joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4985ec
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret

Function at 0x499694
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret

Function at 0x49f18c
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dl, byte [eax + 0x28]
test dl, dl
jne 0x49f1a9
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_connect
jmp 0x49f1ba
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004a2418
pop ebp
ret 0x10

Function at 0x4a2418
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a243b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a244b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_connect
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_connect__u_0x_p__d_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x20
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4a25f4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2617
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2627
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_getsockname
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_getsockname__u_0x_p_0x_p_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x20
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4a27b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a27d3
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a27e3
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_inet_addr
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_inet_addr__s______0x_lX
lea ecx, [ebp - 0xac]
push ecx
call fcn.0056b4b8
add esp, 0x14
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x4a28ac
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a28cf
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a28df
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_recv
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_recv__u_0x_p__d__d_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x24
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4a2964
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2987
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2997
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_recvfrom
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_recvfrom__u_0x_p__d__d_0x_p_0x_p_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x2c
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4a2a28
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2a4b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2a5b
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_send
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_send__u_0x_p__d__d_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x24
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x14

Function at 0x4a2ae0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2b03
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a2b13
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_sendto
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_sendto__u_0x_p__d__d_0x_p__d_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x2c
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4a30e0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a3103
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a3113
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_gethostbyname__s______0x_p___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x18
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8

Function at 0x4a3188
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a31ab
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a31bb
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.WSOCK32.DLL_gethostname
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea ecx, [ebp - 0xc8]
push ecx
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.Sock_ID_lu_gethostname__s__d_______d___s_
lea edx, [ebp - 0xac]
push edx
call fcn.0056b4b8
add esp, 0x1c
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a3234
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
xor eax, eax
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a3257
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x20]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4a3267
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x24]
mov dword [ebp - 8], edx
push dword [ebp + 0x10]
mov cx, word [ebp + 0xc]
push ecx
call sub.WSOCK32.DLL_WSAStartup
mov dword [ebp - 0xc], eax
call sub.WSOCK32.DLL_WSAGetLastError
mov dword [0x5cf78c], eax
lea eax, [ebp - 0xc8]
push eax
push dword [0x5cf78c]
call fcn.004a3440
add esp, 8
lea edx, [ebp - 0xc8]
push edx
push dword [ebp - 0xc]
push dword [ebp + 0x10]
movzx ecx, word [ebp + 0xc]
push ecx
push dword [ebp - 4]
push str.Sock_ID_lu_WSAStartup_0x_X_0x_p_______d___s_
lea eax, [ebp - 0xac]
push eax
call fcn.0056b4b8
add esp, 0x1c
push dword [0x5c1d4c]
call sub.USER32.DLL_IsWindow
test eax, eax
je 0x4a32f3
mov edx, dword [0x5c1d50]
test edx, edx
je 0x4a32f3
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 8]
push dword [0x5c1d50]
push dword [0x5c1d4c]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4b040c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 1
call fcn.004affdc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x134], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x130], edx
mov eax, dword [ebp - 4]
xor dword [eax + 0x9c], edi
mov ebx, 1
mov eax, ebx
shl eax, 3
sub eax, ebx
add eax, eax
mov ecx, 0x25
cdq
idiv ecx
mov eax, edx
mov edx, dword [ebp - 4]
xor dword [edx + eax*4 + 0x9c], esi
mov eax, esi
sub edi, esi
mov esi, edi
mov edi, eax
inc ebx
cmp ebx, 0x25
jl 0x4b0447
xor ebx, ebx
call fcn.004b034c
inc ebx
cmp ebx, 0x3e8
jl 0x4b0474
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4b3e78
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [ecx + 0x1c]
xor ebx, ebx
mov dword [eax], ebx
inc edx
add eax, 4
cmp edx, 0x50
jl 0x4b3e84
xor eax, eax
mov dword [ecx + 4], eax
mov dword [ecx], eax
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
pop ebx
pop ebp
ret

Function at 0x4b9c2c
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4b9b78
call sub.USER32.DLL_EnumWindows
ret

Function at 0x4b9d50
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4b9dcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004b979c
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x4b9d75
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004b93f4
cmp dword [ebp - 4], 0
je 0x4b9db7
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.0055bb04
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9dd4
lea eax, [ebp - 4]
call fcn.0055b654
ret

Function at 0x4cd320
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0055b654
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x4cd36f
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.0055b8bc
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d32a4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d3504
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4d3307
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004d2d6c
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0054bfc4
cmp al, 1
jne 0x4d3307
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004d3084
test al, al
je 0x4d3493
cmp dword [ebp - 8], 0
jge 0x4d3325
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004d2d6c
mov eax, dword [ebp - 0x210]
call fcn.0055b90c
cmp ebx, eax
jge 0x4d336f
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004d2d6c
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x5cefe0]
and eax, 0xff
bt dword [edx], eax
jae 0x4d336f
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4d3383
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004d3280
cmp ebx, dword [ebp - 8]
je 0x4d3485
lea eax, [ebp - 0x108]
push eax
call sub.USER32.DLL_GetKeyboardState
mov edx, 0x100
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4d33af
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0055ad04
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c6004]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.USER32.DLL_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4d3472
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0055ad04
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c6004]
push eax
push 0x100
mov eax, dword [ebp - 4]
call fcn.00507060
push eax
call sub.USER32.DLL_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0055ad04
and eax, 0x7f
movzx eax, word [eax*2 + 0x5c6004]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.00507060
push eax
call sub.USER32.DLL_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3479
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4d34e6
cmp dword [ebp - 8], 0
jge 0x4d349e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004d2d6c
mov eax, dword [ebp - 0x218]
call fcn.0055b90c
cmp eax, dword [ebp - 8]
jg 0x4d34d8
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004d2d6c
mov eax, dword [ebp - 0x21c]
call fcn.0055b90c
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004d3280
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d350b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.0055b678
ret
Function at 0x4e0684
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4e068a
ret

Function at 0x4e2d6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4e2dbd
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4e2da4
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4e2d94
jmp 0x4e2dbd
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4e2da5
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eba80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4ebad0]
test si, 4
je 0x4eba94
or bl, 1
test si, 8
je 0x4eba9e
or bl, 4
test si, 1
je 0x4ebaa8
or bl, 8
test si, 2
je 0x4ebab2
or bl, 0x10
test si, 0x10
je 0x4ebabc
or bl, 0x20
push 0x12
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4ebacb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4ebad4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4ebb0c]
push 0x10
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4ebaed
or bl, 1
push 0x11
call sub.USER32.DLL_GetKeyState
test ax, ax
jge 0x4ebafc
or bl, 4
test esi, 0x20000000
je 0x4ebb07
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4f2468
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4f247a
add esp, 0xfffffff0
call fcn.0055ae6c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00540b94
mov eax, dword [0x5cef10]
mov dword [eax + 4], ebx
mov dword [eax], 0x4f280c
mov eax, dword [0x5cef14]
mov dword [eax + 4], ebx
mov dword [eax], 0x4f2818
mov eax, ebx
call fcn.004f2824
push 0
call sub.USER32.DLL_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x535e68]
call fcn.0055aad8
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x535e68]
call fcn.0055aad8
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x535e68]
call fcn.0055aad8
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x535e68]
call fcn.0055aad8
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x535e68]
call fcn.0055aad8
mov dword [ebx + 0x7c], eax
push 0
call sub.USER32.DLL_GetDC
mov esi, eax
push 0x5a
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.USER32.DLL_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x4eecec
push eax
push 0
push 0
mov eax, dword [0x5ceefc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4dfab8]
call fcn.004e11cc
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4dfab8]
call fcn.004e11cc
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4dfab8]
call fcn.004e11cc
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004f2c8c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4f2b68
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4f2b68
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x4f2b68
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4f25b7
call fcn.0055aec4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret