joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a7b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov ebx, eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add ebx, edx
mov ecx, dword [ebp + 8]
mov ecx, edx
mov edx, dword [ebp + 8]
mov edx, ebx
call fcn.0040321c
add ebx, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x40]
add esi, esi
add esi, esi
sub esi, 5
test esi, esi
jl 0x46a864
inc esi
mov edi, dword [ebx]
mov eax, edi
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x5bc528]
mov edx, 8
call fcn.004508a4
and edi, 0xff
xor eax, dword [edi*4 + 0x5bc528]
push eax
mov eax, dword [ebx]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x5bc528]
mov edx, 0x10
call fcn.004508a4
pop edx
xor edx, eax
push edx
mov eax, dword [ebx]
shr eax, 0x18
mov eax, dword [eax*4 + 0x5bc528]
mov edx, 0x18
call fcn.004508a4
pop edx
xor edx, eax
mov dword [ebx], edx
add ebx, 4
dec esi
jne 0x46a7f9
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x46b1d8
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov dword [ebp - 4], edx
lea eax, [ebp - 0x100]
xor ecx, ecx
mov edx, 0x80
call fcn.00403a20
mov dword [ebp - 8], 0x38
mov eax, 0x5bca28
lea edx, [ebp - 0x48]
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
mov esi, 0x80
shr esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x46b22c
mov byte [edx], 1
jmp 0x46b22f
mov byte [edx], 0
inc edx
inc eax
dec dword [ebp - 8]
jne 0x46b207
xor eax, eax
mov dword [ebp - 8], eax
mov esi, 0x5bd3b0
cmp byte [ebp + 8], 0
je 0x46b255
mov eax, 0xf
sub eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
jmp 0x46b25d
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
xor eax, eax
lea edx, [ebp - 0x80]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x1c
jae 0x46b27c
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x46b283
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x1c
jne 0x46b269
mov eax, 0x1c
lea edx, [ebp - 0x64]
movzx ecx, byte [esi]
add ecx, eax
cmp ecx, 0x38
jae 0x46b2a5
movzx ecx, byte [ebp + ecx - 0x48]
mov byte [edx], cl
jmp 0x46b2ac
movzx ecx, byte [ebp + ecx - 0x64]
mov byte [edx], cl
inc eax
inc edx
cmp eax, 0x38
jne 0x46b292
mov ecx, 0x1000000
mov eax, 0x18
mov edx, 0x5bca60
shr ecx, 1
movzx ebx, byte [edx]
cmp byte [ebp + ebx - 0x80], 0
je 0x46b2d8
mov ebx, dword [ebp - 0xc]
or dword [ebp + ebx*4 - 0x100], ecx
movzx ebx, byte [edx + 0x18]
cmp byte [ebp + ebx - 0x80], 0
je 0x46b2ed
mov ebx, dword [ebp - 0x10]
or dword [ebp + ebx*4 - 0x100], ecx
inc edx
dec eax
jne 0x46b2c2
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], 0x10
jne 0x46b240
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0xfc0000
shl ecx, 6
and eax, 0xfc0
shl eax, 0xa
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0xfc0000
shr eax, 0xa
or ecx, eax
and edx, 0xfc0
shr edx, 6
or ecx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
add dword [ebp + 0xc], 4
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x100]
mov ecx, eax
and ecx, 0x3f000
shl ecx, 0xc
and eax, 0x3f
shl eax, 0x10
or ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x100]
mov eax, edx
and eax, 0x3f000
shr eax, 4
or ecx, eax
and edx, 0x3f
or ecx, edx
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
add dword [ebp + 0xc], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x46b304
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46bcbc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
add eax, eax
mov dword [ebp + 0xc], eax
lea edx, [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.004601e8
shr dword [ebp + 0xc], 1
lea eax, [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00403a20
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [ebp + 0xc]
call fcn.0040321c
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 8
call fcn.00403a20
lea edx, [ebp - 0x14]
mov eax, esi
mov ecx, dword [ebp + 0xc]
call fcn.0040321c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
push 0
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.0046b1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
add eax, 0x80
push eax
push 1
lea edx, [ebp - 0xc]
mov ecx, 7
mov eax, dword [ebp - 4]
call fcn.0046b1d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x100]
lea eax, [ebp - 0x14]
mov ecx, 8
call fcn.0040321c
lea eax, [ebp - 0x1c]
xor ecx, ecx
mov edx, 8
call fcn.00403a20
mov edi, 8
lea esi, [ebp - 0xc]
movzx ebx, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.0040321c
movzx eax, bl
movzx eax, byte [eax + 0x5bd3c0]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x46bd81
mov edi, 8
lea esi, [ebp - 0x14]
movzx ebx, byte [ebp - 0x1c]
xor bl, byte [ebp - 0x1b]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x1b]
mov ecx, 7
call fcn.0040321c
movzx eax, bl
movzx eax, byte [eax + 0x5bd3c0]
xor al, byte [esi]
mov byte [ebp - 0x15], al
inc esi
dec edi
jne 0x46bdb3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
lea edx, [eax + 0x108]
lea eax, [ebp - 0x1c]
mov ecx, 8
call fcn.0040321c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46be50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ecx, 0x5bd290
mov esi, 8
movzx ebx, byte [eax]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
movzx ebx, byte [eax + 1]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
movzx ebx, byte [eax + 2]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
movzx ebx, byte [eax + 3]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 7], bl
inc edx
movzx ebx, byte [eax + 4]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 1], bl
inc edx
movzx ebx, byte [eax + 5]
xor bl, byte [eax + 4]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 2], bl
movzx ebx, byte [eax + 6]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 3], bl
inc edx
movzx ebx, byte [eax + 7]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax], bl
inc edx
dec esi
jne 0x46be5c
movzx ebx, byte [eax]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 4], bl
inc edx
movzx ebx, byte [eax + 1]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 5], bl
inc edx
movzx ebx, byte [eax + 2]
xor bl, byte [edx]
movzx ebx, bl
movzx ebx, byte [ecx + ebx]
xor byte [eax + 6], bl
inc edx
movzx ebx, byte [eax + 3]
xor bl, byte [edx]
movzx edx, bl
movzx edx, byte [ecx + edx]
xor byte [eax + 7], dl
pop esi
pop ebx
ret

Function at 0x470a0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
push ebx
push esi
xor eax, eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd4], eax
xor eax, eax
push ebp
push 0x470adb
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, byte [0x470aec]
mov byte [ebp - 1], al
push 0xc8
lea eax, [ebp - 0xc9]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
xor ebx, ebx
mov esi, 0x5bd53c
lea eax, [ebp - 0xd4]
lea edx, [ebp - 0xc9]
mov ecx, 0xc8
call fcn.00405630
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.0040fcf4
lea eax, [ebp - 0xd0]
mov edx, dword [esi]
call fcn.0040568c
mov eax, dword [ebp - 0xd0]
call fcn.0040b020
test al, al
je 0x470ab4
mov edx, ebx
lea eax, [ebp - 0xd8]
mov cl, 1
call fcn.00403dc4
movzx eax, byte [ebp - 0xd8]
or al, byte [ebp - 1]
mov byte [ebp - 1], al
inc ebx
add esi, 4
cmp bl, 3
jne 0x470a55
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470ae2
lea eax, [ebp - 0xd4]
mov edx, 2
call fcn.004053e4
ret
Function at 0x48e5b8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405840
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x48e6d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0xa4]
call fcn.00407710
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x48e6e8
call fcn.0040ba0c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
call fcn.00407710
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0xa0]
call fcn.00407710
jmp 0x48e685
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0x64]
call fcn.00407710
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.004d3464
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0040a464
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
call fcn.00407710
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0x70]
call fcn.00407710
cmp byte [ebp - 0x20], 0
je 0x48e639
mov eax, dword [ebx]
push eax
mov eax, dword [eax]
call dword [eax + 0xa4]
call fcn.00407710
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e6db
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004053e4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053e4
ret
Function at 0x4934f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4934f6
ret
Function at 0x49d61c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004053c0
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x49d66a
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00405630
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2744
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a2877
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.user32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x44ed24]
call fcn.0044edf4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4a284d
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0044ee94
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405630
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4a288c
call fcn.004056d8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0044eef8
lea ecx, [ebp - 4]
mov edx, 0x4a28c8
mov eax, dword [ebp - 0xc]
call fcn.0044f140
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.00411558
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4a2830
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4a28d4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x5be1cc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a2837
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret

Function at 0x4a2924
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4a296b
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a294e
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a295f
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4a296b
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4a745c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 9]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x5c3d9c], 0
je 0x4a75a5
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x5bec9c]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4a75a5
mov eax, dword [0x5c3da0]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x5c3d9c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4a7574
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x5c3d9c]
call fcn.004206b0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4a756c
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1da], 0
je 0x4a756c
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x4a756c
mov eax, dword [ebp - 0x14]
call fcn.004b1b14
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4a756c
push ebp
call fcn.004a7418
pop ecx
test al, al
jne 0x4a756c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00404620
test al, al
je 0x4a756c
mov byte [ebp - 1], 1
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00404620
cmp byte [ebp - 1], 0
je 0x4a756c
push dword [ebp - 5]
push dword [ebp - 9]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4a756c
mov edx, dword [ebp - 0x14]
mov eax, dword [0x5c3da0]
call fcn.004a6b88
inc edi
dec ebx
jne 0x4a74c1
mov eax, dword [0x5c3da0]
cmp dword [eax + 8], 0
jle 0x4a758c
mov eax, dword [0x5c3da0]
call fcn.004a6c40
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4a75a5
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004a727c
pop ecx
test al, al
jne 0x4a75a5
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ae9ec
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.00408010
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.004a97e4
test ebx, ebx
jne 0x4aea3f
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.004ae928
mov ebx, eax
test ebx, ebx
je 0x4aeb2a
cmp esi, ebx
je 0x4aea68
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x4aea7d
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x4aeab5
add eax, 0xffffff5f
sub eax, 2
jb 0x4aeacd
dec eax
sub eax, 2
jb 0x4aeae1
dec eax
sub eax, 2
jb 0x4aead7
jmp 0x4aeaeb
add eax, 0xfffffdff
sub eax, 2
jb 0x4aeacd
dec eax
sub eax, 2
jb 0x4aeae1
dec eax
sub eax, 2
jb 0x4aead7
jmp 0x4aeaeb
mov byte [esp + 0x120], 0
jmp 0x4aeaf3
mov byte [esp + 0x120], 2
jmp 0x4aeaf3
mov byte [esp + 0x120], 1
jmp 0x4aeaf3
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004bd308
mov byte [esp + 0x121], al
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.004aaf54
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x4aeb2c
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0x4b6c7c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5bef04]
cmp byte [eax + 0xc], 0
je 0x4b6de9
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b6de2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5c3dac], 0
jne 0x4b6cd0
push 0x4b6df0
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4b6df8
push ebx
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dac], eax
cmp dword [0x5be314], 0
jne 0x4b6dcb
push 0x4b6e08
call sub.kernel32.dll_LoadLibraryA
mov dword [0x5be314], eax
cmp dword [0x5be314], 0
je 0x4b6dcb
push 0x4b6e14
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3db0], eax
push 0x4b6e24
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3db4], eax
push 0x4b6e38
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3db8], eax
push 0x4b6e50
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dbc], eax
push 0x4b6e68
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dc0], eax
push 0x4b6e7c
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dc4], eax
push 0x4b6e94
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dc8], eax
push 0x4b6eac
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dcc], eax
push 0x4b6ec8
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dd0], eax
push 0x4b6ed4
mov eax, dword [0x5be314]
push eax
call sub.kernel32.dll_GetProcAddress_2
mov dword [0x5c3dd4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b6de9
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x4bce34
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov edi, eax
push 0xffffffffffffffec
push edi
call sub.user32.dll_GetWindowLongA
mov esi, eax
test bl, bl
je 0x4bce55
test esi, 0x40000
je 0x4bce6f
test bl, bl
jne 0x4bcf09
mov eax, esi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4bcf09
push edi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push edi
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4bcea2
mov eax, dword [0x5c3df0]
cmp edi, dword [eax + 0x30]
jne 0x4bce9e
mov eax, dword [0x5c3df0]
cmp byte [eax + 0x5b], 0
jne 0x4bcea2
xor eax, eax
jmp 0x4bcea4
mov al, 1
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4bcebb
push 0
push edi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4bced0
or esi, 0x40000
push esi
push 0xffffffffffffffec
push edi
call sub.user32.dll_SetWindowLongA
jmp 0x4bcedf
and esi, 0xfffbffff
push esi
push 0xffffffffffffffec
push edi
call sub.user32.dll_SetWindowLongA
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4bcef0
cmp byte [esp + 2], 0
je 0x4bcf09
cmp byte [esp + 2], 0
je 0x4bcf01
push 6
push edi
call sub.user32.dll_ShowWindow
jmp 0x4bcf09
push 5
push edi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4bd1ac
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4bd1d2
mov eax, esp
push eax
push 0x4bd174
call sub.user32.dll_EnumWindows
jmp 0x4bd1e5
mov eax, esp
push eax
push 0x4bd154
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4bd270
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4bd2c4]
test si, 4
je 0x4bd285
or bl, 1
test si, 8
je 0x4bd28f
or bl, 4
test si, 1
je 0x4bd299
or bl, 8
test si, 2
je 0x4bd2a3
or bl, 0x10
test si, 0x10
je 0x4bd2ad
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bd2bc
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4bd2c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x4bd304]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bd2e2
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4bd2f1
or bl, 4
test esi, 0x20000000
je 0x4bd2fc
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4c5370
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4c5382
add esp, 0xfffffff0
call fcn.00404730
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00427e60
mov eax, dword [0x5be980]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c5714
mov eax, dword [0x5be990]
mov dword [eax + 4], ebx
mov dword [eax], 0x4c5720
mov eax, ebx
call fcn.004c572c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41ddfc]
call fcn.004043f4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41ddfc]
call fcn.004043f4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41ddfc]
call fcn.004043f4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41ddfc]
call fcn.004043f4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41ddfc]
call fcn.004043f4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4c0bd4
push eax
push 0
push 0
mov eax, dword [0x5bebd8]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x492b50]
call fcn.00494070
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x492b50]
call fcn.00494070
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x492b50]
call fcn.00494070
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004c5ba4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5a74
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5a74
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4c5a74
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4c54bf
call fcn.00404788
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret