joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463908
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4f38b8]
cmp byte [eax + 0xc], 0
je 0x463a75
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x463a6e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f4b7c], 0
jne 0x46395c
push 0x463a7c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x463a84
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b7c], eax
cmp dword [0x4f2080], 0
jne 0x463a57
push 0x463a94
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4f2080], eax
cmp dword [0x4f2080], 0
je 0x463a57
push 0x463aa0
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b80], eax
push 0x463ab0
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b84], eax
push 0x463ac4
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b88], eax
push 0x463adc
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b8c], eax
push 0x463af4
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b90], eax
push 0x463b08
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b94], eax
push 0x463b20
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b98], eax
push 0x463b38
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4b9c], eax
push 0x463b54
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4ba0], eax
push 0x463b60
mov eax, dword [0x4f2080]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4f4ba4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463a75
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x467ecc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404280
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x467f1b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004044f0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46f728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x46f778]
test si, 4
je 0x46f73c
or bl, 1
test si, 8
je 0x46f746
or bl, 4
test si, 1
je 0x46f750
or bl, 8
test si, 2
je 0x46f75a
or bl, 0x10
test si, 0x10
je 0x46f764
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f773
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x46f77c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x46f7b4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f795
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x46f7a4
or bl, 4
test esi, 0x20000000
je 0x46f7af
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x46f804
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
add esp, 0xffffff00
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.0046f7b8
mov ebx, eax
mov eax, ebx
add esp, 0x100
pop ebx
ret

Function at 0x475e7c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x475e8e
add esp, 0xfffffff0
call fcn.004037b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424830
mov eax, dword [0x4f3458]
mov dword [eax + 4], ebx
mov dword [eax], 0x476220
mov eax, dword [0x4f3468]
mov dword [eax + 4], ebx
mov dword [eax], 0x47622c
mov eax, ebx
call fcn.00476238
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x472654
push eax
push 0
push 0
mov eax, dword [0x4f3608]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x4262c4]
call fcn.00427960
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4262c4]
call fcn.00427960
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4262c4]
call fcn.00427960
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00476658
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x476534
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x476534
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x476534
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x475fcb
call fcn.0040380c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x476318
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4764c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4764a4
mov dl, 1
mov eax, dword [0x419690]
call fcn.00403420
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404280
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x476493
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00463c68
test al, al
je 0x476486
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4764d4
lea eax, [ebp - 0x254]
call fcn.0040968c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x476486
xor eax, eax
push ebp
push 0x47647f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x47650c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x476468
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f0
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x476468
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004044f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476486
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x476389
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041e264
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4764ca
lea eax, [ebp - 0x260]
call fcn.00404280
ret

Function at 0x476df8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4f4bc8]
cmp byte [eax + 0xa5], 0
jne 0x476e69
cmp dword [0x4f4be0], 0
jne 0x476e2a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x476db4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x4f4be0], eax
cmp dword [0x4f4bdc], 0
jne 0x476e45
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x4f4bdc], eax
cmp dword [0x4f4be4], 0
jne 0x476e69
push esp
push 0
push 0
push 0x476d58
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4f4be4], eax
pop edx
ret
Function at 0x476f60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x476f77
add esp, 0xfffffff0
call fcn.004037b4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00424830
mov eax, dword [0x4f35f0]
cmp word [eax + 2], 0
jne 0x476f9f
mov eax, dword [0x4f35f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004786e0
mov eax, dword [0x4f36d8]
cmp word [eax + 2], 0
jne 0x476fb9
mov eax, dword [0x4f36d8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004788d8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41902c]
call fcn.00403420
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x426ccc]
call fcn.0042e484
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x477140
mov eax, dword [0x4f34d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042e854
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x478e88
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4f34d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d09c
test eax, eax
je 0x4770ae
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040906c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d0c4
test eax, eax
je 0x4770c2
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004044f0
mov eax, dword [0x4f335c]
cmp byte [eax], 0
jne 0x4770f6
mov eax, ebx
call fcn.00477268
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00479064
mov eax, ebx
call fcn.00479a28
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x477136
call fcn.0040380c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4774e8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4f4bc8]
cmp dword [eax + 0x30], 0
je 0x477592
cmp dword [ebx + 0x94], 0
jne 0x47758c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x477478
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x47758c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x477552
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x47758c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041b8f0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x477561
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4780f4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x478129
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404370
jmp 0x478136
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004042d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x479240
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x479281
mov eax, esi
call fcn.0045f230
test al, al
je 0x479281
mov eax, dword [ebx + 0x84]
call fcn.0045ef2c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x479281
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045ef2c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x47e2e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47e544
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x47e347
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.0047ddfc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040cba8
cmp al, 1
jne 0x47e347
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.0047e0c4
test al, al
je 0x47e4d3
cmp dword [ebp - 8], 0
jge 0x47e365
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.0047ddfc
mov eax, dword [ebp - 0x210]
call fcn.00404540
cmp ebx, eax
jge 0x47e3af
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.0047ddfc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4f38a0]
and eax, 0xff
bt dword [edx], eax
jae 0x47e3af
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x47e3c3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047e2c0
cmp ebx, dword [ebp - 8]
je 0x47e4c5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x47e3ef
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040364c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2324]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x47e4b2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040364c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2324]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0045ef2c
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040364c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4f2324]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.0045ef2c
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e4b9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x47e526
cmp dword [ebp - 8], 0
jge 0x47e4de
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.0047ddfc
mov eax, dword [ebp - 0x218]
call fcn.00404540
cmp eax, dword [ebp - 8]
jg 0x47e518
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.0047ddfc
mov eax, dword [ebp - 0x21c]
call fcn.00404540
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0047e2c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e54b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004042a4
ret
Function at 0x48b334
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0x48b35e
cmp dword [ebx + 0x64], 0
jne 0x48b35e
cmp dword [ebx + 0x6c], 0
jne 0x48b35e
mov esi, edi
jmp 0x48b3ec
cmp esi, 0xffffffff
jne 0x48b369
dec esi
jmp 0x48b3ec
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0x48b3ec
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.0048a99c
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x48b3b4
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x48b3b9
mov word [edx], 0
dec eax
test eax, eax
jne 0x48b39a
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp edi, dword [esp]
ja 0x48b3e0
mov cx, word [esp]
sub cx, di
mov word [edx], cx
jmp 0x48b3e5
mov word [edx], 0
dec eax
test eax, eax
jne 0x48b3c6
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0x48b44a
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.0048b0bc
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x48b435
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x48b44a
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48b33e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495b24
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x495b39
add esp, 0xfffffff0
call fcn.004037b4
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404730
xor eax, eax
push ebp
push 0x495bfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00491ca0
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a270
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a270
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a270
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041a270
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.0041a298
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495c03
lea eax, [ebp - 4]
call fcn.00404280
ret
Function at 0x49a1e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x49a2e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x49a2f8
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.004042d4
push 0xffffffffffffffff
mov ecx, 0x49a308
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
mov ecx, 0x49a324
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0048604c
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x49a340
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00485f38
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x49a354
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00485f38
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x49a36c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.00485f38
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x49a388
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0048604c
mov byte [ebx + 0x44], al
mov ecx, 0x49a39c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.0049197c
mov byte [ebx + 0x45], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49a2e7
lea eax, [ebp - 4]
call fcn.00404280
ret

Function at 0x4b6560
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bl, byte [0x4b6598]
push 0x10
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b6576
or bl, 1
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b6585
or bl, 4
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x4b6594
or bl, 2
mov eax, ebx
pop ebx
ret

Function at 0x4b6ea0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
mov edx, dword [0x454524]
call fcn.004035dc
test al, al
je 0x4b6ee2
mov eax, dword [0x4f36ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
test eax, eax
je 0x4b6ee2
mov edx, dword [0x4f36ac]
xor edx, edx
call fcn.00471b34
push 0
mov eax, dword [0x4f36ac]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4c4060
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4c41b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x338]
test eax, eax
je 0x4c4188
cmp dword [eax + 0x3e0], 0
je 0x4c4188
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2d8]
cmp eax, 0xc8
jbe 0x4c4188
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2d8], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00458744
mov eax, dword [ebp - 0xc]
call fcn.00404540
dec eax
jne 0x4c4108
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00458744
mov eax, dword [ebp - 0x10]
call fcn.00404740
push eax
mov eax, ebx
call fcn.004c4b54
push eax
push 0x18f
mov eax, dword [ebx + 0x338]
mov eax, dword [eax + 0x3e0]
call fcn.0045ef2c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4c413b
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00458744
mov eax, dword [ebp - 0x14]
call fcn.00404740
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x338]
mov eax, dword [eax + 0x3e0]
call fcn.0045ef2c
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4c4188
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00458744
mov edx, esi
mov eax, ebx
call fcn.004c4b60
lea edx, [ebp - 8]
mov eax, ebx
call fcn.00458744
mov eax, dword [ebp - 4]
call fcn.00404540
mov edx, eax
mov eax, ebx
call fcn.004c4340
mov eax, dword [ebp - 8]
call fcn.00404540
push eax
mov eax, dword [ebp - 4]
call fcn.00404540
pop edx
sub edx, eax
mov eax, ebx
call fcn.004c435c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c41b7
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004042a4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042a4
ret