joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fa50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x45fa9c
mov eax, esi
call fcn.0044e7f4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45fa9c
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x45fa9c
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x45fbdb
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x45fadc
cmp eax, 0x108
ja 0x45fadc
mov eax, esi
call fcn.0044e7f4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45fbd2
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x45fbdb
jmp 0x45fbd2
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x45fbbb
cmp eax, 0x20a
ja 0x45fbbb
test byte [esi + 0x50], 0x80
jne 0x45fb0e
sub eax, 0x203
je 0x45fb0b
sub eax, 3
je 0x45fb0b
sub eax, 3
jne 0x45fb0e
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x45fb22
dec eax
je 0x45fb37
dec eax
je 0x45fb54
dec eax
je 0x45fb37
jmp 0x45fb5b
mov ecx, ebx
mov eax, dword [0x4e3304]
mov eax, dword [eax]
mov edx, esi
call fcn.004584bc
jmp 0x45fbd2
cmp byte [esi + 0x5d], 1
jne 0x45fb4d
mov eax, esi
mov si, 0xffed
call fcn.00403668
jmp 0x45fbdb
or word [esi + 0x54], 1
jmp 0x45fbd2
and word [esi + 0x54], 0xfffe
jmp 0x45fbd2
mov eax, dword [0x4e4b48]
cmp byte [eax + 0x20], 0
je 0x45fbd2
mov eax, dword [0x4e4b48]
cmp dword [eax + 0x1c], 0
je 0x45fbd2
mov eax, dword [ebx]
mov edx, dword [0x4e4b48]
cmp eax, dword [edx + 0x1c]
jne 0x45fbd2
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.0044e738
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403668
jmp 0x45fbdb
cmp eax, 0xb00b
jne 0x45fbd2
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0045e370
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x463134
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x463150
cmp dword [esi + 4], 0
je 0x46317d
test byte [ebx + 0x55], 1
jne 0x46316f
mov eax, ebx
call fcn.00461ce8
test eax, eax
jne 0x46316f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x46328d
mov edx, esi
mov eax, ebx
call fcn.00462c58
jmp 0x46328d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x463286
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00465008
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0045f984
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00463134
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.00465008
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46328d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4665d8
Capabilities:
Check for time delay via gettickcount
Get number of processors
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
mov esi, dword [0x4e34dc]
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 1
xor eax, eax
push ebp
push 0x4667b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045e800
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045fa28
mov eax, dword [esi]
call fcn.00455330
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x4c]
add edx, dword [ebp - 0x14]
cmp eax, edx
jge 0x46664a
mov eax, dword [esi]
call fcn.00455330
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi]
call fcn.0045533c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x48]
add edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x46666e
mov eax, dword [esi]
call fcn.0045533c
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00455324
cmp eax, dword [ebp - 0x18]
jle 0x466684
mov eax, dword [esi]
call fcn.00455324
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
call fcn.00455318
cmp eax, dword [ebp - 0xc]
jle 0x46669a
mov eax, dword [esi]
call fcn.00455318
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call fcn.00465008
push eax
call sub.user32.dll_SetWindowPos
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x214]
cmp eax, 0xfa
jbe 0x466761
mov eax, ebx
call fcn.00404598
cmp eax, 0x64
jge 0x466761
cmp dword [0x4dedfc], 0
je 0x466761
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x466761
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call sub.user32.dll_SystemParametersInfoA
cmp dword [ebp - 8], 0
je 0x466724
mov bl, 2
jmp 0x46673f
lea edx, [ebp - 0x20]
mov eax, dword [0x4e4b48]
call fcn.00469870
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
jle 0x46673d
xor ebx, ebx
jmp 0x46673f
mov bl, 1
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x4def04]
or eax, 0x40000
push eax
push 0x64
mov eax, dword [ebp - 4]
call fcn.00465008
push eax
call dword [0x4dedfc]
mov eax, dword [0x4e3304]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
call fcn.004626ec
push 4
mov eax, dword [ebp - 4]
call fcn.00465008
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x7c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4667b8
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp - 4]
mov dword [edx + 0x214], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x210], 0
ret
Function at 0x469980
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4e3508]
cmp byte [eax + 0xc], 0
je 0x469aed
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x469ae6
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4e4b9c], 0
jne 0x4699d4
push 0x469af4
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x469afc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4b9c], eax
cmp dword [0x4def2c], 0
jne 0x469acf
push 0x469b0c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4def2c], eax
cmp dword [0x4def2c], 0
je 0x469acf
push 0x469b18
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4ba0], eax
push 0x469b28
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4ba4], eax
push 0x469b3c
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4ba8], eax
push 0x469b54
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bac], eax
push 0x469b6c
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bb0], eax
push 0x469b80
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bb4], eax
push 0x469b98
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bb8], eax
push 0x469bb0
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bbc], eax
push 0x469bcc
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bc0], eax
push 0x469bd8
mov eax, dword [0x4def2c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4e4bc4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469aed
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x46e334
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004042bc
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x46e383
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040452c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4741c4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
push ecx
cmp dword [0x4df064], 0
jg 0x4742b5
mov eax, 0x4e4bf0
mov edx, 0x104
call fcn.00404f70
push 0x104
mov eax, dword [0x4e4bf0]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov edx, eax
mov eax, 0x4e4bf0
call fcn.00404f70
xor eax, eax
mov dword [esp], eax
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
test ebx, ebx
je 0x4742b5
jmp 0x47429d
add ebx, 2
mov ax, word [ebx]
test ax, ax
je 0x47422e
cmp ax, 0x20
jbe 0x47421d
mov esi, ebx
xor edi, edi
xor edx, edx
jmp 0x474245
cmp ax, 0x22
je 0x47423f
inc edi
jmp 0x474242
xor dl, 1
add esi, 2
mov ax, word [esi]
test ax, ax
je 0x474258
cmp ax, 0x20
seta cl
or cl, dl
jne 0x474236
cmp esi, ebx
je 0x47429b
cmp dword [esp], 0
jle 0x474298
mov eax, dword [esp]
lea eax, [eax*4 + 0x4e4bf0]
mov edx, edi
call fcn.00404f70
mov edi, 1
mov ax, word [ebx]
cmp ax, 0x22
je 0x474291
mov edx, dword [esp]
mov edx, dword [edx*4 + 0x4e4bf0]
mov word [edx + edi*2 - 2], ax
inc edi
add ebx, 2
cmp esi, ebx
ja 0x474278
inc dword [esp]
mov ebx, esi
cmp word [ebx], 0
je 0x4742ad
cmp dword [esp], 8
jl 0x474220
mov eax, dword [esp]
mov dword [0x4df064], eax
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4743d4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x474441
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x474429
mov eax, dword [0x4e34fc]
cmp dword [eax], 2
jne 0x474400
push ebx
call sub.kernel32.dll_GetFileAttributesW
jmp 0x474418
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004044e4
mov eax, dword [ebp - 4]
call fcn.00404798
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x474421
test al, 0x10
jne 0x474425
xor ebx, ebx
jmp 0x47442b
mov bl, 1
jmp 0x47442b
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474448
lea eax, [ebp - 4]
call fcn.004042bc
ret
Function at 0x474ccc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4173e0]
call fcn.00404fd4
xor eax, eax
push ebp
push 0x474e10
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4df068], 0
jne 0x474d1f
mov ecx, dword [0x4e2f88]
mov dl, 1
mov eax, dword [0x407e0c]
call fcn.0040d384
call fcn.00403c38
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402de8
mov eax, ebx
call fcn.00404bfc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x474e20
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406008
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404c0c
test eax, eax
jle 0x474db7
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x474db0
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404560
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040452c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d90
test eax, eax
jne 0x474db0
mov ebx, 0x15
jmp 0x474dbc
mov ebx, 0x10
jmp 0x474dbc
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4df068]
call fcn.00474c24
mov eax, dword [ebp - 8]
call fcn.00474c24
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406020
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x474e17
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042e0
lea eax, [ebp - 0x10]
mov edx, dword [0x4173e0]
call fcn.004050a4
ret

Function at 0x47907c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4790d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e3024]
cmp byte [eax], 0
je 0x4790a6
push ebx
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
jmp 0x4790c0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004044e4
mov eax, dword [ebp - 4]
call fcn.00404798
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4790dd
lea eax, [ebp - 4]
call fcn.004042bc
ret
Function at 0x479184
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.0040777c
cmp ax, 0xffff
jne 0x4791a5
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x479226
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x479226
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x4791ec
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x4791df
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x479226
cmp dword [ebp + 8], 0
jle 0x479226
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042efa4
mov esi, eax
test esi, esi
jle 0x47921d
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00407790
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x479d3c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x479da0
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040452c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004094e0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479da7
lea eax, [ebp - 0xc]
call fcn.004042bc
ret

Function at 0x479e44
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x479ea0
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x479e6f
call fcn.0040e798
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402970
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x479ea0
call fcn.0040e798
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x482080
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4820ca
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404b64
jmp 0x4820d1
mov eax, ebx
call fcn.004049b8
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4820d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x482110
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x482110
push esi
call sub.user32.dll_VkKeyScanW
cmp al, bl
jne 0x482110
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x489950
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00402de8
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret
Function at 0x491f50
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4e5068
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x491f72
shr eax, 1
xor eax, 0xedb88320
jmp 0x491f74
shr eax, 1
dec edx
jne 0x491f60
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x491f59
mov byte [0x4e5468], 1
pop esi
pop ebx
ret

Function at 0x491f90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4e5468], 0
jne 0x491fa7
call fcn.00491f50
mov eax, edi
dec eax
test eax, eax
jl 0x491fd0
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4e5068]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x491fb1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x494a30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x494a61
dec al
je 0x494a9d
dec al
je 0x494ae1
dec al
je 0x494b4c
jmp 0x494bd6
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x494bd6
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x494a71
jmp 0x494bd6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x494bd6
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x494aad
jmp 0x494bd6
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x494bd6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x494b0f
xor ebp, ebp
jmp 0x494b20
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x494b29
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x494af1
jmp 0x494bd6
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x494bd6
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x494ba4
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00491fd8
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x494b60
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret