joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d2f8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x28]
shr edx, 1
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x28]
shr ecx, 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.00402a14
add dword [ebp - 8], 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40]
shl eax, 2
sub eax, 5
test eax, eax
jl 0x5d306b
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 8
and eax, 0xff
mov eax, dword [eax*4 + 0x659f28]
mov edx, 8
call fcn.005d0a0c
mov ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and eax, 0xff
xor ebx, dword [eax*4 + 0x659f28]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x659f28]
mov edx, 0x10
call fcn.005d0a0c
xor ebx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shr eax, 0x18
mov eax, dword [eax*4 + 0x659f28]
mov edx, 0x18
call fcn.005d0a0c
xor ebx, eax
mov eax, dword [ebp - 8]
mov dword [eax], ebx
add dword [ebp - 8], 4
inc dword [ebp - 4]
dec dword [ebp - 0xc]
jne 0x5d2fee
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5e2518
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5e2531
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x5e2540
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x17
call sub.user32.dll_GetSystemMetrics
test eax, eax
jne 0x5e2559
push 2
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret
push 1
call sub.user32.dll_GetAsyncKeyState
test ax, ax
setl al
ret

Function at 0x5e5cac
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x100]
test byte [eax], 0x80
setne cl
test cl, cl
jne 0x5e5cda
inc eax
dec edx
jne 0x5e5ccc
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x5e5d3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
movzx eax, byte [eax + 0xc]
mov edx, dword [ebp + 8]
mov word [edx - 2], ax
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5e5d68
mov eax, dword [ebp + 8]
add word [eax - 2], 0x2000
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5e5d7d
mov eax, dword [ebp + 8]
add word [eax - 2], 0x4000
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5e5d92
mov eax, dword [ebp + 8]
add word [eax - 2], 0x8000
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc4]
test eax, eax
jne 0x5e5da9
xor ebx, ebx
jmp 0x5e5dbd
mov edx, dword [ebp + 8]
mov dx, word [edx - 2]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
call fcn.005f092c
mov ebx, eax
test bl, bl
jne 0x5e5e37
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
call fcn.0042027c
mov esi, eax
dec esi
test esi, esi
jl 0x5e5e37
inc esi
xor edi, edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, edi
call fcn.005f0f94
cmp byte [eax + 0x75], 0
je 0x5e5e33
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, edi
call fcn.005f0f94
cmp byte [eax + 0x56], 0
jne 0x5e5e33
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov edx, edi
call fcn.005f0f94
mov edx, dword [ebp + 8]
mov dx, word [edx - 2]
call fcn.005f092c
mov ebx, eax
test bl, bl
jne 0x5e5e37
inc edi
dec esi
jne 0x5e5ddc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5e5f1c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push ebp
call fcn.005e5d3c
pop ecx
test al, al
je 0x5e5f3c
mov eax, dword [ebp + 8]
mov dword [eax - 8], 1
jmp 0x5e5ff0
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5e5ff0
call fcn.005e5ce0
mov dl, byte [0x5e5ff8]
not edx
and dl, al
mov byte [ebp - 3], dl
push ebp
call fcn.005e5e40
pop ecx
mov esi, eax
test esi, esi
je 0x5e5ff0
mov eax, dword [esi + 0x18]
call fcn.00603130
test al, al
je 0x5e5ff0
push esi
mov eax, dword [ebp + 8]
mov dx, word [eax + 0xc]
mov cl, byte [ebp - 3]
mov eax, dword [esi + 4]
call fcn.005f2e44
cmp esi, eax
sete bl
mov eax, dword [esi + 0x10]
mov edx, dword [eax]
call dword [edx + 0x88]
test al, al
je 0x5e5fa6
test bl, bl
jne 0x5e5fb8
mov eax, esi
call fcn.005f1bd4
mov edx, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x150]
test bl, bl
je 0x5e5fe6
mov eax, dword [esi + 0x10]
mov edx, dword [0x5e0c34]
call fcn.00403e84
test al, al
je 0x5e5fdc
mov eax, esi
call fcn.005f1bd4
mov byte [eax + 0x280], 1
xor edx, edx
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 8]
mov dword [eax - 8], 1
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5e6c64
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x65d5a4]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041eec4
test eax, eax
jge 0x5e6c89
mov eax, dword [0x65d5a4]
mov eax, dword [eax + 4]
mov edx, ebx
call fcn.0041ecbc
cmp byte [ebx + 0x49], 0
jne 0x5e6ca9
cmp dword [0x65d610], 0
jne 0x5e6ca9
xor ecx, ecx
mov dl, 1
mov eax, dword [0x65a6d4]
call dword [eax + 0x2c]
mov dword [0x65d610], eax
cmp dword [0x65d5ec], 0
jne 0x5e6ccb
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push fcn.005e5ffc
push 2
call sub.user32.dll_SetWindowsHookExA
mov dword [0x65d5ec], eax
cmp dword [0x65d5f0], 0
jne 0x5e6ced
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5e65d4
push 7
call sub.user32.dll_SetWindowsHookExA
mov dword [0x65d5f0], eax
cmp dword [0x65d5f4], 0
jne 0x5e6d0f
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x5e6b3c
push 4
call sub.user32.dll_SetWindowsHookExA
mov dword [0x65d5f4], eax
pop ebx
ret
Function at 0x5ea790
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, edx
mov esi, eax
mov eax, esi
call fcn.005e733c
test al, al
jne 0x5ea89b
cmp byte [esi + 0xfb], 0
je 0x5ea89b
mov eax, 0x65d620
mov edx, edi
call fcn.00404c3c
mov byte [0x65d614], 0
mov byte [esp], bl
test bl, bl
je 0x5ea7ef
mov edi, dword [esi + 0xf0]
test edi, edi
je 0x5ea7e6
mov eax, dword [edi + 0x20]
cmp byte [eax + 0x22f], 0
je 0x5ea7f3
cmp dword [0x65d620], 0
jne 0x5ea7f3
xor eax, eax
jmp 0x5ea7f5
mov al, 1
mov ebx, eax
test bl, bl
je 0x5ea846
call fcn.005e5c64
mov eax, dword [0x65d610]
call fcn.00456c34
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5ea83d
cmp byte [0x65d624], 0
jne 0x5ea83d
mov dword [0x65d62c], esi
push 0x5ea508
push 0x3e8
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x65d618], eax
jmp 0x5ea89b
mov eax, esi
call fcn.005ea578
jmp 0x5ea89b
call fcn.005e5c64
mov eax, dword [0x65d610]
call fcn.00456c34
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ea89b
push 0
mov eax, dword [0x65d610]
call fcn.00456c34
push eax
call sub.user32.dll_ShowWindow
cmp byte [esp], 0
je 0x5ea89b
call fcn.005e5c84
mov byte [0x65d624], 1
push 0x5ea56c
push 0x190
push 0
push 0
call sub.user32.dll_SetTimer
mov dword [0x65d61c], eax
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5f1418
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 0x15], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5f1451
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5f14d2
push ebp
mov al, 1
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 3
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 2
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 4
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x35], 0
je 0x5f14a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d]
sub dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x41]
sub dword [ebp - 0x10], eax
push ebp
mov al, 1
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 3
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 2
call fcn.005f132c
pop ecx
test al, al
jne 0x5f14d2
push ebp
mov al, 4
call fcn.005f132c
pop ecx
test al, al
mov al, byte [ebp - 0x15]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x5f237c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5f2418
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.005f1c98
mov eax, dword [ebp - 8]
call fcn.005f22cc
pop ecx
test al, al
jne 0x5f23bb
xor ebx, ebx
jmp 0x5f2402
push eax
call sub.user32.dll_VkKeyScanA
mov esi, eax
mov eax, esi
and ax, 0xff
cmp di, ax
jne 0x5f2400
shr si, 8
mov bl, byte [0x5f2428]
mov eax, esi
and ax, 1
cmp ax, 1
jne 0x5f23e7
or bl, 1
and si, 2
cmp si, 2
jne 0x5f23f4
or bl, 4
mov al, byte [ebp - 1]
cmp al, bl
sete al
mov ebx, eax
jmp 0x5f2402
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f241f
lea eax, [ebp - 8]
call fcn.00404be8
ret

Function at 0x607a94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
lea ecx, [esp + 8]
mov edx, ebx
mov eax, dword [ebx + 0x20]
call fcn.005f772c
push esp
call sub.user32.dll_GetCursorPos
push esp
mov eax, dword [ebx + 0x20]
call fcn.00456c34
push eax
call sub.user32.dll_ScreenToClient
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x607ade
push dword [esp + 4]
push dword [esp + 4]
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x607ae2
xor eax, eax
jmp 0x607ae4
mov al, 1
test al, al
je 0x607b05
cmp byte [0x65d600], 0
je 0x607af8
call fcn.005e2518
jmp 0x607b05
push 1
call sub.user32.dll_GetKeyState
test ax, ax
setl al
add esp, 0x18
pop ebx
ret
Function at 0x60b764
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x10], 1
sete byte [0x65d5b5]
cmp byte [0x65d5b5], 0
je 0x60b793
cmp dword [esp + 8], 0
je 0x60b797
xor eax, eax
jmp 0x60b799
mov al, 1
mov byte [0x65d5b4], al
cmp dword [esp + 0x10], 1
jne 0x60b7ac
cmp dword [esp + 8], 0
jne 0x60b7be
cmp dword [esp + 0x10], 2
jne 0x60b7ba
cmp dword [esp + 4], 5
je 0x60b7be
xor eax, eax
jmp 0x60b7c0
mov al, 1
mov byte [0x65d5b6], al
add esp, 0x94
ret

Function at 0x620cf8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00468ab0
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x632258
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00468ab0
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret
Function at 0x6360e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
call fcn.00405098
mov esi, dword [ebp + 0xc]
add esi, 0xfffffffc
xor eax, eax
push ebp
push 0x63624f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.006369e4
call fcn.0060fcec
push eax
mov eax, dword [ebp - 0x14]
call fcn.00433190
mov eax, dword [eax + 0xc]
pop edx
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x34]
test al, al
je 0x63616a
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.006369e4
call fcn.0060fcec
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x18]
call fcn.00433190
pop edx
call fcn.0042e1f8
jmp 0x6361a6
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
push eax
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x34]
push eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
call fcn.00630d30
lea eax, [ebp - 0x20]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
call fcn.006369e4
mov edx, eax
mov eax, dword [ebp - 0x14]
pop ecx
call fcn.00630854
mov eax, dword [ebp - 0x14]
call fcn.00433190
mov ebx, eax
mov dl, 1
mov eax, dword [ebx + 0x14]
call fcn.0042d788
cmp byte [ebp + 8], 0
jne 0x636200
mov eax, dword [esi]
call fcn.00636590
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0042ce80
push ebp
lea ecx, [ebp - 0x20]
mov edx, 1
mov eax, 1
call fcn.00630d30
lea eax, [ebp - 0x20]
call fcn.0063603c
pop ecx
mov eax, dword [esi]
call fcn.00636598
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0042ce80
jmp 0x636214
mov eax, dword [ebp + 0xc]
push eax
call fcn.00635fb8
pop ecx
mov edx, eax
mov eax, dword [ebx + 0xc]
call fcn.0042ce80
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov eax, dword [esi]
mov ecx, dword [ebx + 0xc]
call fcn.00635f78
push ebp
lea ecx, [ebp - 0x20]
xor edx, edx
xor eax, eax
call fcn.00630d30
lea eax, [ebp - 0x20]
call fcn.0063603c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x636256
lea eax, [ebp - 0x18]
call fcn.00404be8
ret
Function at 0x4c05e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [esi + 8]
mov edi, edx
and edi, 7
je 0x4c060f
cmp edx, edi
jge 0x4c05ff
push esi
call fcn.004bcf20
add esp, 4
mov eax, dword [esi + 0xc]
mov ecx, edi
shr eax, cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
mov dword [esi + 0xc], eax
xor eax, eax
mov ecx, edx
test edx, edx
jle 0x4c0638
mov edx, dword [esi + 0xc]
push ebx
mov bl, dl
nop dword [eax]
mov byte [ebp + eax + 8], bl
sub ecx, 8
shr edx, 8
inc eax
mov dword [esi + 0xc], edx
mov bl, dl
test ecx, ecx
jg 0x4c0620
pop ebx
mov dword [esi + 8], ecx
test ecx, ecx
js 0x4c06dc
cmp eax, 4
jge 0x4c0667
mov edi, dword [esi + 4]
mov ecx, dword [esi]
nop word [eax + eax]
cmp ecx, edi
jb 0x4c0658
xor dl, dl
jmp 0x4c065d
mov dl, byte [ecx]
inc ecx
mov dword [esi], ecx
mov byte [ebp + eax + 8], dl
inc eax
cmp eax, 4
jl 0x4c0650
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x4c06dc
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4c06a6
pop edi
mov dword [0x54d318], 0x4fc0c0
xor eax, eax
pop esi
pop ebp
ret
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4c06c0
push edi
push ecx
push esi
call fcn.004c12f0
add esp, 0xc
test eax, eax
je 0x4c06e6
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0044e815
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
pop ebp
ret
mov dword [0x54d318], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4cd9f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
or eax, 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push edi
lea edi, [ecx + 4]
test edi, edi
jle 0x4cda2b
push esi
mov esi, dword [ebx]
sub esi, ecx
sub esi, 4
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x53e3e0]
sub edi, 1
jne 0x4cda10
pop esi
mov ecx, dword [ebx]
not eax
mov edx, eax
shr edx, 0x18
pop edi
mov byte [ecx], dl
mov edx, eax
mov ecx, dword [ebx]
shr edx, 0x10
mov byte [ecx + 1], dl
mov edx, eax
mov ecx, dword [ebx]
shr edx, 8
mov byte [ecx + 2], dl
mov ecx, dword [ebx]
mov byte [ecx + 3], al
add dword [ebx], 4
pop ebx
pop ebp
ret

Function at 0x4d8a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
mov ecx, 0x7fffffff
cmp dword [ebp + 8], ebx
jle 0x4d8adb
mov edx, dword [ebp + 0x10]
imul edx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x10], edx
nop
mov eax, dword [edi + 4]
mov esi, ecx
imul eax, dword [edi]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, edi
cmp eax, ecx
cmovl ecx, eax
cmp eax, esi
cmovge edx, ebx
add edi, 0xc
sub dword [ebp + 8], 1
mov ebx, edx
mov edx, dword [ebp + 0x10]
jne 0x4d8ab0
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
Function at 0x4db000
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x540d40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov dword [0x54f710], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4db05b
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x54f700], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x54f708], xmm0
mov eax, dword [edi + 0x6c]
cmp eax, 0x34001
je 0x4db070
cmp eax, 0x34004
je 0x4db070
push 0
jmp 0x4db08a
mov eax, dword [edi + 0x44]
test eax, eax
je 0x4db07c
push dword [eax + 4]
jmp 0x4db08a
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
push edi
call dword [0x54d3d0]
movd xmm0, dword [ebp - 0x18]
cvtdq2pd xmm0, xmm0
push ecx
mulsd xmm0, qword [0x4f74d8]
movsd qword [esp + 8], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x4f74d8]
movsd qword [esp], xmm0
push edi
call dword [0x54d354]
add esp, 0x14
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0xc]
push eax
push dword [edi + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
mov dword [0x54f714], edi
cmp dword [edi + 0x1e8], 0
je 0x4db15b
mov eax, dword [edi + 0x2ac]
push 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0x10], 0x20001
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x4db15b
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.0044d30c
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044daff
mov esp, ebp
pop ebp
ret

Function at 0x4db1d0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x4db20f
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.0044d30c
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4db230
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1e8], 0
je 0x4db27c
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x4db27c
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.0044d30c
add esp, 8
push 0
mov dword [0x54f710], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x54f708]
mov dword [0x54f714], 0
cvttsd2si ecx, qword [0x54f700]
mov dword [ebp - 4], eax
mov dword [esi + 0x2e0], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2ac]
mov dword [ebp - 8], ecx
mov dword [esi + 0x2dc], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov eax, dword [esi + 0x6c]
cmp eax, 0x34001
je 0x4db2f4
cmp eax, 0x34004
je 0x4db2f4
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4db309
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4db360
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push 0xc
push 1
mov dword [ebp - 0xc], 0x20001
mov eax, dword [eax + 0x2ac]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x4db3a4
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.0044d30c
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4db980
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
push 0x11
shr esi, 0xf
call ebx
mov edi, esi
or edi, 2
test ax, ax
push 0x12
cmovns edi, esi
call ebx
mov ebx, edi
or ebx, 4
test ax, ax
push 0x5c
cmovns ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push 0x5b
mov si, ax
call edi
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
call ebx
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x4df838
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x54d330], 0
jne 0x4df7ad
push 0
push 0x10001
call fcn.0044d78f
add esp, 8
pop ebp
ret
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
setne cl
lea edx, [eax - 0x20003]
cmp edx, 0xa
ja case.0x4df7c3.131076
jmp dword [edx*4 + 0x4df850]
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], ecx
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
mov dword [eax + 4], ecx
jne 0x4df7ab
push ecx
push eax
call dword [0x54d428]
add esp, 8
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
mov dword [eax + 8], ecx
jne 0x4df7ab
push ecx
push eax
call dword [0x54d42c]
add esp, 8
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0
mov dword [eax + 0x10], ecx
jne 0x4df7ab
push ecx
push eax
call dword [0x54d430]
add esp, 8
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], ecx
pop ebp
ret
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [eax + 0x18], ecx
call dword [0x54d438]
add esp, 8
pop ebp
ret
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], str.Invalid_window_attribute_0x_08X
mov dword [ebp + 8], 0x10003
pop ebp
jmp fcn.0044d78f