joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x5c8800], eax
inc edx
cmp edx, 0x100
jb 0x447282
ret

Function at 0x447330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
or eax, 0xffffffff
test esi, esi
je 0x44735b
nop
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x5c8800]
dec esi
jne 0x447340
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x44e8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x44e91d
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x591260]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x44e900
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x44e9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov ecx, 0x80
mov dword [ebp - 4], ebx
push edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [ebx]
jne 0x44e9d1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5c58c0]
test eax, eax
je 0x44e9dc
call eax
lea eax, [esi*8]
push eax
call fcn.0044a3e0
mov ecx, dword [0x5c58c4]
add esp, 4
mov esi, eax
mov dword [ebp - 0xc], esi
test ecx, ecx
je 0x44e9fd
call ecx
test esi, esi
je 0x44e9c8
push dword [ebx + 0xc]
call fcn.0044a730
add esp, 4
mov dword [ebx + 0xc], esi
push esi
call dword [0x5bf5f0]
shr eax, 3
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebx], eax
lea ecx, [eax*8]
push ecx
push 0
push esi
call fcn.0053e230
mov ecx, dword [ebx + 8]
add esp, 0xc
mov dword [ebx + 8], 0
test ecx, ecx
je 0x44eae0
mov esi, dword [ecx + 0x10]
xor edi, edi
mov ebx, dword [ecx + 0xc]
test esi, esi
jle 0x44ea6f
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
dec esi
movzx edx, byte [eax + 0x591260]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test esi, esi
jg 0x44ea52
xor edx, edx
mov ebx, dword [ecx]
mov eax, edi
div dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea esi, [eax + edx*8]
test esi, esi
je 0x44eaba
mov eax, dword [esi]
test eax, eax
je 0x44ea8d
mov edx, dword [esi + 4]
jmp 0x44ea8f
xor edx, edx
inc eax
mov dword [esi + 4], ecx
mov dword [esi], eax
test edx, edx
je 0x44eaba
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x44eaaf
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x44ead6
mov eax, dword [ebp - 4]
mov dword [eax + 8], ecx
mov dword [edx + 4], ecx
jmp 0x44ead6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov eax, dword [edx + 8]
test eax, eax
je 0x44eacc
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edx + 8], ecx
mov ecx, ebx
test ebx, ebx
jne 0x44ea46
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ec00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [eax + 0xc], 0
je 0x44ec54
push ebx
push esi
xor esi, esi
mov ebx, edx
push edi
mov edi, ecx
test ecx, ecx
jle 0x44ec44
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x591260]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x44ec24
mov ecx, dword [ebp + 8]
mov eax, esi
xor edx, edx
mov esi, dword [ebp - 4]
pop edi
div dword [esi]
mov eax, esi
pop esi
pop ebx
jmp 0x44ec56
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ecx
mov ecx, eax
call fcn.0044eaf0
add esp, 8
test eax, eax
je 0x44ec70
mov eax, dword [eax + 8]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x44ec80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp dword [esi], 0
je 0x44ecd5
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, eax
test eax, eax
jle 0x44ecc5
mov esi, edx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x591260]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x44eca5
mov esi, dword [ebp - 0xc]
mov eax, edi
xor edx, edx
div dword [esi]
mov edi, dword [ebp - 8]
mov ebx, edx
mov dword [ebp - 4], edx
jmp 0x44ecda
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.0044eaf0
add esp, 8
test eax, eax
je 0x44ed22
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x44ed12
push ebx
mov edx, eax
mov ecx, esi
call fcn.0044eba0
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x44edc0
push 0x14
call fcn.0044a3e0
mov edi, eax
add esp, 4
test edi, edi
jne 0x44ed46
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
mov dword [edi + 8], ebx
inc dword [esi + 4]
mov edx, dword [esi + 4]
cmp edx, 0xa
jb 0x44ed86
mov eax, dword [esi]
add eax, eax
cmp edx, eax
jbe 0x44ed86
add edx, edx
mov ecx, esi
call fcn.0044e9a0
test eax, eax
je 0x44ed86
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.0044e8f0
xor edx, edx
div dword [esi]
jmp 0x44ed89
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44eda7
push edi
lea edx, [eax + edx*8]
mov ecx, esi
call fcn.0044e930
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
mov dword [edi], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x44edb6
mov dword [eax + 4], edi
mov dword [edi + 4], 0
mov dword [esi + 8], edi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov esi, ecx
mov dword [ebp - 0xc], esi
mov ebx, edx
push edi
test edx, edx
je 0x48445d
cmp byte [edx], al
je 0x484455
inc ebx
cmp byte [ebx], al
jne 0x484450
sub ebx, edx
and ebx, 0x3fffffff
xor edi, edi
cmp dword [esi + 0x14], eax
jle 0x4844ff
mov ecx, edi
cmp edi, 2
jge 0x484477
xor ecx, 1
mov dword [ebp - 4], ecx
jmp 0x48447a
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x4844ce
mov edx, ecx
mov ecx, dword [esi + 0x10]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x4844b0
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x591260]
cmp cl, byte [edx + 0x591260]
jne 0x4844b0
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484493
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 0xc]
movzx ecx, byte [ecx + 0x591260]
movzx eax, byte [eax + 0x591260]
sub eax, ecx
jne 0x4844ef
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x10]
add ecx, ecx
push ebx
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0044ec00
add esp, 4
mov dword [ebp - 8], eax
test eax, eax
jne 0x4844ff
jmp 0x4844f2
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
inc edi
cmp edi, dword [esi + 0x14]
jl 0x484468
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x484620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x48464d
cmp byte [edx], al
je 0x484645
jmp 0x484640
inc ebx
cmp byte [ebx], al
jne 0x484640
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x4846f3
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x14], ecx
mov eax, edi
cmp edi, 2
jge 0x48466d
xor eax, 1
add eax, eax
lea esi, [ecx + eax*8]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x4846cb
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x4846b0
lea esp, [esp]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x591260]
cmp cl, byte [edx + 0x591260]
jne 0x4846ad
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x484690
mov edx, dword [ebp - 8]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x591260]
movzx ecx, byte [ecx + 0x591260]
sub eax, ecx
jne 0x4846e0
mov eax, dword [ebp - 0xc]
push ebx
lea ecx, [eax + 0x18]
call fcn.0044ec00
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x4846f3
jmp 0x4846e3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc edi
mov ecx, dword [ebp - 0x14]
cmp edi, dword [ebp - 0x10]
jl 0x484663
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x484a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, edx
mov dword [esp + 0x1c], esi
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
test esi, esi
je 0x484c5d
test edi, edi
je 0x484a9d
cmp dword [edi + 0x200], 0
jne 0x484aac
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x484c5d
mov ebx, dword [esi + 8]
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x484bff
jmp 0x484ac0
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x18], esi
test edi, edi
je 0x484ad8
cmp dword [edi + 0x200], 0
jne 0x484b9f
mov esi, dword [ebx]
mov ecx, esi
mov dword [esp + 0x30], esi
test esi, esi
je 0x484afe
cmp byte [esi], 0
je 0x484af6
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x484af0
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x18]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
mov edx, dword [eax]
mov dword [esp + 0x34], edx
test edx, edx
je 0x484b71
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
test ecx, ecx
jle 0x484b65
mov ebx, ecx
mov edi, eax
mov ecx, esi
lea ebx, [ebx]
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x591260]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x484b30
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
xor edx, edx
div dword [esp + 0x34]
mov eax, dword [esp + 0x14]
jmp 0x484b73
xor edx, edx
push edx
mov dword [esp + 0x14], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0044eaf0
add esp, 8
test eax, eax
je 0x484b9b
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.0044eba0
add esp, 4
mov esi, dword [esp + 0x18]
test edi, edi
je 0x484bac
cmp dword [edi + 0x200], 0
jne 0x484bc0
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x484bc0
dec dword [eax]
jne 0x484bc0
push eax
call fcn.0044a730
add esp, 4
mov edx, dword [ebx + 0x24]
mov ecx, edi
call fcn.0047b670
mov edx, dword [ebx + 0x10]
mov ecx, edi
call fcn.0044a7d0
test byte [ebx + 0x38], 0x10
je 0x484be4
mov edx, dword [ebx + 0x20]
mov ecx, edi
call fcn.0044a7d0
mov edx, ebx
mov ecx, edi
call fcn.0044a7d0
mov dword [esp + 0x1c], esi
mov ebx, esi
test esi, esi
jne 0x484ac0
mov esi, dword [esp + 0x20]
mov edx, esi
mov ecx, edi
call fcn.00491990
mov edx, esi
mov ecx, edi
call fcn.004849f0
mov edx, dword [esi]
mov ecx, edi
call fcn.0044a7d0
mov edx, dword [esi + 0x14]
mov ecx, edi
call fcn.0044a7d0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x484c3d
mov edx, esi
mov ecx, edi
call fcn.0049adc0
mov edx, esi
mov ecx, edi
call fcn.0044a7d0
mov esi, dword [esp + 0x20]
mov ecx, edi
mov edx, dword [esi + 0x18]
call fcn.0047c380
mov edx, esi
mov ecx, edi
call fcn.004ab300
mov edx, esi
mov ecx, edi
call fcn.0044a7d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5bd250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0044c640
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x4870e6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x4870e0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x487221
mov edi, ebx
cmp ebx, 2
jge 0x487111
xor edi, 1
test esi, esi
je 0x48716f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x48714d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x591260]
cmp cl, byte [edx + 0x591260]
jne 0x48714d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x487130
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x591260]
movzx ecx, byte [ecx + 0x591260]
sub eax, ecx
jne 0x4871e3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x4871bb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x4871b0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x591260]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x487190
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x4871bd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.0044eaf0
add esp, 8
test eax, eax
je 0x4871dc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x487200
jmp 0x4871e6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x4871e6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x487107
test eax, eax
je 0x487221
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.00484330
add esp, 0x18
jmp 0x487224
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 4
jle 0x4870b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f9bc
mov esp, ebp
pop ebp
ret
Function at 0x4bdba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov eax, dword [eax]
and eax, 7
cmp edx, 5
jae 0x4bdbc0
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
add edx, 0xfffffffc
or ebx, 0xffffffff
add edx, ecx
push esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
lea esi, [edi + ecx]
cmp esi, edx
jae 0x4bdbe9
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x4bdbe6
inc esi
cmp esi, edx
jb 0x4bdbd7
mov ecx, dword [ebp - 4]
mov edi, esi
sub edi, ecx
mov ecx, edi
sub ecx, ebx
cmp esi, edx
jae 0x4bdcf1
cmp ecx, 3
jbe 0x4bdc02
xor eax, eax
jmp 0x4bdc40
dec ecx
shl eax, cl
and eax, 7
je 0x4bdc40
movzx ecx, byte [eax + 0x59454c]
mov edx, esi
sub edx, ecx
cmp byte [eax + 0x594544], 0
mov cl, byte [edx + 4]
je 0x4bdc2a
test cl, cl
je 0x4bdc2a
cmp cl, 0xff
jne 0x4bdc3d
mov edx, dword [ebp - 8]
and eax, 3
mov ecx, dword [ebp - 4]
add eax, eax
mov ebx, edi
or eax, 1
inc edi
jmp 0x4bdbd0
mov edx, dword [ebp - 8]
mov cl, byte [esi + 4]
mov ebx, edi
mov dword [ebp - 0x10], ebx
test cl, cl
je 0x4bdc62
cmp cl, 0xff
je 0x4bdc62
mov ecx, dword [ebp - 4]
and eax, 3
add eax, eax
or eax, 1
inc edi
jmp 0x4bdbd0
movzx edx, cl
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
sub edx, edi
lea ebx, [edx - 5]
test eax, eax
je 0x4bdcbe
movzx edx, byte [eax + 0x59454c]
mov ecx, 0x18
shl edx, 3
sub ecx, edx
mov dword [ebp - 0xc], edx
mov edx, ebx
shr edx, cl
test dl, dl
je 0x4bdcaa
cmp dl, 0xff
jne 0x4bdcbe
mov ecx, 0x20
mov edx, 1
sub ecx, dword [ebp - 0xc]
shl edx, cl
dec edx
xor edx, ebx
jmp 0x4bdc80
mov edx, dword [ebp - 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
mov byte [esi + 1], bl
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
shr ecx, 8
add edi, 5
mov byte [esi + 2], cl
mov ecx, dword [ebp - 4]
jmp 0x4bdbd0
pop esi
pop ebx
cmp ecx, 3
jbe 0x4bdd06
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0xc]
and eax, 7
mov dword [ecx], eax
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4bff1f
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x4bff42
or esi, 1
push 1
call edi
test ax, ax
jns 0x4bff4e
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x4bff5a
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x4bff66
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c0b0b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xd0]
call fcn.004bf132
mov edi, dword [ebp + 8]
test eax, eax
jle 0x4c0b5b
push ebx
mov byte [ebp + 0xb], 0
call fcn.004bf155
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x4c0bb6
lea ecx, [esi + 0xd0]
inc ebx
call fcn.004bf132
cmp ebx, eax
jl 0x4c0b2a
sub edi, 0x100
je 0x4c0c10
sub edi, 4
je 0x4c0bba
dec edi
dec edi
jne 0x4c0c05
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.005492fe
pop ecx
mov ecx, dword [esi + 0x50]
lea edx, [ebp + 8]
push 0x8000000a
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x4c3cc3
call dword [eax + 0xfc]
mov esi, eax
test esi, esi
je 0x4c0c05
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf0]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4c0c07
cmp dword [esi + 0x54], 0
je 0x4c0c05
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x64]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004bff1f
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4c0c05
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x4c0c5d
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0053eb4f
pop ecx
pop ecx
test eax, eax
je 0x4c0c5d
mov ecx, dword [esi + 0x54]
call fcn.004d402f
test al, al
jne 0x4c0c05
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.004c2845
jmp 0x4c0bb6
Function at 0x4c2434
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx]
je 0x4c2460
cmp esi, dword [ebx + 0x54]
je 0x4c252a
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
cmp esi, dword [ebx + 0x54]
je 0x4c252a
cmp dword [ebx + 0x54], 0
je 0x4c24b7
push 7
pop ecx
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x14
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
xor edi, edi
mov ecx, ebx
push edi
push edi
push str.killfocus
push dword [ebx + 0x54]
call fcn.004c2a8a
mov dword [ebx + 0x54], edi
test esi, esi
je 0x4c252a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x4c252a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x4c252a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x4c252a
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x54], esi
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x15
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [esp + 0x10]
mov dword [esp + 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x108]
push ecx
push 0
push 0
push str.setfocus
push dword [ebx + 0x54]
mov ecx, ebx
call fcn.004c2a8a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4