joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4390f4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x439296
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4392ac
mov dl, 8
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x439279
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4391f4
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
je 0x439218
test ebx, ebx
jle 0x4391b9
mov eax, dword [ebp - 4]
lea edx, [eax + 0x24]
mov ecx, ebx
mov eax, edi
call fcn.004a5f98
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x4391af
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
jmp 0x4391e3
inc ebx
jne 0x4391e3
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], ebx
cmp ebx, 0x2749
je 0x439218
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
cmp esi, 0xffffffff
je 0x439218
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x439218
cmp esi, 0xffffffff
je 0x43914c
mov eax, edi
call fcn.004a5f28
cmp esi, eax
jg 0x43914c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x439263
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4392c4
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_EAbortError_]
call fcn.004b35b8
call fcn.004b82b8
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x439263
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439280
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x4392dc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4394b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4394c8
mov dl, 8
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, esi
call fcn.004b87bc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x100b4], edx
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
xor eax, eax
push ebp
push 0x439493
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x43940e
push 0
push 0x10000
mov eax, dword [ebp - 4]
add eax, 0x24
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
mov ebx, eax
test ebx, ebx
je 0x439432
cmp ebx, 1
jle 0x4393d8
mov eax, dword [esi]
call fcn.004b8a3c
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, ebx
mov eax, esi
call fcn.004b8d70
mov eax, esi
call fcn.004b8c0c
mov edx, dword [ebp - 8]
inc edx
dec edx
cmp edx, dword [eax - 4]
jb 0x439394
call fcn.004b7aa0
inc edx
lea edx, [eax + edx - 1]
mov eax, dword [ebp - 4]
add eax, 0x24
mov ecx, ebx
call fcn.004b7600
mov eax, dword [ebp - 4]
add dword [eax + 0x100b4], ebx
mov eax, dword [ebp - 4]
cmp word [eax + 0x100ba], 0
je 0x4393ce
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x100bc]
call dword [ebx + 0x100b8]
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
jmp 0x439402
inc ebx
jne 0x439402
call sub.WSOCK32.DLL_WSAGetLastError
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1008c], ebx
cmp ebx, 0x2749
je 0x439432
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
jne 0x439432
cmp edi, 0xffffffff
je 0x43933b
mov eax, dword [esi]
call fcn.004b8a3c
cmp edi, eax
jg 0x43933b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10088], 0
je 0x43947d
mov eax, dword [ebp - 4]
mov byte [eax + 0x10088], 0
mov ecx, 0x4394e0
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_EAbortError_]
call fcn.004b35b8
call fcn.004b82b8
mov eax, dword [ebp - 4]
cmp word [eax + 0x10282], 0
je 0x43947d
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x10284]
call dword [ebx + 0x10280]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43949a
mov eax, dword [ebp - 4]
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOff_qqrv
ret
Function at 0x4395d0
Capabilities:
Set socket configuration

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov ecx, 0x439698
mov dl, 8
mov eax, esi
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
lea eax, [esi + 0x24]
mov edx, 0x4396ac
call fcn.004b141c
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [esi + 0x10260], eax
mov word [esi + 0x1025c], 2
mov eax, dword [esi + 0x100ac]
cmp eax, 0xffff
jbe 0x439618
call fcn.004b7aa0
push eax
call sub.WSOCK32.DLL_htons
mov word [esi + 0x1025e], ax
mov byte [esi + 0x100c8], 0
push 0x10
lea eax, [esi + 0x1025c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_bind
test bl, bl
je 0x439663
push 8
push 0x466
mov eax, dword [esi + 0x1028c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x43967e
push 8
push 0x465
mov eax, dword [esi + 0x1028c]
push eax
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
push 1
movzx eax, word [esi + 0x10288]
push eax
call sub.WSOCK32.DLL_listen
pop esi
pop ebx
ret
Function at 0x439f58
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x43a024
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x43a038
mov dl, 4
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov byte [ebx + 0x10290], 0
mov si, word [ebx + 0x10288]
cmp si, 0xffff
je 0x43a00e
movzx eax, si
push eax
call sub.WSOCK32.DLL_closesocket
test eax, eax
jne 0x43a000
test byte [ebx + 0x20], 8
jne 0x439fbd
cmp word [ebx + 0x1004a], 0
je 0x439fbd
mov edx, ebx
mov eax, dword [ebx + 0x1004c]
call dword [ebx + 0x10048]
cmp byte [ebx + 0x10089], 0
jne 0x43a00e
push 0
push 1
push 2
call sub.WSOCK32.DLL_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x439fe0
call fcn.004b7aa0
mov word [ebx + 0x10288], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x1028c]
push eax
movzx eax, si
push eax
call sub.WSOCK32.DLL_WSAAsyncSelect
jmp 0x43a00e
lea ecx, [ebp - 4]
mov dx, 0x2733
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_ErrorManager_qqrus
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a02b
lea eax, [ebp - 4]
call fcn.004b87bc
ret

Function at 0x43a320
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x43a35c
mov dl, 8
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 2
push 1
lea eax, [ebx + 0x24]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
test eax, eax
jle 0x43a34e
mov al, 1
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x43a36c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x43a373
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x43a3c0
mov dl, 8
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10288]
push eax
call sub.WSOCK32.DLL_recv
add esp, 0x10004
pop ebx
ret
Function at 0x43a3d0
Capabilities:
Set socket configuration

Disassembly:
push ebx
mov ebx, eax
mov ecx, 0x43a560
mov dl, 8
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
cmp dword [ebx + 0x1009c], 0
jne 0x43a406
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x1026c]
call fcn.004b141c
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10260], eax
jmp 0x43a420
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x1009c]
call fcn.004b141c
push eax
call sub.WSOCK32.DLL_inet_addr
mov dword [ebx + 0x10260], eax
cmp dword [ebx + 0x10260], 0xffffffff
jne 0x43a556
xor eax, eax
mov dword [ebx + 0x10260], eax
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOn_qqrv
mov byte [ebx + 0x100c8], 0
push 0x400
mov eax, dword [ebx + 0x10270]
push eax
lea eax, [ebx + 0x24]
push eax
push 0x466
mov eax, dword [ebx + 0x1028c]
push eax
call sub.WSOCK32.DLL_WSAAsyncGetHostByName
push 2
call sub.KERNEL32.DLL_Sleep
mov eax, dword [0x4f0650]
mov eax, dword [eax]
call fcn.0047bbb0
cmp byte [ebx + 0x100c8], 0
jne 0x43a492
cmp byte [ebx + 0x100a9], 0
jne 0x43a492
cmp byte [ebx + 0x10088], 0
je 0x43a464
mov eax, ebx
call sym.RouletteGroup.exe__Psock_TPowersock_TimerOff_qqrv
cmp byte [ebx + 0x100a9], 0
je 0x43a4b8
mov ecx, 0x43a578
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_ESockError_]
call fcn.004b35b8
call fcn.004b82b8
cmp byte [ebx + 0x10088], 0
je 0x43a4d7
mov ecx, 0x43a598
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_ESockError_]
call fcn.004b35b8
call fcn.004b82b8
cmp byte [ebx + 0x100a8], 0
jne 0x43a4f6
mov ecx, 0x43a5b8
mov dl, 1
mov eax, dword [sym.RouletteGroup.exe__Psock_ESockError_]
call fcn.004b35b8
call fcn.004b82b8
lea eax, [ebx + 0x10260]
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx]
mov byte [eax], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 2]
mov byte [eax + 2], dl
mov edx, dword [ebx + 0x10270]
mov edx, dword [edx + 0xc]
mov edx, dword [edx]
mov dl, byte [edx + 3]
mov byte [eax + 3], dl
cmp word [ebx + 0x10062], 0
je 0x43a556
mov edx, ebx
mov eax, dword [ebx + 0x10064]
call dword [ebx + 0x10060]
pop ebx
ret
Function at 0x43a678
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], edx
mov ecx, 0x43a738
mov dl, 8
call sym.RouletteGroup.exe__Psock_TPowersock_StatusMessage_qqruc17System_AnsiString
mov eax, 0xc8
call fcn.004b0b2c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43a723
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.WSOCK32.DLL_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x43a754
call fcn.004b1a88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a72a
mov eax, dword [ebp - 8]
call fcn.004b748c
ret

Function at 0x43a760
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
mov edi, esp
mov dword [edi], 0x10
push edi
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_getsockname
push dword [esp + 8]
call sub.WSOCK32.DLL_inet_ntoa
mov ebx, eax
xor eax, eax
mov dword [edi], eax
xor eax, eax
mov edx, dword [edi]
cmp byte [ebx + edx], 0x2e
jne 0x43a7a3
mov edx, dword [edi]
mov byte [ebx + edx], 0x2c
inc eax
inc dword [edi]
cmp eax, 3
jl 0x43a794
mov edx, esi
mov eax, ebx
call fcn.004b1540
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x43a7bc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov esi, edx
mov dword [esp], 0x10
push esp
lea edx, [esp + 8]
push edx
movzx eax, word [eax + 0x10288]
push eax
call sub.WSOCK32.DLL_getsockname
push esi
mov bx, word [esp + 0xa]
mov eax, ebx
and ax, 0xff
movzx eax, ax
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], 0
shr bx, 8
movzx eax, bx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
lea edx, [esp + 0x18]
mov ecx, 1
mov eax, 0x43a828
call fcn.004b1a88
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x43e3b8
Capabilities:
Get graphical window text

Disassembly:
movsb byte es:[edi], byte [esi]
fisttp qword [eax]
or byte [eax + ecx*2 + 0x4a448800], al
add byte [eax - 0x72], bh
dec eax
add byte [eax + 0x67], dl
dec eax
add byte [eax - 0x77ffb76b], dh
outsd dx, dword [esi]
dec eax
add byte [edx + ebx*4 - 0x686bffb6], ch
dec edx
add byte [edi + edx*4 - 0x654bffb6], cl
dec edx
add ah, dh
out dx, eax
inc esp
add byte [eax + ebx*8 - 0x222bffb8], bl
dec eax
add byte [eax], al
fisttp qword [eax]
sub bl, dl
dec eax
add byte [eax - 0x2d], cl
dec eax
add byte [eax + 0x80048d0], ah
dec eax
add byte [0x90440048], cl
dec eax
add byte [eax - 0x70], dh
dec eax
add byte [eax + 0x4004866], cl
jno 0x43e45f
add byte [eax + esi*2 + 0x48], dh
add byte [eax + 0x73], bh
dec eax
add byte [edx + esi*2], bh
dec eax
add byte [eax], bl
lodsb al, byte [esi]
dec eax
add al, dh
nop
dec eax
add ah, dh
ror byte [eax], 1
jo 0x43e403
dec eax
add ah, dh
int3
add byte [eax - 0x50], bl
dec eax
add byte [eax - 0x31], dl
dec eax
add byte [eax], al
ror byte [eax], cl
pushfd
invalid

Function at 0x43e4a8
Capabilities:
Get graphical window text

Disassembly:
pop es
or byte [ebx + eax*2 + 0x61], dl
bound eax, qword [ebp + 0x64]
imul esi, dword [eax + edi*4 - 0x1d], 0xa8280043
inc esp
add byte [0x61430700], bh
bound eax, qword [ebp + 0x64]
imul esi, dword [ebx + eax], 0x44a51c
sbb dh, ah
inc ebx
add byte [eax], ah
out 0x43, al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4308000f], al
push 0x61437261
jae 0x43e54e
cld
pop esi
dec ebx
add byte [eax], ch
out 0x43, al
add byte [eax], dh
out 0x43, al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4e0b003b], al
jne 0x43e574
jb 0x43e573
arpl word [edi + 0x6e], cx
outsb dx, byte [esi]
insb byte es:[edi], dx
jns 0x43e50c
pop esi
dec ebx
add byte [eax], bh
out 0x43, al
add byte [eax - 0x1a], al
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x450a003c], al
outsb dx, byte [esi]
je 0x43e593
jb 0x43e571
jae 0x43e586
popal
bound edx, qword [ebx + 0x56]
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
cmp byte [esi + 0x209], 0
je 0x43e554
mov al, byte [ebx]
dec eax
sub al, 0x1f
jb 0x43e554
add al, 0xf0
sub al, 0xa
jb 0x43e554
or dh, byte [edx + 3]
mov byte [ebx], 0
mov al, byte [esi + 0x208]
dec al
je 0x43e564
dec al
je 0x43e56f
jmp 0x43e580
mov al, byte [ebx]
call fcn.004b7640
mov byte [ebx], al
jmp 0x43e580
mov al, byte [ebx]
add al, 0xbf
sub al, 0x1a
jae 0x43e580
sbb dh, byte [ebx + 9]
xor eax, eax
mov al, byte [ebx]
add eax, 0x20
mov byte [ebx], al
cmp byte [esi + 0x20a], 0
je 0x43e5b1
add byte [eax + ebp - 0x80], dh
cmp ecx, dword [0xc68b2375]
cmp byte [ebx], 0xd
jne 0x43e5b1
mov eax, esi
call fcn.004732dc
add eax, dword [eax]
mov edi, eax
test edi, edi
je 0x43e5ae
push 0
push 0
push 0x28
mov eax, edi
call fcn.0048d280
push eax
call sub.USER32.DLL_SendMessageA
mov byte [ebx], 0
cmp byte [ebx], 0
je 0x43e5bf
mov edx, ebx
mov eax, esi
call fcn.0048c0a4
pop edi
pop esi
pop ebx
ret
Function at 0x455b08
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004b87bc
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x455b57
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004b89ec
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c100
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c35f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x45c162
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0045bbc8
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.004b3ef4
cmp al, 1
jne 0x45c162
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0045bee0
test al, al
je 0x45c2ee
cmp dword [ebp - 8], 0
jge 0x45c180
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0045bbc8
mov eax, dword [ebp - 0x210]
call fcn.004b8a3c
cmp ebx, eax
jge 0x45c1ca
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0045bbc8
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4f0880]
and eax, 0xff
bt dword [edx], eax
jae 0x45c1ca
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x210]
cmp eax, dword [ebp - 8]
jg 0x45c1de
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045c0dc
cmp ebx, dword [ebp - 8]
je 0x45c2e0
lea eax, [ebp - 0x108]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x45c20a
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004b7d3c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ebd2c]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.DLL_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 1
xor eax, eax
push ebp
push 0x45c2cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004b7d3c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ebd2c]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.0048d280
push eax
call sub.USER32.DLL_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov bx, 0xffce
call fcn.004b7d3c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4ebd2c]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0048d280
push eax
call sub.USER32.DLL_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c2d4
mov eax, dword [ebp - 4]
mov byte [eax + 0x224], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x218], edx
jmp 0x45c341
cmp dword [ebp - 8], 0
jge 0x45c2f9
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0045bbc8
mov eax, dword [ebp - 0x218]
call fcn.004b8a3c
cmp eax, dword [ebp - 8]
jg 0x45c333
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0045bbc8
mov eax, dword [ebp - 0x21c]
call fcn.004b8a3c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045c0dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c366
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004b87e0
ret
Function at 0x467704
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46770a
ret

Function at 0x46a084
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x46a0d5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x46a0bc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x46a0ac
jmp 0x46a0d5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x46a0bd
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472ff8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4f0f94
cmp dword [edi], 0
jne 0x473074
push 0x40
push 0x1000
push 0x1000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov esi, eax
mov eax, dword [0x4f0f90]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4ec008
mov ecx, 2
call fcn.004b7600
mov edx, 0x472fd0
lea eax, [esi + 5]
call fcn.00472ff0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00472ff0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x473049
mov dword [0x4f0f90], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x473190
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4731e0]
test si, 4
je 0x4731a4
or bl, 1
test si, 8
je 0x4731ae
or bl, 4
test si, 1
je 0x4731b8
or bl, 8
test si, 2
je 0x4731c2
or bl, 0x10
test si, 0x10
je 0x4731cc
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4731db
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4731e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x47321c]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4731fd
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x47320c
or bl, 4
test esi, 0x20000000
je 0x473217
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x479804
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x479816
add esp, 0xfffffff0
call fcn.004b7e60
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004a9318
mov eax, ebx
call fcn.00479b50
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x4a25a0]
call fcn.004b7b30
mov dword [ebx + 0x40], eax
mov dl, 1
mov eax, dword [0x4a25a0]
call fcn.004b7b30
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x4a25a0]
call fcn.004b7b30
mov dword [ebx + 0x48], eax
mov dl, 1
mov eax, dword [0x4a25a0]
call fcn.004b7b30
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4a25a0]
call fcn.004b7b30
mov dword [ebx + 0x70], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x34], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x4c]
push eax
mov eax, 0x47625c
push eax
push 0
push 0
mov eax, dword [0x4f0858]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x466b8c]
call fcn.004681bc
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x466b8c]
call fcn.004681bc
mov dword [ebx + 0x7c], eax
mov dl, 1
mov eax, dword [0x466b8c]
call fcn.004681bc
mov dword [ebx + 0x74], eax
mov eax, ebx
call fcn.00479fc0
mov eax, dword [ebx + 0x78]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x479e94
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x479e94
mov eax, dword [ebx + 0x74]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x479e94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x479925
call fcn.004b7eb8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret