], 1
test al, 0x10
jne 0x4c1b2c
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0047622a
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0047622a
pop esi
leave
ret 4
Function at 0x4c8528
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x44]
call fcn.004a101e
or dword [esi + 0x48], 0xffffffff
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x2c]
call fcn.004c82bf
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
pop esi
test eax, eax
je 0x4c856f
push 0
push 0
push 0x806f
push dword [0x890598]
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x4c891b
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.004c86d5
test al, al
je 0x4c8932
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4