joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475070
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4751b8
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x4751d0
mov dl, 4
mov eax, dword [ebp - 4]
call fcn.0047617c
mov eax, dword [ebp - 4]
call fcn.00475b78
xor edx, edx
push ebp
push 0x47519b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x47513a
test si, si
jne 0x4750e0
mov eax, dword [ebp - 8]
call fcn.004095c0
mov esi, eax
cmp esi, 0xffff
jbe 0x4750e0
call fcn.0040373c
movzx ebx, si
push 0
push ebx
movzx eax, si
sub eax, ebx
mov edx, dword [ebp - 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x47513a
cmp eax, 0xffffffff
jle 0x47510f
sub ebx, eax
jmp 0x47511e
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, dword [ebp - 4]
call fcn.004760b0
test ebx, ebx
je 0x47513a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
jne 0x47513a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x100bd], 0
je 0x4750e3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10098], 0
je 0x475185
mov eax, dword [ebp - 4]
mov byte [eax + 0x10098], 0
mov ecx, 0x4751e8
mov dl, 1
mov eax, dword [0x474228]
call fcn.0040c72c
call fcn.00403fc8
mov eax, dword [ebp - 4]
cmp word [eax + 0x1010a], 0
je 0x475185
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4751a2
mov eax, dword [ebp - 4]
call fcn.00475bdc
ret
Function at 0x475664
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47580f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x475824
mov dl, 8
mov eax, ebx
call fcn.0047617c
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0041bc68
cmp byte [ebx + 0x10098], 0
jne 0x4757bb
xor eax, eax
mov dword [ebx + 0x10094], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4756c8
call fcn.0040373c
mov dword [ebx + 0x100c4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041bc48
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push eax
sar eax, 0x1f
cmp eax, edx
pop eax
je 0x4756f6
call fcn.0040373c
cmp eax, 0x10000
jle 0x475702
mov eax, 0x10000
lea edx, [ebx + 0x30]
mov ecx, eax
mov eax, dword [ebp - 4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push 0
push esi
mov eax, dword [ebp - 8]
sub eax, esi
cmp eax, 0x10000
jbe 0x475729
call fcn.0040373c
lea eax, [ebx + eax + 0x30]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_send
test eax, eax
je 0x4757f9
test eax, eax
jle 0x475769
sub esi, eax
add dword [ebx + 0x10094], eax
cmp word [ebx + 0x100da], 0
je 0x475777
mov edx, ebx
mov eax, dword [ebx + 0x100dc]
call dword [ebx + 0x100d8]
jmp 0x475777
lea ecx, [ebp - 0xc]
mov dx, 0x2733
mov eax, ebx
call fcn.004760b0
mov eax, dword [0x538c6c]
mov eax, dword [eax]
call fcn.00471f94
test esi, esi
je 0x475790
cmp byte [ebx + 0x10098], 0
je 0x475715
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041bc48
cmp edx, dword [esp + 4]
jne 0x4757aa
cmp eax, dword [esp]
pop edx
pop eax
je 0x4757bb
cmp byte [ebx + 0x10098], 0
je 0x4756ce
cmp byte [ebx + 0x10098], 0
je 0x4757f9
mov byte [ebx + 0x10098], 0
mov ecx, 0x475838
mov dl, 1
mov eax, dword [0x474228]
call fcn.0040c72c
call fcn.00403fc8
cmp word [ebx + 0x1010a], 0
je 0x4757f9
mov edx, ebx
mov eax, dword [ebx + 0x1010c]
call dword [ebx + 0x10108]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475816
lea eax, [ebp - 0xc]
call fcn.00404610
ret
Function at 0x475c10
Capabilities:
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x475d19
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x475d30
mov dl, 8
mov eax, ebx
call fcn.0047617c
test byte [ebx + 0x1c], 0x10
setne al
xor al, 1
and al, byte [0x539bf4]
je 0x475d03
xor eax, eax
push ebp
push 0x475ce3
push dword fs:[eax]
mov dword fs:[eax], esp
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x475c79
call fcn.0040373c
mov word [ebx + 0x10110], si
mov word [ebp - 4], 0
mov word [ebp - 2], 0
push 4
lea eax, [ebp - 4]
push eax
push 0x80
push 0xff7f
movzx eax, si
push eax
call sub.wsock32.dll_setsockopt
cmp word [ebx + 0x10110], 0xffff
jne 0x475cbe
lea ecx, [ebp - 8]
mov dx, 0x2733
mov eax, ebx
call fcn.004760b0
push 0x3f
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475d03
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475d20
lea eax, [ebp - 8]
call fcn.00404610
ret

Function at 0x475ffc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov ecx, 0x476098
mov dl, 4
mov eax, ebx
call fcn.0047617c
mov byte [ebx + 0x10118], 0
mov ax, word [ebx + 0x10110]
cmp ax, 0xffff
je 0x47608a
movzx eax, ax
push eax
call sub.wsock32.dll_closesocket
test byte [ebx + 0x1c], 8
jne 0x476049
cmp word [ebx + 0x1005a], 0
je 0x476049
mov edx, ebx
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
cmp byte [ebx + 0x10099], 0
jne 0x47608a
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
cmp esi, 0xffff
jbe 0x47606c
call fcn.0040373c
mov word [ebx + 0x10110], si
push 0x3d
push 0x465
mov eax, dword [ebx + 0x10114]
push eax
movzx eax, si
push eax
call sub.wsock32.dll_WSAAsyncSelect
pop esi
pop ebx
ret
Function at 0x476224
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x100b8]
cmp dword [eax + 4], 0
setg byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x4762e8
push 2
push 1
lea eax, [ebp - 6]
push eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x10110]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x476275
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
call fcn.00475fa8
jmp 0x4762e8
test eax, eax
jne 0x4762e8
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x4762b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10118], 0
je 0x4762a7
mov eax, dword [ebp - 4]
call fcn.004762f4
mov eax, dword [ebp - 4]
call fcn.00475ffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4762bb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10034]
call fcn.0042f468
mov eax, dword [ebp - 4]
cmp word [eax + 0x1005a], 0
je 0x4762e8
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x1005c]
call dword [ebx + 0x10058]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4762f4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x4762fb
mov eax, dword [esp + 0x10000]
mov ebx, eax
mov ecx, 0x476348
mov dl, 8
mov eax, ebx
call fcn.0047617c
push 0
push 0x10000
lea eax, [esp + 8]
push eax
movzx eax, word [ebx + 0x10110]
push eax
call sub.wsock32.dll_recv
add esp, 0x10004
pop ebx
ret

Function at 0x476574
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
mov dword [ebp - 4], edx
mov ecx, 0x476634
mov dl, 8
call fcn.0047617c
mov eax, 0xc8
call fcn.004088fc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47661f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostname
mov eax, dword [ebp - 8]
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
xor eax, eax
mov al, byte [esi]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [esi + 1]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
xor eax, eax
mov al, byte [esi + 2]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov al, byte [esi + 3]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x28]
mov ecx, 3
mov eax, 0x476650
call fcn.00409c9c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476626
mov eax, dword [ebp - 8]
call fcn.00402764
ret
Function at 0x477900
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
test ebx, ebx
js 0x477918
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x477911
mov edx, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor esi, esi
cmp dword [ebp + 8], 0
jne 0x4779b3
test esi, esi
jle 0x47794a
mov ecx, 0x477a5c
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040c72c
call fcn.00403fc8
jmp 0x4779a9
cmp word [ebx + 0xa4a], 0
jne 0x47796c
mov ecx, 0x477a5c
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040c72c
call fcn.00403fc8
jmp 0x4779a9
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ebp - 9]
mov eax, dword [ebx + 0xa4c]
call dword [ebx + 0xa48]
cmp byte [ebp - 9], 0
jne 0x4779a8
mov ecx, 0x477a5c
mov dl, 1
mov eax, dword [0x407cb4]
call fcn.0040c72c
call fcn.00403fc8
jmp 0x4779a9
inc esi
cmp dword [ebp + 8], 0
je 0x47792e
mov byte [ebx + 0x870], 0
mov eax, ebx
call fcn.00477794
cmp dword [ebx + 0x848], 0
jne 0x4779e0
mov ecx, 0x477a74
mov dl, 1
mov eax, dword [0x477014]
call fcn.0040c72c
call fcn.00403fc8
mov ecx, 0x477a90
mov dl, 2
mov eax, ebx
call fcn.00477c64
mov word [ebx + 0x844], 2
mov ax, word [ebx + 0x83c]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0x846], ax
mov eax, 0x10
push eax
lea eax, [ebx + 0x844]
push eax
push 0
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebx + 0xa54]
push eax
call sub.wsock32.dll_sendto
cmp word [ebx + 0xa32], 0
je 0x477a46
mov edx, ebx
mov eax, dword [ebx + 0xa34]
call dword [ebx + 0xa30]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 4

Function at 0x477d58
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x477e2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x800
lea eax, [ebx + 0x30]
push eax
mov eax, dword [ebx + 0xa54]
push eax
call sub.wsock32.dll_recvfrom
mov dword [ebx + 0x834], eax
cmp word [ebx + 0xa2a], 0
je 0x477e16
lea eax, [ebp - 8]
push eax
xor eax, eax
mov al, byte [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
xor eax, eax
mov al, byte [ebp - 0x13]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov al, byte [ebp - 0x12]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
lea edx, [ebp - 0x38]
mov ecx, 3
mov eax, 0x477e40
call fcn.00409c9c
mov ax, word [ebp - 0x16]
push eax
call sub.wsock32.dll_ntohs
mov edx, dword [ebp - 8]
push edx
movzx eax, ax
push eax
mov ecx, dword [ebx + 0x834]
mov edx, ebx
mov eax, dword [ebx + 0xa2c]
call dword [ebx + 0xa28]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477e33
lea eax, [ebp - 8]
call fcn.00404610
ret
Function at 0x477ec4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x477ecd
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404ac0
xor eax, eax
push ebp
push 0x477fdf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004093b4
test al, al
je 0x477fb7
xor ecx, ecx
push ebp
push 0x477fad
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x20
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x417498]
call fcn.0041c160
mov dword [ebp - 0x10], eax
jmp 0x477f7d
lea edx, [ebp - 0x2010]
mov ecx, 0x2000
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, eax
test edx, edx
jle 0x477f7d
lea eax, [ebp - 0x2010]
mov ecx, dword [ebp - 0xc]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ebx
mov bl, byte [eax]
xor ebx, dword [ebp - 0xc]
and ebx, 0xff
xor ecx, dword [ebx*4 + 0x536c9c]
mov dword [ebp - 0xc], ecx
inc eax
dec edx
jne 0x477f56
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 0x10]
call fcn.0041bc48
cmp edx, dword [esp + 4]
jne 0x477f97
cmp eax, dword [esp]
pop edx
pop eax
jne 0x477f37
mov eax, dword [ebp - 0x10]
call fcn.004037fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x477fb7
mov eax, dword [ebp - 0xc]
xor eax, 0x38259662
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
not dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477fe6
lea eax, [ebp - 4]
call fcn.00404610
ret
Function at 0x47bd04
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47bd32
mov eax, ebx
call fcn.0047c7b8
cmp dword [ebx + 0x40], 0
je 0x47bd2b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47bda3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47bd95
cmp dword [ebx + 8], 0
je 0x47bd54
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47bd66
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47bd95
cmp dword [ebx + 8], 0
je 0x47bd47
cmp eax, 3
je 0x47bd79
dec eax
jne 0x47bd47
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47bd47
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47bd47
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47bdc1
cmp dword [ebx + 0x14], 0xcc
je 0x47bdc1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047bdcc
pop ebx
ret
Function at 0x494bd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x494e38
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x494c3b
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004946f0
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040d0e0
cmp al, 1
jne 0x494c3b
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004949b8
test al, al
je 0x494dc7
cmp dword [ebp - 8], 0
jge 0x494c59
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004946f0
mov eax, dword [ebp - 0x210]
call fcn.004048d0
cmp ebx, eax
jge 0x494ca3
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004946f0
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x538e24]
and eax, 0xff
bt dword [edx], eax
jae 0x494ca3
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x494cb7
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00494bb4
cmp ebx, dword [ebp - 8]
je 0x494db9
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x494ce3
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039f8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5387dc]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x494da6
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039f8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5387dc]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.004039f8
and eax, 0x7f
movzx eax, word [eax*2 + 0x5387dc]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494dad
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x494e1a
cmp dword [ebp - 8], 0
jge 0x494dd2
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004946f0
mov eax, dword [ebp - 0x218]
call fcn.004048d0
cmp eax, dword [ebp - 8]
jg 0x494e0c
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004946f0
mov eax, dword [ebp - 0x21c]
call fcn.004048d0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00494bb4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x494e3f
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.00404634
ret
Function at 0x496d54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x496d8c]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x496d6a
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x496d79
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x496d88
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4976c8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x44e414]
call fcn.00403988
test al, al
je 0x49770a
mov eax, dword [0x538c6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x49770a
mov edx, dword [0x538c6c]
xor edx, edx
call fcn.0046b724
push 0
mov eax, dword [0x538c6c]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret

Function at 0x4a7d30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404ac0
xor eax, eax
push ebp
push 0x4a7e4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4a7e37
cmp dword [eax + 0x408], 0
je 0x4a7e37
cmp byte [ebx + 0x30c], 0
je 0x4a7db8
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0x1f4
jb 0x4a7d91
lea eax, [ebx + 0x308]
call fcn.00404610
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea eax, [ebx + 0x308]
mov edx, dword [ebp - 4]
call fcn.004048d8
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x308]
call fcn.004046a8
mov eax, dword [ebp - 4]
call fcn.004048d0
test eax, eax
jle 0x4a7e27
mov eax, dword [ebp - 4]
call fcn.004048d0
dec eax
jne 0x4a7dfe
mov eax, dword [ebp - 4]
call fcn.00404ad0
push eax
mov eax, ebx
call fcn.004a8964
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x408]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
jmp 0x4a7e2a
mov eax, dword [ebp - 4]
call fcn.00404ad0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x408]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
jmp 0x4a7e2a
or eax, 0xffffffff
test eax, eax
jl 0x4a7e37
mov edx, eax
mov eax, ebx
call fcn.004a8970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7e54
lea eax, [ebp - 4]
call fcn.00404610
ret
Function at 0x4a7e58
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7fa8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x368]
test eax, eax
je 0x4a7f80
cmp dword [eax + 0x408], 0
je 0x4a7f80
call sub.kernel32.dll_GetTickCount_1
sub eax, dword [ebx + 0x304]
cmp eax, 0xc8
jbe 0x4a7f80
call sub.kernel32.dll_GetTickCount_1
mov dword [ebx + 0x304], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00452634
mov eax, dword [ebp - 0xc]
call fcn.004048d0
dec eax
jne 0x4a7f00
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00452634
mov eax, dword [ebp - 0x10]
call fcn.00404ad0
push eax
mov eax, ebx
call fcn.004a8964
push eax
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x408]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4a7f33
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00452634
mov eax, dword [ebp - 0x14]
call fcn.00404ad0
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x368]
mov eax, dword [eax + 0x408]
call fcn.00458e1c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4a7f80
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00452634
mov edx, esi
mov eax, ebx
call fcn.004a8970
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00452634
mov eax, dword [ebp - 4]
call fcn.004048d0
mov edx, eax
mov eax, ebx
call fcn.004a8010
mov eax, dword [ebp - 8]
call fcn.004048d0
push eax
mov eax, dword [ebp - 4]
call fcn.004048d0
pop edx
sub edx, eax
mov eax, ebx
call fcn.004a802c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7faf
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404634
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404634
ret