joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4946d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
mov esi, ecx
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], esi
push eax
push 0x104
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x218]
call fcn.0049d450
mov ebx, dword [ebp + 0x10]
test al, al
jne 0x4947c8
push 0
push 0
push 1
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4947c5
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x494745
sub ecx, edx
sar ecx, 1
lea eax, [ebx + ecx*2]
push 0
mov dword [ebp + 0x10], eax
lea edi, [ecx*2 + 2]
mov ecx, 0x5d
mov word [eax], cx
lea eax, [ebp + 0xc]
push eax
push 4
push 0x4daecc
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49479f
cmp dword [ebp + 0xc], 4
jne 0x49479f
push 0
lea eax, [ebp + 0xc]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x49479f
cmp dword [ebp + 0xc], edi
je 0x4947a6
mov dword [ebp - 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg eax
mov ecx, 0
sbb eax, eax
and eax, dword [ebp - 8]
mov eax, dword [ebp + 0x10]
mov word [eax], cx
je 0x49487f
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
cmp word [eax], 0
je 0x4947e5
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x494841
push 0
mov ecx, esi
call fcn.0043adb0
lea eax, [eax*2 + 4]
call fcn.004b7430
mov edi, dword [ebp + 8]
mov eax, esp
mov dword [ebp + 0x10], eax
mov edx, eax
movzx ecx, word [edi]
test cx, cx
je 0x49482e
mov esi, ecx
sub edi, eax
xor ecx, ecx
movzx eax, si
cmp si, 0xa
cmovne ecx, eax
mov word [edx], cx
add edx, 2
movzx esi, word [edi + edx]
test si, si
jne 0x494810
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov dword [edx], ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov esi, eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test esi, esi
je 0x49487f
mov ecx, dword [0x4e5b90]
push 1
push 0
push 0xffffffffffffffff
push 0x4b9cc4
call fcn.004a05c0
lea esp, [ebp - 0x224]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [0x4e30fc]
test byte [eax + 0x100], 1
jne 0x4948b2
mov ecx, dword [0x4e5b90]
push 1
push 0
push 0xffffffffffffffff
push 0x4cffc4
call fcn.004a05c0
lea esp, [ebp - 0x224]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
push 0x4b9c10
push 0
push 0x4cffc4
call fcn.00447640
lea esp, [ebp - 0x224]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x495010
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x10]
push esi
push edi
push eax
push 0
push 0
push 0
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xff
push eax
lea eax, [esp + 0x34]
mov edi, ecx
push eax
push 0
push edi
call ebx
cmp eax, 0x103
je 0x4950d6
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop dword [eax + eax]
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4e30fc]
mov eax, dword [eax + 0xd0]
or eax, 0x20019
push eax
push 0
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4950e0
mov ecx, dword [esp + 0x14]
call fcn.00495010
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4950e0
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
test esi, esi
jne 0x4950e0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], 0xff
push eax
push esi
push esi
push esi
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push edi
call ebx
cmp eax, 0x103
jne 0x495060
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4950f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], ecx
push esi
push edi
test ebp, ebp
je 0x4951ee
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x495117
cmp word [edi], 0
jne 0x49511f
test ebx, ebx
je 0x4951ee
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x4e30fc]
mov eax, dword [eax + 0xd0]
or eax, 0x2001f
push eax
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4951df
test ebx, ebx
jne 0x4951c8
mov ecx, dword [esp + 0x18]
call fcn.00495010
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4951df
mov eax, dword [0x4ea334]
test al, 1
jne 0x495198
push str.RegDeleteKeyExW
or eax, 1
push str.advapi32
mov dword [0x4ea334], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [0x4ea338], ecx
jmp 0x49519e
mov ecx, dword [0x4ea338]
mov eax, dword [0x4e30fc]
mov eax, dword [eax + 0xd0]
test eax, eax
je 0x4951bc
test ecx, ecx
je 0x4951bc
push 0
push eax
push edi
push ebp
call ecx
mov esi, eax
jmp 0x4951df
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
jmp 0x4951df
push ebx
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x18]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0xffffffff
jne 0x4951f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x4951f5
mov esi, 0x57
mov ecx, esi
mov eax, dword [0x4e30fc]
test esi, esi
mov dword [eax + 0x30], ecx
setne al
mov ecx, dword [esp + 0x10]
movzx eax, al
push eax
call fcn.004476e0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x496ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push 0x34
mov dword [esp + 0x10], esi
call fcn.004b64c6
mov ebx, eax
xor eax, eax
mov dword [esp + 0x1c], ebx
mov word [ebx + 0x20], ax
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x22], 0xffff0101
mov byte [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 4], 1
mov dword [ebx], vtable.Struct.0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
movzx eax, byte [esi + 0x22]
mov byte [ebx + 0x22], al
movzx eax, word [esi + 0x20]
mov word [ebx + 0x20], ax
movzx eax, word [esi + 0x24]
mov word [ebx + 0x24], ax
movzx eax, byte [esi + 0x23]
mov byte [ebx + 0x23], al
mov eax, dword [esi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
movzx eax, byte [esi + 0x18]
mov byte [ebx + 0x18], al
movzx eax, byte [esp + 0x24]
xor eax, 1
dec eax
mov dword [ebx + 0x2c], eax
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], eax
lea eax, [edi + edi*8]
shl eax, 2
push eax
push 0
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov edx, eax
add esp, 0xc
test edx, edx
je 0x497076
mov dword [ebx + 8], edx
mov dword [ebx + 0x10], edi
mov ecx, dword [esi + 0xc]
push ebp
xor ebp, ebp
mov dword [ebx + 0xc], ecx
mov dword [esp + 0x24], ebp
cmp dword [esi + 0xc], ebp
jle 0x49706a
mov ebx, dword [esp + 0x10]
lea esi, [edx + 0x14]
mov eax, 0xffffffec
sub eax, edx
mov dword [esp + 0x18], eax
lea edi, [eax + esi]
add edi, dword [ebx + 8]
push dword [edi + 0x20]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
add esp, 4
mov dword [esi + 0xc], eax
test eax, eax
jne 0x496ff1
inc ebp
mov eax, dword [edi + 0x14]
mov dword [esi], eax
movzx eax, byte [edi + 0x10]
mov byte [esi - 4], al
movzx eax, word [edi + 0xc]
mov word [esi - 8], ax
movzx eax, byte [edi + 0xe]
mov byte [esi - 6], al
movzx eax, byte [edi + 0xf]
mov byte [esi - 5], al
movzx eax, word [edi + 0x12]
mov word [esi - 2], ax
movzx eax, byte [edi + 0x11]
mov byte [esi - 3], al
mov eax, dword [edi + 8]
mov dword [esi - 0xc], eax
mov eax, dword [edi + 4]
mov dword [esi - 0x10], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
add esi, 0x24
mov eax, dword [esp + 0x24]
inc eax
cmp eax, dword [ebx + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
jl 0x496fd7
mov ebx, dword [esp + 0x1c]
test ebp, ebp
je 0x49706a
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x10
ret 4
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 4
Function at 0x49d450
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x250
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x49d4d7
cmp word [esi], 0
je 0x49d4d7
push 4
push 0x4db520
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
add esp, 0xc
mov ecx, esi
test eax, eax
jne 0x49d486
lea ecx, [esi + 8]
mov edx, 0x4d8990
call fcn.00406300
test eax, eax
je 0x49d4be
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x49d4d7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x49d4b6
mov eax, dword [esp + 8]
mov dword [edi], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test edi, edi
je 0x49d4cb
mov dword [edi], eax
cmp eax, 0xffffffff
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49da50
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 0x1c]
or eax, 1
push eax
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x49daf0
push esi
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x208
push eax
push edi
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x49daf0
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x49daf0
shr ecx, 1
lea eax, [ecx - 1]
mov dword [esp + 0x18], eax
cmp word [edi + eax*2], 0
jne 0x49dad7
test eax, eax
je 0x49daf5
cmp word [edi + eax*2 - 2], 0
jne 0x49daf5
sub eax, 1
mov dword [esp + 0x18], eax
jne 0x49dac3
pop edi
pop ecx
ret
mov dword [esp + 0x18], ecx
cmp ecx, 0x104
jae 0x49daf0
xor eax, eax
mov word [edi + ecx*2], ax
mov eax, dword [esp + 0x18]
pop edi
pop ecx
ret
xor eax, eax
mov word [edi], ax
pop edi
pop ecx
ret
Function at 0x49e320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
xor ebx, ebx
mov dword [esp + 0xc], ebp
push edi
mov edi, edx
mov dword [esp + 0x14], edi
test ebp, ebp
je 0x49e347
push 2
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
jmp 0x49e34d
mov esi, dword [0x4e5c10]
test esi, esi
je 0x49e4b8
test edi, edi
jns 0x49e362
mov eax, edi
neg eax
movzx eax, ax
jmp 0x49e393
test edi, edi
mov dword [esp + 0x1c], ebx
mov eax, 1
mov dword [esp + 0x20], 0x4e9cd0
cmovne eax, edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x49e2f0
push 0xe
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [esp + 0x20]
cmp eax, 0x4e9cd0
je 0x49e48f
push 0xe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x49e48f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49e48f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x49e485
cmp dword [esp + 0x28], 0xffffffff
mov ebp, dword [esp + 0x2c]
cmovne ebp, dword [esp + 0x28]
test ebp, ebp
jne 0x49e3ed
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
movzx eax, word [ebx + 4]
lea edx, [ebx + 6]
cmp eax, 1
jbe 0x49e433
add ebx, 0x14
lea edi, [eax - 1]
nop
mov al, byte [ebx]
mov cl, byte [edx]
cmp al, cl
jbe 0x49e414
movzx eax, cl
xor ecx, ecx
cmp eax, ebp
setl cl
jmp 0x49e41e
movzx eax, al
xor ecx, ecx
cmp eax, ebp
setge cl
test ecx, ecx
mov eax, ebx
cmove eax, edx
add ebx, 0xe
mov edx, eax
sub edi, 1
jne 0x49e400
mov edi, dword [esp + 0x14]
movzx eax, word [edx + 0xc]
push 3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x49e489
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x49e481
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
je 0x49e489
push 0
push 0
push 0
push 0x30000
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebp
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ebx, eax
jmp 0x49e48b
mov ebp, dword [esp + 0x10]
xor ebx, ebx
jmp 0x49e48f
xor ebx, ebx
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x49e49f
test ebx, ebx
je 0x49e49f
mov dword [ecx], esi
jmp 0x49e4aa
test ebp, ebp
je 0x49e4aa
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x49e4b8
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
test edi, edi
jle 0x49e4d1
lea eax, [edi - 1]
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
xor eax, eax
cmp edi, 0xffffffff
cmovl eax, edi
push eax
push ebp
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x49f540
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x814
push ebx
push esi
push edi
push 0x800
lea eax, [esp + 0x24]
mov dword [esp + 0x14], edx
push 0
push eax
mov ebx, ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x1c]
push 0xf0000000
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x49f6d2
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x8004
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x49f6d2
mov edx, dword [ebp + 8]
test edx, edx
je 0x49f5e3
cmp dword [edx], 0
je 0x49f5e3
xor ecx, ecx
mov eax, edx
mov esi, 0x4dc428
nop dword [eax]
cmp edx, 0x4e4218
jne 0x49f5cc
mov eax, esi
jmp 0x49f5ce
mov eax, dword [eax]
mov ax, word [eax]
add esi, 0xa
mov word [esp + ecx*2 + 0x20], ax
inc ecx
cmp dword [edx + ecx*4], 0
lea eax, [edx + ecx*4]
jne 0x49f5c0
lea ecx, [esp + 0x20]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49f5f0
sub ecx, edx
sar ecx, 1
push 0
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x49f6d2
xor eax, eax
lea edi, [esp + 0x20]
mov ecx, 0x200
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x10]
cmp ecx, 0x80
jne 0x49f63b
mov eax, 0x660e
jmp 0x49f64b
xor eax, eax
cmp ecx, 0xc0
setne al
add eax, 0x660f
lea edx, [esp + 0x18]
shl ecx, 0x10
push edx
push ecx
push dword [esp + 0x1c]
push eax
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x49f6d2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x49f6d2
cmp byte [ebp + 0xc], 0
je 0x49f69b
mov eax, dword [esp + 0x10]
add eax, 0x10
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x30]
call dword [0x4e5bd4]
jmp 0x49f6b1
lea eax, [esp + 0x10]
push eax
push ebx
push 0
push 1
push 0
push dword [esp + 0x2c]
call dword [0x4e5bd0]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a03f0
Capabilities:
Write clipboard data

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, 0x4e88a8
push esi
mov esi, edx
call fcn.00406240
test eax, eax
jne 0x4a0421
push 0x4b9c10
push str.Cant_open_clipboard_for_writing.
mov ecx, 0x4e7d50
call fcn.00447cc0
pop esi
pop ebx
add esp, 8
ret
push ebp
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [ebx + esi]
lea esi, [ebx + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
ja 0x4a04a9
mov ecx, dword [ebx]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4a04a9
mov edi, esi
add esi, 4
cmp esi, eax
ja 0x4a04a9
mov edi, dword [edi]
mov ebx, esi
add esi, edi
cmp esi, eax
ja 0x4a04a9
xor eax, eax
test edi, edi
sete al
add eax, edi
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x4a055d
test edi, edi
je 0x4a0493
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4a04f8
push edi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, esi
push ebp
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov eax, dword [esp + 0x14]
lea esi, [ebx + 4]
cmp esi, eax
jbe 0x4a0437
cmp dword [0x4e88c0], 0
je 0x4a04eb
cmp dword [0x4e88b0], 0
je 0x4a04d1
push dword [0x4e88a8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4e88b0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4e88c0], 0
mov dword [0x4e88a8], 0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
add esp, 8
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x4e88c0], 0
je 0x4a0541
cmp dword [0x4e88b0], 0
je 0x4a0527
push dword [0x4e88a8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4e88b0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4e88c0], 0
mov dword [0x4e88a8], 0
push 0x4b9c10
push 0x4ba10c
mov ecx, 0x4e7d50
call fcn.00447cc0
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
cmp dword [0x4e88c0], 0
je 0x4a059f
cmp dword [0x4e88b0], 0
je 0x4a0585
push dword [0x4e88a8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4e88b0], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4e88c0], 0
mov dword [0x4e88a8], 0
push 0x4b9c10
push 0x4cdaa4
mov ecx, 0x4e7d50
call fcn.00447cc0
pop edi
pop ebp
pop esi
pop ebx
add esp, 8
ret
Function at 0x4a1280
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, ecx
push esi
push edi
mov edi, edx
movzx eax, word [edi]
cmp eax, 0x41
je 0x4a1299
cmp eax, 0x61
jne 0x4a12f6
cmp word [edi + 2], 0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
jne 0x4a12fe
cmp word [ecx], 0
jne 0x4a12fe
cmp word [eax], 0
jne 0x4a12fe
cmp word [ebp], 0
jne 0x4a12fe
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4a12f6
cmp byte [ebx + 0xea], 0
jne 0x4a12db
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a12f6
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4a12ef
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
test dl, dl
jne 0x4a1328
cmp word [edi], 0
jne 0x4a1328
cmp word [ecx], 0
jne 0x4a1328
cmp word [eax], 0
jne 0x4a1328
cmp word [ebp], 0
jne 0x4a1328
mov ecx, ebx
call fcn.004a1a70
jmp 0x4a1342
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push edx
push ebp
push eax
push ecx
mov edx, edi
mov ecx, ebx
call fcn.004a18c0
add esp, 0x1c
test eax, eax
jne 0x4a134b
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov ecx, eax
pop ebx
jmp fcn.004a13e0
Function at 0x4a13e0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4a1568
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
call ebp
mov edi, eax
mov dword [esp + 0x18], edi
cmp edi, dword [0x4e7484]
je 0x4a1419
mov ecx, esi
call fcn.004a2410
test al, al
jne 0x4a1568
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
test ebx, ebx
jne 0x4a1433
push eax
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4a1447
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebx
jne 0x4a1455
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [0x4e5c52], 0
jne 0x4a146f
mov edx, ebx
mov ecx, esi
call fcn.004a1360
test eax, eax
jne 0x4a156a
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
test ebx, ebx
je 0x4a14d0
push 0
push ebx
call ebp
mov ebp, eax
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x4a14d8
cmp dword [0x4e7484], ebp
je 0x4a14b5
mov ecx, ebx
call fcn.004a2410
test al, al
jne 0x4a14b5
push 1
push ebp
push dword [0x4e7484]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x12]
test edi, edi
je 0x4a14d8
cmp ebp, edi
je 0x4a14d8
push 1
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [esp + 0x13]
jmp 0x4a14d8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
xor edi, edi
nop word [eax + eax]
mov edx, ebx
mov ecx, esi
call fcn.004a1360
mov ebp, eax
test ebp, ebp
jne 0x4a1527
inc edi
cmp edi, 5
jl 0x4a14e0
push 0xffc3d44d
push eax
push eax
push eax
mov dl, 0x12
lea ecx, [eax + 2]
call fcn.004189c0
push 0xffc3d44d
push ebp
push ebp
push ebp
mov dl, 0x12
lea ecx, [ebp + 2]
call fcn.004189c0
add esp, 0x20
mov edx, ebx
mov ecx, esi
call fcn.004a1360
mov ebp, eax
cmp byte [esp + 0x12], 0
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
je 0x4a1543
push 0
push edi
push dword [0x4e7484]
call ebx
cmp byte [esp + 0x13], 0
je 0x4a1553
push 0
push dword [esp + 0x1c]
push edi
call ebx
test ebp, ebp
je 0x4a1568
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4a1670
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ecx
cmp byte [esp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, ecx
je 0x4a16ce
lea eax, [esp + 0xc]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4a16db
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x4a16db
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4a16db
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4a16db
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test ebx, ebx
cmovns edi, ebx
test edi, edi
je 0x4a1743
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword fs:[0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x18], eax
nop
cmp dword [0x4e7484], ebx
jne 0x4a1719
mov edx, 1
mov ecx, 0x8000012f
call fcn.00401a20
jmp 0x4a171d
push 0xa
call ebp
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4a173b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x18]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jg 0x4a1700
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret