joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fb78
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov eax, dword [edi + 8]
imul esi, ebx
imul eax, dword [ebp + 0x10]
add esi, dword [edi + 0x14]
sub ebx, dword [edi + 0xc]
sar eax, 8
cmp eax, 0xfe
jge 0x45fbf0
inc eax
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
mov eax, dword [edi + 0x18]
inc ebx
imul ecx, edx
movzx edx, byte [ecx + eax]
imul edx, dword [ebp + 8]
movzx eax, byte [esi]
shr edx, 8
mov ecx, 0x100
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [esi], cl
mov eax, dword [edi]
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45fbac
jmp 0x45fc2f
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, 0x100
movzx edx, byte [edx + eax]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [esi], cl
mov eax, dword [edi]
inc ebx
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45fbf6
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x45fc36
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
imul esi, ebx
add esi, dword [edi + 0x14]
sub ebx, dword [edi + 0xc]
cmp dword [edi + 8], 0xfe
mov dword [ebp + 0xc], eax
jge 0x45fca5
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
mov eax, dword [edi + 0x18]
inc ebx
imul ecx, edx
movzx edx, byte [ecx + eax]
mov eax, dword [edi + 8]
inc eax
imul edx, eax
movzx eax, byte [esi]
shr edx, 8
mov ecx, 0x100
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [esi], cl
mov eax, dword [edi]
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45fc5e
jmp 0x45fcde
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
idiv dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul edx, dword [ecx + 0xc]
mov ecx, 0x100
movzx edx, byte [edx + eax]
movzx eax, byte [esi]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [esi], cl
mov eax, dword [edi]
inc ebx
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45fca5
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45fd2e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, dword [edi]
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov eax, dword [eax]
shr eax, 0x18
and esi, 0xff00ff
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
mov eax, dword [ebp + 0xc]
xor esi, ecx
add esi, dword [eax]
mov eax, dword [ebp - 4]
mov dword [edi], esi
mov eax, dword [eax]
add edi, dword [eax + 0xc]
dec ebx
test ebx, ebx
jg 0x45fd3e
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x46bb0b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c60b3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00421909
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [esp + 0x3c], 0
lea eax, [esp + 0x10]
push eax
call fcn.004878b8
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x7c]
call fcn.00421a36
test al, al
je 0x46bb7b
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x7c]
call fcn.00421a8a
mov ecx, esi
call fcn.0046d1c1
lea ecx, [esp + 0xc]
call fcn.0040971a
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x46bde1
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c84f6
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push ecx
movzx eax, byte [edi + 0xc]
push eax
call fcn.0046bda3
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0046bd75
and dword [esp + 0x38], 0
push ecx
lea ecx, [esp + 0x10]
call fcn.004199e1
xor esi, esi
cmp dword [edi + 8], esi
jle 0x46be72
mov eax, dword [edi]
lea edx, [esp + 0x1c]
mov ecx, dword [eax + esi*4]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
push ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.004199c7
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 0
call fcn.00419712
inc esi
cmp esi, dword [edi + 8]
jl 0x46be3e
lea ecx, [esp + 0xc]
call fcn.00419712
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46c987
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 8]
push eax
call fcn.00487445
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x10]
call fcn.004053ec
push 0
lea eax, [esp + 0x10]
push eax
push 0x508f5c
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
lea ecx, [esp + 8]
call fcn.0040b44b
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8

Function at 0x46e9aa
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8f71
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x10]
call fcn.0040527a
and dword [esp + 0x38], 0
push 0
lea eax, [esp + 0x10]
push eax
push 0x508f58
mov ecx, esi
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8

Function at 0x46ea5f
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 8]
push eax
call fcn.0041f8c4
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x10]
call fcn.004053ec
push 0
lea eax, [esp + 0x10]
push eax
push 0x50902c
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
lea ecx, [esp + 8]
call fcn.0040b44b
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8
Function at 0x46ebe0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 8]
push eax
call fcn.004475e2
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x10]
call fcn.004053ec
push 0
lea eax, [esp + 0x10]
push eax
push 0x509010
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
lea ecx, [esp + 8]
call fcn.0040b44b
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8

Function at 0x46ee8e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 8]
push eax
call fcn.004868dc
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x10]
call fcn.004053ec
push 0
lea eax, [esp + 0x10]
push eax
push 0x508f24
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
lea ecx, [esp + 8]
call fcn.0040b44b
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8

Function at 0x46ef6e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c8bd6
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x503298]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 8]
push eax
call fcn.004868dc
and dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x10]
call fcn.004053ec
push 0
lea eax, [esp + 0x10]
push eax
push 0x508ff4
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.00419819
lea ecx, [esp + 0xc]
call fcn.004051b3
lea ecx, [esp + 8]
call fcn.0040b44b
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a40c7
mov esp, ebp
pop ebp
ret 8
Function at 0x47ffe8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6f55
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
cmp byte [ebp + 0x18], 0
movss xmm0, dword [0x4ee3a8]
movaps xmm7, xmm0
jne 0x480028
cmp byte [ebp + 0x1c], 0
je 0x48004f
push 0x190000ff
lea ecx, [esp + 0x14]
call fcn.0041f2f4
mov ecx, dword [ebp + 8]
push eax
call fcn.0042695d
movss xmm7, dword [0x4ee3f4]
movss xmm0, dword [0x4ee3a8]
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], eax
movd xmm5, dword [ebp + 0x10]
movd xmm6, eax
cmovl eax, dword [ebp + 0x10]
movd xmm4, eax
cvtdq2ps xmm4, xmm4
cvtdq2ps xmm6, xmm6
mulss xmm4, dword [0x4ee3a0]
cvtdq2ps xmm5, xmm5
mulss xmm6, xmm0
mulss xmm5, xmm0
movaps xmm0, xmm4
mulss xmm0, dword [0x4ee564]
push 1
movaps xmm1, xmm5
push ecx
subss xmm1, xmm0
push ecx
lea eax, [esp + 0x20]
movaps xmm2, xmm7
mov ecx, 0x508e60
movss dword [esp + 4], xmm1
movss dword [esp], xmm6
push eax
movss dword [esp + 0x20], xmm6
movss dword [esp + 0x1c], xmm5
movss dword [esp + 0x18], xmm4
call fcn.0041f435
movaps xmm3, xmm4
mulss xmm4, dword [0x4ee368]
push eax
lea eax, [esp + 0x28]
push eax
movaps xmm2, xmm7
mov ecx, 0x508dd8
addss xmm3, xmm5
addss xmm4, xmm6
call fcn.0041f435
movaps xmm2, xmm4
push eax
lea ecx, [esp + 0x30]
call fcn.0041f910
mov ecx, dword [ebp + 8]
and dword [esp + 0x48], 0
push eax
call fcn.00426562
or dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.0041f993
movss xmm0, dword [esp + 8]
movss xmm2, dword [esp + 0xc]
movss xmm1, dword [esp + 0x10]
movaps xmm3, xmm0
mulss xmm3, dword [0x4ee4f0]
push ecx
mov ecx, dword [ebp + 8]
subss xmm2, xmm0
subss xmm1, xmm0
movss dword [esp], xmm3
call fcn.00426b40
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x480f06
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6d15
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push edi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x34]
call fcn.00421909
push dword [ebp + 0x14]
and dword [esp + 0x64], 0
push dword [ebp + 0x10]
mov eax, dword [edi]
lea ecx, [esp + 0x3c]
push ecx
push dword [ebp + 8]
mov ecx, edi
call dword [eax + 0x154]
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
call fcn.00479fdf
movd xmm2, dword [esp + 0x10]
movd xmm1, dword [esp + 0xc]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
lea ecx, [esp + 0x1c]
call fcn.0042038e
push eax
lea ecx, [esp + 0x38]
call fcn.00423137
movss xmm2, dword [0x4ee3a8]
and dword [esp + 0xc], 0
lea eax, [esp + 0x34]
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x18]
push eax
mov ecx, 0x508e60
mov dword [esp + 0x24], 1
call fcn.0041f435
push eax
lea ecx, [esp + 0x30]
call fcn.00449cd6
mov ecx, eax
call fcn.00449cfb
push dword [ebp + 0x14]
mov eax, dword [edi]
push dword [ebp + 0x10]
lea ecx, [esp + 0x3c]
push ecx
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call dword [eax + 0x158]
push dword [ebp + 0x14]
mov eax, dword [edi]
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x14c]
lea ecx, [esp + 0x34]
call fcn.0040971a
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x481f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 0x28], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
je 0x481f6e
push 0x1000540
lea eax, [esp + 0x10]
push eax
call fcn.0047b159
push eax
mov ecx, edi
call fcn.0042695d
push 0x508e60
mov ecx, edi
call fcn.004264ff
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
test ecx, ecx
je 0x481fab
cmp dword [ecx], 0
je 0x481fab
push ecx
lea eax, [esp + 0x10]
push eax
lea eax, [ebx - 4]
push eax
push 0x1c
push 2
push 2
push ecx
mov ecx, edi
mov dword [esp + 0x28], 0x124
call fcn.00426f74
jmp 0x482013
cmp byte [ebp + 0x24], 0
mov eax, dword [esi]
mov ecx, esi
je 0x481fba
call dword [eax + 0x7c]
jmp 0x481fc0
call dword [eax + 0x80]
test eax, eax
je 0x482013
movd xmm0, ebx
push ecx
cvtdq2ps xmm0, xmm0
mov dword [esp], 0x3f800000
subss xmm0, dword [0x4ee564]
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x20]
push ecx
push edi
mov ecx, eax
mov dword [esp + 0x1c], 0x124
mov dword [esp + 0x28], 0x40000000
mov dword [esp + 0x2c], 0x40000000
mov dword [esp + 0x30], 0x41e00000
movss dword [esp + 0x34], xmm0
call fcn.0046986c
push 0x1000541
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.0047b159
push eax
mov ecx, edi
call fcn.004264ff
movd xmm1, dword [ebp + 0x10]
cvtdq2ps xmm1, xmm1
mov ecx, edi
mulss xmm1, dword [0x4ee3c4]
call fcn.00426621
mov eax, dword [ebp + 0xc]
cmp eax, 0x1c2
jle 0x482146
cmp byte [ebp + 0x24], 0
jne 0x482146
movd xmm2, eax
cvtdq2ps xmm2, xmm2
push ecx
movaps xmm0, xmm2
mulss xmm0, dword [0x4ee3c4]
mulss xmm2, dword [0x4ee3d0]
cvtss2sd xmm0, xmm0
mov dword [esp], 0x3f333333
addsd xmm0, qword [0x4ee650]
push 1
lea eax, [esp + 0x14]
push eax
push ebx
movsd qword [esp + 0x28], xmm0
mov esi, dword [esp + 0x28]
cvtps2pd xmm0, xmm2
lea eax, [esi - 0x20]
addsd xmm0, qword [0x4ee650]
push eax
push 0
push 0x20
push dword [ebp + 0x14]
mov ecx, edi
movsd qword [esp + 0x30], xmm0
mov dword [esp + 0x2c], 0x21
call fcn.0042682a
movd xmm0, dword [ebp + 0x10]
cvtdq2ps xmm1, xmm0
mov ecx, edi
mulss xmm1, dword [0x4ee3a8]
call fcn.00426621
push 0x508d60
mov ecx, edi
call fcn.004264ff
push ecx
lea eax, [esp + 0x10]
mov dword [esp], 0x3f333333
push 1
push eax
mov eax, dword [esp + 0x1c]
push ebx
sub eax, esi
sub eax, 8
push eax
push 0
push esi
push dword [ebp + 0x1c]
mov ecx, edi
mov dword [esp + 0x2c], 0x22
call fcn.0042682a
push ecx
lea eax, [esp + 0x10]
mov dword [esp], 0x3f333333
push 1
push eax
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x1c]
push ebx
sub eax, 8
push eax
push 0
push dword [esp + 0x28]
mov dword [esp + 0x28], 0x22
push dword [ebp + 0x20]
jmp 0x482169
push ecx
lea ecx, [esp + 0x10]
mov dword [esp], 0x3f333333
push 1
push ecx
push ebx
add eax, 0xffffffe0
push eax
push 0
push 0x20
push dword [ebp + 0x14]
mov dword [esp + 0x2c], 0x21
mov ecx, edi
call fcn.0042682a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x2c

Function at 0x48cc87
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x80]
pop ebp
jmp fcn.0048e0ad
Function at 0x496052
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c787d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x503298]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esp + 0x10]
call fcn.00495e4c
and dword [esp + 0x30], 0
or dword [esp + 0x1c], 0xffffffff
or dword [esp + 0x20], 0xffffffff
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00495e91
and dword [esi + 0x34], 0
lea ecx, [esp + 0x18]
mov bl, al
call fcn.0040b44b
lea ecx, [esp + 0xc]
call fcn.0040cfc7
mov al, bl
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x499ece
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
call fcn.00461951
test al, al
jne 0x499efa
cmp dword [esi + 0x54], 0
jbe 0x499efa
call fcn.0040e28e
mov ecx, dword [esi + 0x54]
add ecx, 0x1e
cmp eax, ecx
jbe 0x499efa
mov ecx, esi
pop esi
jmp fcn.0049b079
pop esi
ret

Function at 0x49a662
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
xor esi, esi
call edi
push 1
shr eax, 0xf
test al, 1
pop eax
push 0x11
cmovne esi, eax
call edi
shr eax, 0xf
test al, 1
je 0x49a68d
or esi, 2
push 0x12
call edi
shr eax, 0xf
test al, 1
je 0x49a69b
or esi, 4
push 0xa5
call edi
shr eax, 0xf
test al, 1
je 0x49a6ac
and esi, 0xfffffff9
mov eax, dword [0x50904c]
and eax, 0x70
push eax
lea ecx, [ebp - 4]
call fcn.0041f2f4
mov eax, dword [ebp - 4]
or eax, esi
push eax
lea ecx, [ebp - 4]
call fcn.0041f2f4
mov eax, ecx
push eax
mov ecx, 0x50904c
call fcn.0040b22d
pop edi
pop esi
leave
ret
Function at 0x49ba49
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
call fcn.0049a662
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 0x5d
ja 0x49bb06
cmp esi, 0x5b
jae 0x49bb6b
cmp esi, 0x10
jb 0x49baa3
cmp esi, 0x12
jbe 0x49bb6b
cmp esi, 0x14
je 0x49bb6b
cmp esi, 0x20
jbe 0x49baa3
cmp esi, 0x28
jbe 0x49bb29
cmp esi, 0x2c
jbe 0x49baa3
cmp esi, 0x2e
jbe 0x49bb29
push 1
mov ecx, edi
call fcn.004958a7
push 0
push 0x103
push 0x102
push dword [edi + 0x44]
mov bl, al
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x49baeb
push 2
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
push 0
push eax
mov ecx, edi
call fcn.00495734
test al, al
jne 0x49bae9
test bl, bl
je 0x49baef
mov bl, 1
test bl, bl
jne 0x49bafa
xor ebx, ebx
call fcn.00462a68
test eax, eax
je 0x49bafd
xor ebx, ebx
inc ebx
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 4
cmp esi, 0x91
ja 0x49bb5c
cmp esi, 0x90
jae 0x49bb6b
cmp esi, 0x6a
jb 0x49baa3
cmp esi, 0x6f
jbe 0x49bb4f
cmp esi, 0x7f
ja 0x49baa3
push 1
mov ecx, edi
call fcn.004958a7
push ebx
or esi, 0x10000
push esi
mov ecx, edi
mov byte [ebp + 0xb], al
call fcn.00495734
test al, al
jne 0x49bafa
cmp byte [ebp + 0xb], bl
je 0x49baf1
jmp 0x49bafa
push 1
mov ecx, edi
call fcn.004958a7
mov bl, al
jmp 0x49baeb
lea eax, [esi - 0xa0]
cmp eax, 5
ja 0x49baa3
mov ecx, edi
call fcn.0049b9b4
jmp 0x49baf1

Function at 0x49bb77
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov dword [ebp - 4], ecx
call fcn.0049a662
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
sar edx, 0x10
lea eax, [edi - 0x30]
and edx, 0xff
mov ebx, edi
cmp eax, 9
ja 0x49bbc3
cmp edx, 0x47
jl 0x49bbef
cmp edx, 0x49
jle 0x49bbbb
cmp edx, 0x4a
jle 0x49bbef
cmp edx, 0x4d
jle 0x49bbbb
lea eax, [edx - 0x4f]
cmp eax, 3
ja 0x49bbef
add edi, 0x10030
jmp 0x49bbef
push 1
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
test eax, eax
cmovne edi, eax
cmp ebx, 0x20
jae 0x49bbef
test byte [0x50904c], 6
push 0
pop eax
cmovne ebx, eax
mov ecx, dword [ebp - 4]
push ebx
push edi
call fcn.00495734
pop edi
pop ebx
leave
ret 8

Function at 0x49caa3
Capabilities:
Log keystrokes via input method manager

Disassembly:
push 8
mov eax, 0x4c7258
call fcn.004ab9ba
xor esi, esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov edi, eax
test edi, edi
jle 0x49cb09
push esi
mov dword [ebp - 4], esi
call fcn.004a50b4
mov eax, edi
shr eax, 1
inc eax
push 2
push eax
call fcn.004a7f66
add esp, 0xc
mov esi, eax
push edi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
push dword [ebp + 0xc]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ecx, dword [ebp + 8]
push esi
call fcn.0040b529
push esi
call fcn.004a50b4
mov eax, dword [ebp + 8]
pop ecx
jmp 0x49cb18
mov ecx, dword [ebp + 8]
push 0x508c2c
call fcn.0040b450
mov eax, ecx
call fcn.004ab988
ret 0xc