joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a7a14
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4d7234]
cmp dword [eax + 0x30], 0
je 0x4a7abe
cmp dword [ebx + 0x94], 0
jne 0x4a7ab8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a79a4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a7ab8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4a7a7e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a7ab8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c964
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a7a8d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a861c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4a8651
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00405134
jmp 0x4a865e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405098
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4a9604
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4a9645
mov eax, esi
call fcn.0048fcf0
test al, al
je 0x4a9645
mov eax, dword [ebx + 0x84]
call fcn.0048f9ec
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a9645
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048f9ec
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4ab584
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
test dl, dl
je 0x4ab596
add esp, 0xfffffff0
call fcn.0040454c
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004054f4
xor eax, eax
push ebp
push 0x4ab65c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004228a0
mov eax, dword [ebp - 4]
add eax, 0x44
mov edx, dword [ebp - 0xc]
call fcn.00405098
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
call fcn.004373d4
cmp al, 6
jb 0x4ab646
lea eax, [ebp - 0x18]
xor ecx, ecx
mov edx, 0xc
call fcn.004036c0
push 1
lea eax, [ebp - 0x2c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0xffffffffffffffff
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x18], 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0xff
push 4
push 3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
call fcn.00405504
push eax
call sub.kernel32.dll_CreateNamedPipeA
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab663
lea eax, [ebp - 0xc]
call fcn.00405044
ret

Function at 0x4ac704
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 1], 1
mov eax, dword [0x4d37d8]
cmp byte [eax + 0x24], 0
je 0x4ac7c1
mov eax, dword [0x4d3d00]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x4ac73a
mov byte [ebp - 1], 0
jmp 0x4ac7c1
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [0x4d3a98]
mov dword [edx], eax
mov eax, dword [0x4d3a98]
cmp dword [eax], 0xffffffff
jne 0x4ac75d
mov byte [ebp - 1], 0
jmp 0x4ac7c1
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 0x10
call fcn.004036c0
mov word [ebp - 0x14], 2
mov eax, dword [0x4d37d8]
mov ax, word [eax + 0x10]
push eax
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x4d3a98]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x4ac7a7
mov byte [ebp - 1], 0
jmp 0x4ac7c1
push pe_nt_image_headers32
mov eax, dword [0x4d3a98]
mov eax, dword [eax]
push eax
call sub.wsock32.dll_listen
test eax, eax
je 0x4ac7c1
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4ae7f0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4aea02
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 1
mov byte [ebp - 0x1d], 1
xor eax, eax
push ebp
push 0x4ae9b1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x14a]
push eax
mov eax, dword [0x4d4668]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
mov dword [ebp - 8], eax
call fcn.0044c35c
test al, al
jne 0x4ae86f
push 0x424
call sub.kernel32.dll_SetLastError
xor eax, eax
call fcn.004ae21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae9dc
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4ae88c
cmp dword [ebp - 8], 0
jge 0x4ae8a4
xor eax, eax
call fcn.004ae21c
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae9dc
lea edx, [ebp - 0x16c]
mov eax, dword [0x4d3c74]
mov eax, dword [eax]
call fcn.0040a330
mov edx, dword [ebp - 0x16c]
lea eax, [ebp - 0x18]
mov ecx, 0x4aea1c
call fcn.00405350
push 0xf01ff
lea eax, [ebp - 0x18]
call fcn.0040555c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4ae90a
xor eax, eax
call fcn.004ae21c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov byte [ebp - 1], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae9dc
xor eax, eax
push ebp
push 0x4ae934
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
push eax
push 1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_ControlService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae93e
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DeleteService
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
cmp dword [ebp - 0x14], 0
jne 0x4ae96d
xor eax, eax
call fcn.004ae21c
mov byte [ebp - 1], 0
cmp byte [ebp - 0x1d], 0
jne 0x4ae9a7
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae9a7
cmp dword [ebp - 0x14], 0
jle 0x4ae9a7
lea edx, [ebp - 0x1c]
mov eax, 0x4aea28
call fcn.00449128
test al, al
jne 0x4ae9a7
push 0x40
mov ecx, 0x4aea38
mov dl, 1
mov eax, dword [0x44df70]
call fcn.0044dff4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ae9bb
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, dword [0x4d38f0]
cmp byte [eax], 0
jne 0x4ae9dc
cmp byte [ebp - 0x1d], 0
jne 0x4ae9dc
xor eax, eax
call fcn.00449220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aea09
lea eax, [ebp - 0x16c]
call fcn.00405044
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00405068
ret
Function at 0x4aea5c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4aeb7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x427f60]
call fcn.00428060
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4aeae6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.00428100
xor ecx, ecx
mov edx, 0x4aeb94
mov eax, dword [ebp - 4]
call fcn.00428164
lea edx, [ebp - 8]
mov eax, 0x7d0
call fcn.0040a330
lea eax, [ebp - 8]
mov edx, 0x4aebcc
call fcn.0040530c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00428440
mov eax, dword [ebp - 4]
call fcn.004280d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aeaf0
xor eax, eax
push ebp
push 0x4aeb51
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.00428100
mov cl, 1
mov edx, 0x4aebdc
mov eax, dword [ebp - 4]
call fcn.00428164
lea edx, [ebp - 0xc]
mov eax, 0x7d0
call fcn.0040a330
lea eax, [ebp - 0xc]
mov edx, 0x4aebcc
call fcn.0040530c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00428440
mov eax, dword [ebp - 4]
call fcn.004280d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aeb5b
mov eax, dword [ebp - 4]
call fcn.00404214
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aeb85
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405068
ret

Function at 0x4aec14
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 2], dl
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4aed5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402f58
call fcn.0044c510
cmp al, 1
jne 0x4aec77
lea eax, [ebp - 8]
mov ecx, 0x4aed74
mov edx, dword [ebp - 0xc]
call fcn.00405350
push 1
push 0
push 0x4aed78
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4aed8c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x3e8
call sub.kernel32.dll_Sleep
cmp byte [ebp - 1], 0
je 0x4aece7
lea eax, [ebp - 8]
mov ecx, 0x4aed74
mov edx, dword [ebp - 0xc]
call fcn.00405350
cmp byte [ebp - 2], 0
je 0x4aecbd
push 1
push 0
push 0x4aed94
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4aed8c
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4aecdb
push 1
push 0
push 0x4aeda8
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4aed8c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x1f4
call sub.kernel32.dll_Sleep
jmp 0x4aed44
push 0x1f4
call sub.kernel32.dll_Sleep
lea eax, [ebp - 8]
mov ecx, 0x4aed74
mov edx, dword [ebp - 0xc]
call fcn.00405350
push 1
push 0
push 0x4aedb4
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4aed8c
push 0
call sub.shell32.dll_ShellExecuteA
push 0x64
call sub.kernel32.dll_Sleep
push 1
push 0
push 0x4aedc0
lea eax, [ebp - 8]
call fcn.0040555c
push eax
push 0x4aed8c
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aed66
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405068
ret
Function at 0x4af0f8
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4af1ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402f58
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402f58
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040a90c
mov edx, dword [ebp - 4]
mov eax, 0x4af200
call fcn.00405648
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4af1c4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405564
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
mov ecx, 0x4af20c
call fcn.00405350
lea ecx, [ebp - 0x18]
xor edx, edx
xor eax, eax
call fcn.004498bc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
call fcn.00405350
push 0
mov eax, dword [ebp - 4]
call fcn.00405504
push eax
mov eax, dword [ebp - 8]
call fcn.00405504
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
je 0x4af1c4
push 1
push 0
push 0
lea eax, [ebp - 4]
call fcn.0040555c
push eax
push 0x4af214
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
call fcn.00449220
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af1f3
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00405068
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405068
ret
Function at 0x4b1b10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x68]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x29c]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x298]
push eax
call sub.wsock32.dll_recv
mov edx, dword [ebp - 4]
mov dword [edx + 0x64], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x64], 0
je 0x4b1b6a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x64], 0xffffffff
jne 0x4b1b76
push ebp
call fcn.004b19e8
pop ecx
jmp 0x4b1c6a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x2a0]
jae 0x4b1ba7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 4]
sub dword [edx + 0x2a0], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x64]
mov edx, dword [ebp - 4]
add dword [edx + 0x68], eax
jmp 0x4b1c66
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 0
je 0x4b1bcb
mov eax, dword [ebp - 4]
call fcn.004b1f68
test al, al
jne 0x4b1bcb
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00464ff8
jmp 0x4b1c6a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6c], 0
je 0x4b1be0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x2a0], 0
jne 0x4b1c32
mov eax, dword [ebp - 4]
call fcn.004b6d10
test al, al
jne 0x4b1bf8
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00464ff8
jmp 0x4b1c6a
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x6d], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a0], 9
push 9
mov eax, dword [ebp - 4]
add eax, 0x29c
mov ecx, 1
mov edx, dword [0x46491c]
call fcn.00406528
add esp, 4
jmp 0x4b1c5e
mov eax, dword [ebp - 4]
mov byte [eax + 0x6c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2a0]
push eax
mov eax, dword [ebp - 4]
add eax, 0x29c
mov ecx, 1
mov edx, dword [0x46491c]
call fcn.00406528
add esp, 4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x68], edx
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4b1ff4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
xor edx, edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b21ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x6d], 0
jne 0x4b20b6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x70]
cmp eax, 0xea60
jbe 0x4b2198
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x2c0]
push 0x4b21e0
mov eax, dword [ebp - 4]
push dword [eax + 0x2a8]
push 0x4b21ec
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.004053c4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, 0x4b21f8
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov dword [ebp - 0x14], 1
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x24]
mov ecx, 2
mov eax, 0x4b221c
call fcn.0040b2a0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
add eax, 0x2cc
call fcn.00405098
jmp 0x4b21a7
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 0
jne 0x4b2108
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x70]
cmp eax, 0x7530
jbe 0x4b2108
mov eax, dword [ebp - 4]
cmp byte [eax + 0x2a4], 0
jne 0x4b20e8
mov eax, dword [0x4d37d8]
cmp dword [eax], 0
je 0x4b20f2
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00464ff8
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], eax
mov eax, dword [ebp - 4]
inc byte [eax + 0x78]
jmp 0x4b2198
mov eax, dword [ebp - 4]
cmp byte [eax + 0x78], 1
jne 0x4b2198
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x74]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x70]
cmp eax, 0x7530
jbe 0x4b2198
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
push dword [eax + 0x2c0]
push 0x4b21e0
mov eax, dword [ebp - 4]
push dword [eax + 0x2a8]
push 0x4b21ec
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.004053c4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, 0x4b21f8
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x24]
mov eax, 0x4b221c
mov ecx, 2
call fcn.0040b2a0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 0x2cc
call fcn.00405098
jmp 0x4b21a7
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x74], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b21d1
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00405068
lea eax, [ebp - 0xc]
call fcn.00405044
ret
Function at 0x4b445c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b4575
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4b454b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.004b71a8
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x400]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x404]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x408]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40c]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x410]
push eax
call sub.user32.dll_ShowWindow
push 9
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4b4430]
call fcn.00406528
add esp, 4
mov eax, dword [ebp - 0xc]
call fcn.00406354
push eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ax, 0x11
call fcn.00449d38
mov edx, dword [ebp - 0xc]
mov ecx, 9
mov eax, dword [ebp - 4]
call fcn.00464b30
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x4b4430]
call fcn.00406528
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b4559
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b457c
lea eax, [ebp - 0xc]
mov edx, dword [0x4b4430]
call fcn.00406654
ret
Function at 0x4b4c9c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x29c]
lea eax, [edx + eax + 2]
movzx eax, byte [eax]
mov edx, dword [ebp + 8]
mov word [edx - 0xa], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xa]
add eax, 0xffffffdf
sub ax, 8
jb 0x4b4cee
add eax, 0xfffffffc
sub ax, 2
jb 0x4b4cee
sub ax, 0x2e
je 0x4b4cee
sub ax, 0x12
je 0x4b4cee
sub ax, 0x21
jne 0x4b4d15
push 0
mov eax, dword [ebp - 4]
or eax, 1
push eax
push 0
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xa]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xa]
push eax
call sub.user32.dll_keybd_event
jmp 0x4b4d8d
mov eax, dword [ebp + 8]
cmp word [eax - 0xa], 0x2c
jne 0x4b4d3e
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov al, byte [eax + 0x2e2]
push eax
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xa]
push eax
call sub.user32.dll_keybd_event
jmp 0x4b4d8d
mov eax, dword [ebp + 8]
cmp word [eax - 0xa], 0x13
jne 0x4b4d5e
push 0
mov eax, dword [ebp - 4]
push eax
push 0x45
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xa]
push eax
call sub.user32.dll_keybd_event
jmp 0x4b4d8d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.004b4bcc
pop ecx
push 0
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xa]
push eax
call sub.user32.dll_MapVirtualKeyA
push eax
mov eax, dword [ebp + 8]
mov al, byte [eax - 0xa]
push eax
call sub.user32.dll_keybd_event
cmp dword [ebp - 4], 0
jne 0x4b4dab
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xa]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov byte [edx + eax + 0x2d0], 1
pop ecx
pop ebp
ret
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xa]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov byte [edx + eax + 0x2d0], 0
pop ecx
pop ebp
ret

Function at 0x4b4f5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
sub ebx, dword [eax + 0x430]
call sub.user32.dll_GetDoubleClickTime
sub eax, 0xa
cmp ebx, eax
jbe 0x4b4fa3
push 0
push 0
push 0
push 0
push 0x8002
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 0x8004
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 0x8002
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 0x8004
call sub.user32.dll_mouse_event
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x430], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov byte [eax + 0x3d0], 0
pop ebx
pop ebp
ret
Function at 0x4b8330
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4b84e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 1
xor eax, eax
push ebp
push 0x4b84b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x4b84a5
xor eax, eax
push ebp
push 0x4b849e
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_CountClipboardFormats
test eax, eax
jne 0x4b83ac
mov dword [ebp - 0x18], 5
call fcn.00404a60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b84c7
call sub.user32.dll_CountClipboardFormats
push eax
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b8300]
call fcn.00406528
add esp, 4
call sub.user32.dll_CountClipboardFormats
dec eax
test eax, eax
jl 0x4b8419
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
jle 0x4b8400
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
movzx eax, word [eax + edx*2 - 2]
push eax
call sub.user32.dll_EnumClipboardFormats
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov word [edx + ecx*2], ax
jmp 0x4b8411
push 0
call sub.user32.dll_EnumClipboardFormats
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov word [edx + ecx*2], ax
inc dword [ebp - 0x1c]
dec dword [ebp - 0x24]
jne 0x4b83dd
call sub.user32.dll_CountClipboardFormats
dec eax
test eax, eax
jl 0x4b8463
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0xd], 0
jne 0x4b8463
push ebp
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
movzx eax, word [eax + edx*2]
mov edx, dword [ebp - 0x14]
call fcn.004b7f70
pop ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x4b8463
push 1
call sub.kernel32.dll_Sleep_1
inc dword [ebp - 0x1c]
dec dword [ebp - 0x24]
jne 0x4b842e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b84ac
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4b8485
call sub.user32.dll_CloseClipboard
push 0
lea eax, [ebp - 0x20]
mov ecx, 1
mov edx, dword [0x4b8300]
call fcn.00406528
add esp, 4
ret
mov dword [ebp - 0x18], 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b84c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b84ea
lea eax, [ebp - 0x20]
mov edx, dword [0x4b8300]
call fcn.00406654
ret