joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457c24
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp si, word [ebx + 0x44]
je 0x457ca8
mov word [ebx + 0x44], si
test si, si
jne 0x457c98
push esp
call sub.user32.dll_DrawMenuBar
push dword [esp + 4]
push dword [esp + 4]
call sub.user32.dll_SetScrollRange
mov edi, eax
test edi, edi
je 0x457c98
push 0
push edi
call sub.user32.dll_GetMenuItemCount
mov ebp, eax
call fcn.00408c1c
cmp ebp, eax
jne 0x457c98
mov eax, esp
call fcn.0040974c
push eax
push 0
push 0x84
push edi
call sub.user32.dll_MapVirtualKeyA
mov ebx, eax
mov dx, 0x200
mov eax, ebx
call fcn.004096a4
push eax
push edi
push 0x20
push edi
call sub.user32.dll_MapVirtualKeyA
jmp 0x457cab
movsx edx, si
mov eax, ebx
call fcn.00457bfc
push eax
call sub.user32.dll_MoveWindow
inc dword [ebx + 0x48]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4588c4
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x458a5b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xa4], 0
jne 0x458a45
mov eax, dword [0x4bbe58]
cmp byte [eax], 0
jne 0x458a45
push ebx
push fcn.00458de0
call fcn.0042622c
mov dword [ebx + 0x40], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x4b84e0]
push eax
mov eax, dword [0x4bc718]
push eax
call sub.user32.dll_DestroyWindow
test eax, eax
jne 0x45895c
mov eax, dword [0x4bc718]
mov dword [0x4b84cc], eax
push 0x4b84bc
call sub.user32.dll_IsWindowVisible
test ax, ax
jne 0x45895c
lea edx, [ebp - 0x2c]
mov eax, dword [0x4bbb48]
call fcn.0040765c
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x41a378]
call fcn.0040df84
call fcn.004049b8
push 0
mov eax, dword [0x4bbc2c]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x45896e
adc eax, 0
push eax
push 1
mov eax, dword [0x4bbc2c]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x458981
adc eax, 0
push eax
push 0
push 0
push 0
push 0
mov eax, dword [0x4bc718]
push eax
push 0
mov eax, dword [ebx + 0x8c]
call fcn.0040548c
mov edx, eax
mov ecx, 0x84ca0000
mov eax, dword [0x4b84e0]
call fcn.0040976c
mov dword [ebx + 0x30], eax
lea eax, [ebx + 0x8c]
call fcn.00404fdc
mov byte [ebx + 0xa4], 1
mov eax, dword [ebx + 0x40]
push eax
push 0xfffffffffffffffc
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_ReleaseDC
mov eax, dword [0x4bbccc]
cmp byte [eax], 0
je 0x458a07
mov eax, ebx
call fcn.004594b8
push eax
push 1
push 0x80
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_MapVirtualKeyA
mov eax, ebx
call fcn.004594b8
push eax
push 0xfffffffffffffff2
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_MessageBoxW
push 0
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0
push 0xf030
push ebx
call fcn.004091ac
push 0
push 0xf000
push ebx
call fcn.004091ac
mov eax, dword [0x4bbccc]
cmp byte [eax], 0
je 0x458a45
push 0
push 0xf010
push ebx
call fcn.004091ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458a62
lea eax, [ebp - 0x2c]
call fcn.00404fdc
ret
Function at 0x458b38
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4bee20]
cmp dword [eax + 0x30], 0
je 0x458be2
cmp dword [ebx + 0x94], 0
jne 0x458bdc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458ac8
call sub.user32.dll_CreatePopupMenu
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458bdc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetCursor
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetKeyboardLayout
test al, 8
je 0x458ba2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458bdc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041cc70
push eax
call sub.user32.dll_RemovePropA
dec esi
cmp esi, 0xffffffff
jne 0x458bb1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458d94
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
push eax
call fcn.00409124
mov ebx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004594b8
push eax
push 0
push 0
push ebx
call sub.user32.dll_AttachThreadInput
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ClientToScreen
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4597fc
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x4598ad
cmp eax, 0x108
ja 0x4598ad
call sub.user32.dll_DestroyMenu
mov ebp, eax
test ebp, ebp
jne 0x459880
mov ebp, dword [esi]
mov eax, dword [edi + 0x44]
test eax, eax
je 0x45984c
cmp ebp, dword [eax + 0x254]
jne 0x45984c
call fcn.0044078c
mov ebp, eax
jmp 0x459861
push ebp
call sub.user32.dll_GetCursorPos
mov ebp, eax
mov eax, ebp
call fcn.004370e4
test eax, eax
jne 0x45985b
test ebp, ebp
jne 0x459844
test ebp, ebp
jne 0x459861
mov ebp, dword [esi]
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x4598ad
mov bl, 1
jmp 0x4598ad
push 0xfffffffffffffffa
push ebp
call sub.user32.dll_GetKeyboardLayout
cmp eax, dword [0x4bc718]
jne 0x4598ad
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x4598ad
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x459d28
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
call sub.user32.dll_DestroyCursor
mov dword [ebp - 0xc], eax
push 2
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4bbce4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x14], eax
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x4bbce4]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x459dd2
mov dword [ebp - 0x44], 0x28
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [0x4bbc08]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x54]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetKeyboardState
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
sub ecx, edx
sar ecx, 1
jns 0x459daf
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
sub edx, eax
sar edx, 1
jns 0x459dc1
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_RemovePropA
xor eax, eax
call fcn.00450bb8
mov dword [ebp - 0x10], eax
call fcn.00450ad4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
call fcn.00458c64
test al, al
je 0x459df6
or ebx, 0x100000
xor ecx, ecx
push ebp
push 0x459e7d
push dword fs:[ecx]
mov dword fs:[ecx], esp
push ebx
push edi
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_InflateRect
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459e84
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
je 0x459e63
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
sub ecx, edx
sar ecx, 1
jns 0x459e40
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x54]
sub edx, eax
sar edx, 1
jns 0x459e52
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_RemovePropA
mov eax, dword [ebp - 0x10]
call fcn.00450c6c
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_MapWindowPoints
mov eax, dword [ebp - 0x1c]
call fcn.00450adc
ret
Function at 0x45a834
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
push 0xe
mov eax, dword [0x4bbc2c]
mov eax, dword [eax]
call eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_DrawIconEx
push eax
call sub.user32.dll_EnumWindows
test eax, eax
je 0x45a97d
xor edx, edx
push ebp
push 0x45a976
push dword fs:[edx]
mov dword fs:[edx], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x1c]
call fcn.0042a680
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
call fcn.0040a890
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x45a947
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 0x10]
add ebx, dword [ebp - 8]
push ebx
mov esi, dword [ebp - 0x10]
mov ecx, esi
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.0042a738
test al, al
je 0x45a92b
mov eax, dword [ebp - 0x10]
cmp word [eax + 0xe], 1
jne 0x45a92b
mov eax, dword [esi + 4]
mov edx, eax
movzx ecx, word [esi + 0xe]
imul edx, ecx
add edx, 0x1f
and edx, 0xffffffe0
test edx, edx
jns 0x45a8d7
add edx, 7
sar edx, 3
mov dword [ebp - 0x14], edx
mov edi, eax
imul edi, dword [ebp - 0x14]
add ebx, dword [ebp - 0xc]
sub ebx, edi
mov ecx, 0xff
mov edx, edi
mov eax, ebx
call fcn.0045a824
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x45a91b
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
add edx, edx
cmp eax, edx
jl 0x45a91b
mov eax, ebx
sub eax, edi
xor ecx, ecx
mov edx, edi
call fcn.0045a824
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cdq
idiv dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
sub dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a94e
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00402a78
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x461ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040547c
mov eax, dword [ebp - 8]
call fcn.0040547c
xor eax, eax
push ebp
push 0x461d84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4bbb88]
mov byte [eax], 1
mov byte [ebx + 8], 0
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
inc dword [0x4bee48]
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 4]
call fcn.00405030
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00405030
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x461c9c
push 0
push 0
call fcn.00408b34
mov dword [ebx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d8b
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405000
ret
Function at 0x463530
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
push ebp
push 0x4635f1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040548c
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4635d3
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00405618
lea eax, [ebp - 0x1c]
call fcn.004054e4
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x463604
lea eax, [ebp - 0x1c]
call fcn.004054e4
push eax
call sub.version.dll_VerQueryValueA
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4635d3
mov eax, dword [ecx + 8]
xor edx, edx
mov ebx, dword [ebp - 8]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ecx + 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4635f8
lea eax, [ebp - 0x1c]
call fcn.00404fdc
lea eax, [ebp - 4]
call fcn.00404fdc
ret
Function at 0x465fac
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, edx
mov ebp, eax
cmp byte [0x4befd5], 0
jne 0x465fc5
call fcn.00465f30
mov eax, ebp
call fcn.00405294
mov ecx, 3
cdq
idiv ecx
mov esi, eax
mov eax, ebp
call fcn.00405294
mov ecx, 3
cdq
idiv ecx
test edx, edx
je 0x465fea
inc esi
mov edx, esi
shl edx, 2
mov eax, edi
call fcn.00405618
xor esi, esi
xor ebx, ebx
mov eax, ebp
call fcn.00405294
mov ecx, 3
cdq
idiv ecx
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
cmp esi, dword [esp + 4]
jge 0x4660d0
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp], al
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp + 1], al
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp + 2], al
inc ebx
mov eax, edi
call fcn.004054e4
xor edx, edx
mov dl, byte [esp]
shr edx, 2
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esp + 1]
shr ecx, 4
or edx, ecx
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esp + 2]
shr ecx, 6
or edx, ecx
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
cmp esi, dword [esp + 4]
jl 0x46601a
mov eax, ebp
call fcn.00405294
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x466144
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp], al
inc ebx
mov eax, edi
call fcn.004054e4
xor edx, edx
mov dl, byte [esp]
shr edx, 2
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp]
and dl, 3
and edx, 0xff
shl edx, 4
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov byte [eax + ebx - 1], 0x3d
inc ebx
mov eax, edi
call fcn.004054e4
mov byte [eax + ebx - 1], 0x3d
jmp 0x4661e2
mov eax, ebp
call fcn.00405294
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x4661e2
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp], al
inc esi
mov al, byte [ebp + esi - 1]
mov byte [esp + 1], al
inc ebx
mov eax, edi
call fcn.004054e4
xor edx, edx
mov dl, byte [esp]
shr edx, 2
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esp + 1]
shr ecx, 4
or edx, ecx
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov dl, byte [esp + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov dl, byte [edx + 0x4bef94]
mov byte [eax + ebx - 1], dl
inc ebx
mov eax, edi
call fcn.004054e4
mov byte [eax + ebx - 1], 0x3d
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x466e28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040547c
xor eax, eax
push ebp
push 0x466eee
push dword fs:[eax]
mov dword fs:[eax], esp
lea ebx, [ebp - 0xc]
mov dword [ebx], esi
mov eax, dword [ebp - 4]
call fcn.00405294
mov esi, eax
xor eax, eax
mov dword [ebp - 0x10], eax
cmp esi, 4
jl 0x466e92
mov edi, dword [ebx]
lea eax, [ebp - 4]
call fcn.004054e4
mov edx, esi
test edx, edx
jns 0x466e7b
add edx, 3
sar edx, 2
mov dword [ebp - 0x10], edx
mov ebx, dword [ebp - 0x10]
dec ebx
test ebx, ebx
jl 0x466e92
inc ebx
xor dword [eax], edi
add eax, 4
dec ebx
jne 0x466e8a
xor edi, edi
mov eax, dword [ebp - 0x10]
shl eax, 2
inc eax
mov ebx, esi
sub ebx, eax
jl 0x466ecd
inc ebx
mov esi, eax
lea eax, [ebp - 4]
call fcn.004054e4
mov edx, dword [ebp - 4]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp + edi - 0xc]
mov byte [eax + esi - 1], dl
inc edi
and edi, 0x80000003
jns 0x466ec9
dec edi
or edi, 0xfffffffc
inc edi
inc esi
dec ebx
jne 0x466ea4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00405030
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466ef5
lea eax, [ebp - 4]
call fcn.00404fdc
ret

Function at 0x467188
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x4befd8
mov eax, ebx
mov edx, 0xfffffff8
test al, 1
je 0x4671a4
shr eax, 1
xor eax, 0xedb88320
jmp 0x4671a6
shr eax, 1
inc edx
jne 0x467197
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x467190
pop ebx
ret
Function at 0x4671bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
cmp byte [0x4befd4], 0
jne 0x4671e0
mov byte [0x4befd4], 1
call fcn.00467188
mov eax, ebx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.0041f204
mov eax, dword [ebp - 4]
call fcn.0041f218
push edx
push eax
mov eax, dword [ebp - 8]
add eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x46720c
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x46721d
jmp 0x467210
pop edx
pop eax
jle 0x46721d
mov eax, dword [ebp - 4]
call fcn.0041f218
sub eax, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x80000
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x14]
jge 0x467232
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.00402a58
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x4672ce
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 0xc], 0xffffffff
cmp dword [ebp - 8], 0
jle 0x4672b1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
test eax, eax
jle 0x467297
mov ecx, dword [ebp - 0xc]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ebx
mov bl, byte [edx]
xor ebx, dword [ebp - 0xc]
and ebx, 0xff
xor ecx, dword [ebx*4 + 0x4befd8]
mov dword [ebp - 0xc], ecx
inc edx
dec eax
jne 0x467270
mov eax, dword [ebp - 0x14]
sub dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jle 0x4672ab
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
jg 0x467258
and dword [ebp - 0xc], 0x7fffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4672d5
mov eax, dword [ebp - 0x10]
call fcn.00402a78
ret

Function at 0x4672e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
cmp byte [0x4befd4], 0
jne 0x4672f9
mov byte [0x4befd4], 1
call fcn.00467188
or ebx, 0xffffffff
mov eax, esi
call fcn.00405294
test eax, eax
jle 0x467332
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4befd8]
shr ebx, 8
and ebx, 0xffffff
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x46730c
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x475060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov esi, edx
mov edi, eax
mov eax, dword [esp]
inc eax
cmp eax, 5
jge 0x47507d
xor eax, eax
jmp 0x475105
mov cl, byte [esi]
and cl, 0xff
and ecx, 0xff
mov eax, ecx
mov ebx, 9
cdq
idiv ebx
mov dword [esp + 4], edx
mov eax, ecx
mov ecx, 9
cdq
idiv ecx
mov ecx, eax
mov eax, ecx
mov ebx, 5
cdq
idiv ebx
mov dword [esp + 8], edx
mov eax, ecx
mov ecx, 5
cdq
idiv ecx
mov dword [esp + 0xc], eax
xor ebx, ebx
xor eax, eax
mov ecx, eax
shl ecx, 3
lea edx, [eax + 1]
mov dl, byte [esi + edx]
and dl, 0xff
and edx, 0xff
shl edx, cl
add ebx, edx
inc eax
cmp eax, 4
jne 0x4750c2
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edi
call fcn.00474b70
test al, al
jne 0x4750fc
xor eax, eax
jmp 0x475105
mov edx, ebx
mov eax, edi
call fcn.00474b20
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x488a68
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x488b40
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bfbe4], 0
jne 0x488b24
lea eax, [ebp - 4]
mov edx, 0x488b58
call fcn.00405074
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040548c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x488b24
mov eax, ebx
call fcn.00402a58
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x488b1d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x488b07
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x488b68
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x488b07
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4bfbe4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488b24
mov eax, dword [ebp - 0xc]
call fcn.00402a78
ret
mov ebx, dword [0x4bfbe4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x488b47
lea eax, [ebp - 4]
call fcn.00404fdc
ret

Function at 0x48d92c
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
push ebx
push esi
push ecx
mov ebx, eax
cmp dword [ebx + 0x22c], 0
je 0x48d9b5
cmp dword [ebx + 0x180], 0
jne 0x48d9b5
xor eax, eax
mov dword [esp], eax
push esp
mov eax, dword [ebx + 0x22c]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
cmp dword [esp], 0
jne 0x48d972
mov ecx, dword [0x4bbfd0]
mov dl, 1
mov eax, dword [0x4856bc]
call fcn.0040e040
call fcn.004049b8
mov esi, dword [esp]
mov dword [ebx + 0x180], esi
push 0xfffffffffffffffc
push esi
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x174], eax
mov eax, dword [0x4bbd54]
mov dword [eax], ebx
push 0x436ffc
push 0xfffffffffffffffc
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_ReleaseDC
push 0
push 0
push 0
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_MapVirtualKeyA
pop edx
pop esi
pop ebx
ret
Function at 0x48e594
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
add esp, 0xffffffe4
mov esi, edx
mov ebx, eax
mov eax, dword [esi]
cmp eax, 0xbd00
jb 0x48e60c
cmp eax, 0xbd08
ja 0x48e60c
cmp dword [ebx + 0x230], 0
je 0x48e60c
mov eax, ebx
call fcn.0044078c
mov dword [esp], eax
mov eax, dword [esi]
sub eax, 0xbc00
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi + 8]
mov dword [esp + 0xc], eax
call sub.user32.dll_GetClipboardData
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x115de1f1
mov dword [esp + 0x18], 0x115de1f1
push esp
mov eax, dword [ebx + 0x230]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
test eax, eax
jne 0x48e60c
mov dword [esi + 0xc], 1
jmp 0x48e676
mov eax, dword [esi]
sub eax, 0xb008
je 0x48e61a
dec eax
je 0x48e64d
jmp 0x48e66d
cmp byte [ebx + 0x59], 0
je 0x48e66d
cmp dword [ebx + 0x220], 0
je 0x48e66d
push 0xfffffd41
mov eax, dword [ebx + 0x220]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 0xfffffd40
mov eax, dword [ebx + 0x220]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
jmp 0x48e66d
cmp byte [ebx + 0x5a], 0
je 0x48e66d
cmp dword [ebx + 0x220], 0
je 0x48e66d
push 0xfffffd43
mov eax, dword [ebx + 0x220]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
mov edx, esi
mov eax, ebx
call fcn.0043e210
add esp, 0x1c
pop esi
pop ebx
ret