joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447fd0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
imul esi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x448008
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x447ffd
mov byte [edi + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x44801b
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.004a26d0
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret

Function at 0x448bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x448c08
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x448bfd
cmp dword [edi + 0x7c], ebx
je 0x448c17
call fcn.00448fe0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00448a10
add esp, 0xc
test eax, eax
je 0x448c3d
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push ebp
push 0x84
call fcn.0049b122
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x448c7f
push 0x4000
call fcn.0049b122
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [ebp], eax
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
mov dword [ebp + 0x4c], ebx
cmp eax, ebx
jne 0x448c8b
push ebp
call fcn.0049b045
add esp, 4
pop ebp
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [ebp + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [ebp + 0x64], edx
mov ecx, dword [edi]
mov dword [ebp + 0x60], ecx
mov edx, dword [edi + 0xc]
push esi
mov dword [ebp + 0x68], edx
mov dword [ebp + 0x18], ebx
cmp eax, ebx
jne 0x448cd4
lea esi, [ebp + 4]
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x2c], ebx
call fcn.00447a60
test eax, eax
jne 0x448cd4
mov dword [ebp + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [ebp + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [ebp + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [ebp + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x448cfe
mov cl, byte [edi + 0x39]
mov byte [ebp + 0x80], cl
jmp 0x448d07
mov dl, byte [edi + 0x3f]
mov byte [ebp + 0x80], dl
movzx eax, byte [ebp + 0x6c]
mov esi, dword [esp + 0x20]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [ebp + 0x70]
mov dword [ebp + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [ebp + 0x74], 0x23456789
mov dword [ebp + 0x78], 0x34567890
cmp esi, ebx
je 0x448d44
mov cl, byte [esi]
cmp cl, bl
je 0x448d44
call fcn.004477a0
add esi, 1
jne 0x448d34
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [ebp + 0x3c], eax
mov dword [ebp + 8], ebx
pop esi
mov dword [edi + 0x7c], ebp
pop ebp
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x449140
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push edi
jne 0x4491ff
cmp dword [esi + 4], 0xffffffff
jne 0x4491ff
lea edi, [esi + 0x140]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449175
sub eax, edx
mov al, byte [eax + esi + 0x13f]
cmp al, 0x5c
je 0x4491a1
cmp al, 0x2f
je 0x4491a1
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x449190
mov ax, word [0x6350f8]
mov word [edi], ax
cmp ebp, 1
jne 0x4491c2
push ebp
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4491c2
mov eax, 0x2000000
pop edi
pop ebp
pop ebx
ret 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push ebp
push edx
push ebx
call fcn.00447eb0
add esp, 0x10
test eax, eax
jne 0x4491e4
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
ret 0xc
call fcn.004483c0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop ebp
pop ebx
ret 0xc
pop edi
pop ebp
mov eax, 0x1000000
pop ebx
ret 0xc
Function at 0x4506e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x450702
cmp eax, esi
jge 0x4506fa
mov edx, edi
call fcn.0044ff90
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor eax, eax
cmp dword [edi + 8], eax
jle 0x45072a
lea ecx, [eax - 8]
lea esp, [esp]
mov dl, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], ecx
mov byte [esp + eax + 8], dl
inc eax
cmp dword [edi + 8], 0
jg 0x450710
cmp eax, 4
jge 0x450747
mov esi, dword [edi + 4]
mov edx, dword [edi]
nop
cmp edx, esi
jb 0x450738
xor cl, cl
jmp 0x45073b
mov cl, byte [edx]
inc edx
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jl 0x450730
mov dword [edi], edx
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xb]
movzx edx, byte [esp + 0xa]
movzx esi, ah
movzx eax, al
shl esi, 8
add esi, eax
shl ecx, 8
mov eax, esi
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x450786
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
mov dword [edx + 4], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x4507a5
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx]
pop edi
mov dword [edx + 4], str.read_past_buffer
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x4507bb
mov edx, esi
call fcn.00450090
test eax, eax
je 0x450780
push ebx
mov ebx, dword [edi]
push ebp
mov ebp, dword [edi + 0x10]
push esi
push ebx
push ebp
call fcn.004a26d0
add esp, 0xc
add ebx, esi
add ebp, esi
mov dword [edi + 0x10], ebp
pop ebp
mov dword [edi], ebx
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x45ed30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push edi
push 0x74
mov edi, ecx
push 0
push edi
call fcn.004a0660
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
mov ebx, dword [esi + 0x42c]
add esp, 0xc
mov ecx, esi
call edx
mov ecx, ebx
mov edx, eax
call fcn.00430350
lea ecx, [esp + 8]
push ecx
push 0x3c
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ebx, dword [esi + 0x428]
mov ecx, esi
call eax
cmp byte [eax + 0x13d], 0
je 0x45ed96
test ebx, 0xffffff
jne 0x45ed96
inc ebx
mov ecx, ebx
shr ecx, 8
movzx edx, cl
movzx eax, bl
shl eax, 8
or edx, eax
shr ebx, 0x10
movzx ecx, bl
shl edx, 8
or edx, ecx
mov dword [edi], 0x74
mov dword [edi + 0x14], edx
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
mov ecx, esi
call eax
mov eax, dword [eax + 0x78]
push 0x5a
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, eax
mov eax, dword [esp + 8]
imul eax, eax, 0xfffffa60
cdq
idiv ecx
cmp dword [esp + 0x18], 0x2bc
mov dword [edi + 0x10], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0xf8000007
mov dword [edi + 0xc], eax
jl 0x45ee07
mov dword [edi + 8], 1
cmp byte [esp + 0x1c], 0
je 0x45ee12
or dword [edi + 8], 2
cmp byte [esp + 0x1d], 0
je 0x45ee1d
or dword [edi + 8], 4
mov cl, byte [esp + 0x1f]
mov dl, byte [esp + 0x23]
push 0x20
mov byte [edi + 0x18], cl
mov byte [edi + 0x19], dl
add edi, 0x1a
push edi
push 0x20
lea eax, [esp + 0x30]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [esp + 0x44]
pop edi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00499a1c
add esp, 0x40
ret

Function at 0x45fb90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x40]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + 0x44]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x48]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x18], edx
mov edx, dword [ebx]
push ecx
mov dword [esp + 0x20], eax
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x45fc1b
mov cl, byte [edi + 0x14]
and cl, 0x20
movzx esi, cl
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
neg esi
sbb esi, esi
lea edx, [esp + 0x10]
not esi
and esi, edx
mov edx, dword [eax + 0x1c]
call edx
mov ecx, dword [edi + 0xc]
mov edi, dword [ebx + 4]
mov eax, dword [eax + 0x78]
mov edx, dword [ecx]
mov edx, dword [edx + 0x1c]
push edi
mov edi, dword [ebx]
push edi
push esi
push 0
push eax
push 0
push 0
push 0xffffffffffffffff
push 1
call edx
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
Function at 0x460510
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x41c], 0
je 0x460595
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x100
jne 0x460573
cmp ebx, 0xd
jne 0x460573
cmp byte [esi + 0x422], 0
je 0x460552
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x460573
cmp byte [esi + 0x423], 0
jne 0x460573
mov edi, dword [esi + 0x44]
test edi, edi
je 0x46056b
push 0
push 0
push 0
push str.return
mov ecx, esi
call fcn.0042f650
pop edi
pop ebx
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0x41c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ebx
push edi
call edx
pop edi
pop ebx
pop esi
ret 0x10
mov eax, 1
pop esi
ret 0x10
Function at 0x462ca0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5de3bd
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x658aa8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov edi, 0x53
xor ecx, ecx
xor ebx, ebx
mov eax, edi
mov edx, 4
mul edx
seto cl
mov dword [esi + 8], ebx
mov dword [esi + 4], edi
neg ecx
or ecx, eax
push ecx
call fcn.0048fcef
push 0x14c
push ebx
push eax
mov dword [esi], eax
call fcn.004a0660
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
mov dword [esp + 0x28], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], edi
neg ecx
or ecx, eax
push ecx
call fcn.0048fcef
push 0x14c
push ebx
push eax
mov dword [esi + 0x10], eax
call fcn.004a0660
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
mov byte [esp + 0x38], 1
mov dword [esi + 0x24], ebx
mov dword [esi + 0x20], edi
neg ecx
or ecx, eax
push ecx
call fcn.0048fcef
push 0x14c
push ebx
push eax
mov dword [esi + 0x1c], eax
call fcn.004a0660
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov byte [esi + 0xce], 1
lea eax, [esi + 0xd4]
mov dword [esi + 0xd0], eax
mov byte [eax], bl
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
mov byte [esp + 0x48], 4
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x118], edi
neg ecx
or ecx, eax
push ecx
call fcn.0048fcef
push 0x14c
push ebx
push eax
mov dword [esi + 0x114], eax
call fcn.004a0660
add esp, 0x40
mov dword [esi + 0xc], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4646f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
push edi
mov dword [esp + 0xc], esi
test eax, eax
je 0x46473a
cmp byte [ecx], 0x3c
je 0x46473a
call fcn.00432090
add eax, 0x1c
push 1
push eax
mov eax, dword [ebp + 8]
call fcn.004296b0
test eax, eax
jne 0x46472c
xor ecx, ecx
jmp 0x46472e
mov ecx, dword [eax]
test ecx, ecx
je 0x464737
mov dword [ebp + 8], ecx
jmp 0x46473a
mov ecx, dword [ebp + 8]
mov edx, ecx
shr edx, 0x10
test edx, edx
je 0x464776
cmp byte [ecx], 0x3c
jne 0x464761
push ecx
call fcn.00466270
test al, al
jne 0x4647e9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
call fcn.00466400
test al, al
jne 0x4647e9
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [esi + 0xb0]
test esi, esi
jne 0x464790
mov esi, dword [0x66bde4]
test esi, esi
jne 0x464790
mov esi, dword [0x66bdf0]
mov eax, dword [ebp + 0xc]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x464756
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x464756
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0xc]
push edi
push esi
mov dword [edx + 0xa8], ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [esp + 0x10]
push eax
push esi
call fcn.00466300
test al, al
je 0x464756
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xac], eax
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
push esi
call fcn.00464810
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46e590
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x440
jmp fcn.004683d0
Function at 0x479510
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xa4
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xa8]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esi + 0x10], eax
mov dword [eax + 0x398], 0
cmp dword [esi + 4], 0
push edi
jne 0x4795ae
lea edi, [esp + 0xc]
mov eax, esi
call fcn.00479690
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0x74]
sub edx, ecx
push edx
mov edx, dword [esp + 0x10]
sub edi, edx
push edi
push ecx
push edx
push 0
push 0x40000000
push 0
push eax
mov eax, esi
call fcn.00433850
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
mov edi, dword [ecx + 0x358]
call eax
mov ecx, edi
mov edx, eax
call fcn.004305f0
mov ecx, dword [eax]
mov edx, dword [esi + 4]
push 1
push ecx
push 0x30
push edx
call ebp
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x1c]
push edx
call eax
mov ecx, dword [eax]
cmp byte [ecx], 0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
sete bl
cmp eax, edx
je 0x4795da
push eax
call fcn.0049b045
add esp, 4
test bl, bl
je 0x4795ed
mov eax, dword [esi + 0x10]
add eax, 0x388
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esi + 0x10]
push ecx
lea eax, [esp + 0x64]
call fcn.00479b20
mov edx, dword [esp + 0x60]
mov eax, dword [esi + 4]
push edx
push 0
push 0x1005
push eax
call ebp
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x388]
add eax, 0x388
mov dword [esi + 0x1a], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x1e], edx
mov ecx, dword [eax + 8]
push eax
mov dword [esi + 0x22], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esi + 4]
push 0
push 0x1002
push eax
mov dword [esi + 0x26], edx
call ebp
mov ecx, dword [esi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x64]
mov byte [esi + 0x18], 1
cmp eax, ecx
je 0x47966c
push eax
call fcn.0049b045
add esp, 4
mov ecx, dword [esp + 0xac]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00499a1c
add esp, 0xa4
ret 4
Function at 0x47d030
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x298
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x294], eax
lea eax, [esp]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x47d070
xor eax, eax
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.00499a1c
mov esp, ebp
pop ebp
ret
push 0xfe
lea ecx, [esp + 0x195]
push 0
push ecx
mov byte [esp + 0x19c], 0
call fcn.004a0660
add esp, 0xc
push 0xff
lea edx, [esp + 0x194]
push edx
call sub.WS2_32.dll_gethostname
lea eax, [esp + 0x190]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x47d05c
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov ecx, dword [edx]
mov eax, ecx
shr eax, 8
movzx edx, cl
movzx eax, al
shl edx, 8
add eax, edx
mov edx, ecx
shr edx, 0x10
shl eax, 8
movzx edx, dl
add eax, edx
shr ecx, 0x18
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.00499a1c
mov esp, ebp
pop ebp
ret

Function at 0x47d120
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x60
push ebx
mov dword [esi + 0x10], eax
push ebp
mov dword [eax + 0x390], 0
cmp dword [esi + 4], 0
push edi
jne 0x47d1c9
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x47d19f
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x58]
call eax
mov ecx, dword [eax + 4]
mov ebp, dword [eax]
mov edi, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [esp + 0x18]
sub ebx, ecx
push ebx
sub edi, ebp
push edi
push ecx
mov ecx, dword [eax + 0x74]
push ebp
push 0
push 0x40030000
push 0
push ecx
mov eax, esi
call fcn.00433850
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
mov edi, dword [ecx + 0x358]
call eax
mov ecx, edi
mov edx, eax
call fcn.004305f0
mov ecx, dword [eax]
mov edx, dword [esi + 4]
push 1
push ecx
push 0x30
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x24]
push edx
call eax
mov ecx, dword [eax]
cmp byte [ecx], 0
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
sete bl
cmp eax, edx
je 0x47d1f5
push eax
call fcn.0049b045
add esp, 4
test bl, bl
je 0x47d207
call fcn.0047d030
mov ecx, dword [esi + 0x10]
mov dword [ecx + 0x388], eax
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 0x388]
mov ecx, dword [esi + 4]
push eax
push 0
push 0x465
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [esi + 4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop ebp
mov byte [esi + 0x18], 1
pop ebx
add esp, 0x60
ret
Function at 0x47d3b0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetFocus]
push ebp
push esi
call ebx
mov esi, eax
test esi, esi
je 0x47d3d7
mov ebp, dword [sym.imp.USER32.dll_GetParent]
call ebx
cmp eax, dword [edi + 4]
je 0x47d43e
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x47d3c7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [edi + 4]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov ebx, eax
mov eax, dword [edi + 0x10]
cmp dword [eax + 0x390], 0
jne 0x47d42a
mov edx, dword [edi + 4]
add eax, 0x388
push eax
push 0
push 0x466
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [edi + 0x10]
mov dword [eax + 0x390], 1
mov esi, dword [edi + 0x10]
call fcn.0047d5d0
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x10
mov eax, dword [esp + 0x1c]
pop esi
pop ebp
mov dword [eax], 1
xor eax, eax
pop ebx
ret 0x10
Function at 0x489d00
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
sub esp, 0x108
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov edi, eax
lea eax, [ebx - 0x21]
cmp eax, 0xd
ja case.0x489d43.41
movzx eax, byte [eax + 0x489dc8]
jmp dword [eax*4 + 0x489dc0]
or edi, 0x100
cmp dword [esp + 0x11c], 0
je 0x489d60
or edi, 0x1000000
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.004a0660
add esp, 0xc
push 0x104
lea edx, [esp + 0x10]
push edx
shl edi, 0x10
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [esi + 4]
mov dword [esi], eax
mov byte [eax], 0
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push eax
call fcn.00428e20
mov ecx, dword [esp + 0x110]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00499a1c
add esp, 0x108
ret 8

Function at 0x489d4a
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x108
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
mov ebx, dword [esp + 0x110]
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyExA]
mov edi, eax
lea eax, [ebx - 0x21]
cmp eax, 0xd
ja case.0x489d43.41
movzx eax, byte [eax + 0x489dc8]
jmp dword [eax*4 + 0x489dc0]
or edi, 0x100
cmp dword [esp + 0x11c], 0
je 0x489d60
or edi, 0x1000000
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.004a0660
add esp, 0xc
push 0x104
lea edx, [esp + 0x10]
push edx
shl edi, 0x10
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [esi + 4]
mov dword [esi], eax
mov byte [eax], 0
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push eax
call fcn.00428e20
mov ecx, dword [esp + 0x110]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.00499a1c
add esp, 0x108
ret 8
Function at 0x48d760
Capabilities:
Check mutex on windows
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x658aa8]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x4c]
test ebp, ebp
je 0x48d904
test esi, esi
je 0x48d904
mov al, 0x65
push edi
mov byte [esp + 0xf], al
mov byte [esp + 0x17], al
lea eax, [esp + 0xc]
push eax
mov cl, 0x74
push 0
push 0
mov byte [esp + 0x18], 0x4d
mov byte [esp + 0x19], 0x75
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1c], 0x78
mov byte [esp + 0x1d], 0x55
mov byte [esp + 0x1e], 0x68
mov byte [esp + 0x1f], 0x7a
mov byte [esp + 0x20], 0x43
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x22], 0x69
mov byte [esp + 0x24], 0x6e
mov byte [esp + 0x25], cl
mov byte [esp + 0x26], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x48d8e7
mov dl, 0xd2
mov cl, 0xb4
mov al, 0xaa
mov bl, 0xa3
push edi
mov byte [esp + 0x20], dl
mov byte [esp + 0x21], 0xd1
mov byte [esp + 0x22], 0xbe
mov byte [esp + 0x23], 0xad
mov byte [esp + 0x24], cl
mov byte [esp + 0x25], 0xf2
mov byte [esp + 0x26], 0xbf
mov byte [esp + 0x27], al
mov byte [esp + 0x28], 0xc1
mov byte [esp + 0x29], 0xcb
mov byte [esp + 0x2a], dl
mov byte [esp + 0x2b], 0xbb
mov byte [esp + 0x2c], 0xb8
mov byte [esp + 0x2d], 0xf6
mov byte [esp + 0x2e], 0xc9
mov byte [esp + 0x2f], 0xcf
mov byte [esp + 0x30], 0xba
mov byte [esp + 0x31], 0xc5
mov byte [esp + 0x32], 0xc6
mov byte [esp + 0x33], 0xf7
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0xac
mov byte [esp + 0x36], 0xc7
mov byte [esp + 0x37], 0xeb
mov byte [esp + 0x38], 0xb2
mov byte [esp + 0x39], 0xbb
mov byte [esp + 0x3a], dl
mov byte [esp + 0x3b], al
mov byte [esp + 0x3c], 0xd6
mov byte [esp + 0x3d], 0xd8
mov byte [esp + 0x3e], 0xb8
mov byte [esp + 0x3f], cl
mov byte [esp + 0x40], cl
mov byte [esp + 0x41], 0xf2
mov byte [esp + 0x42], 0xbf
mov byte [esp + 0x43], al
mov byte [esp + 0x44], 0xa1
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x1c]
mov ecx, esi
mov edx, eax
sub ecx, edx
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0x48d8c7
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00499a1c
add esp, 0x3c
ret 8
push ebp
push ebx
mov ecx, esi
call fcn.0048cad0
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00499a1c
add esp, 0x3c
ret 8
mov ecx, dword [esp + 0x40]
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.00499a1c
add esp, 0x3c
ret 8