joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48194c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea esi, [ebp - 4]
xor eax, eax
push ebp
push 0x481b2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [esi]
call fcn.004e6908
mov eax, dword [esi]
cmp byte [eax + 0x278], 0
je 0x481b13
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
sub eax, dword [edx + 0x288]
mov edx, dword [esi]
cmp eax, dword [edx + 0x2e0]
jb 0x4819b4
mov eax, dword [esi]
add eax, 0x284
xor edx, edx
call fcn.00407b00
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [esi]
mov dword [edx + 0x288], eax
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, 8
je 0x481a9a
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp ax, 0xd800
jb 0x4819e3
cmp ax, 0xdfff
jbe 0x4819e7
xor eax, eax
jmp 0x4819e9
mov al, 1
test al, al
je 0x481a57
push 1
push 0x102
push 0x102
mov eax, dword [esi]
call fcn.004e7afc
push eax
lea eax, [ebp - 0x24]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
je 0x481ade
mov eax, dword [esi]
push dword [eax + 0x284]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.00407c6c
push dword [ebp - 0x28]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
call fcn.00407c6c
push dword [ebp - 0x2c]
mov eax, dword [esi]
add eax, 0x284
mov edx, 3
call fcn.004080b8
mov eax, dword [ebp - 8]
mov word [eax], 0
jmp 0x481ade
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 8]
movzx edx, word [edx]
call fcn.00407c6c
mov edx, dword [ebp - 0x30]
mov eax, dword [esi]
add eax, 0x284
call fcn.00407f14
jmp 0x481ade
mov eax, dword [esi]
mov ebx, dword [eax + 0x284]
test ebx, ebx
je 0x481a87
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [esi]
add eax, 0x284
mov ecx, 1
mov edx, ebx
call fcn.004083b0
mov eax, dword [esi]
mov eax, dword [eax + 0x284]
call fcn.00407e70
mov edx, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x284]
call fcn.0041be08
cmp al, 2
je 0x481a76
mov eax, dword [esi]
mov eax, dword [eax + 0x284]
test eax, eax
je 0x481acb
sub eax, 4
mov eax, dword [eax]
mov edx, dword [esi]
add edx, 0x284
mov ecx, 1
xchg edx, eax
call fcn.004083b0
mov eax, dword [esi]
mov eax, dword [eax + 0x284]
test eax, eax
je 0x481aef
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x481afc
push ebp
call fcn.00481864
pop ecx
jmp 0x481b13
xor edx, edx
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov eax, dword [esi]
mov si, 0xffec
call fcn.00405a14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481b35
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00407af8
ret
Function at 0x484ab8
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x484ba5
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x484b77
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x484b66
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.00404504
mov eax, dword [ebp - 4]
call fcn.0048499c
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x484b4f
mov ecx, dword [0x736ca0]
mov dl, 1
mov eax, dword [0x42d668]
call fcn.0041affc
call fcn.00406324
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484b6d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x484bb8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
push 0xd
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x484c2c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x484bfe
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00407cac
jmp 0x484c07
mov eax, ebx
xor edx, edx
call fcn.00407b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484c33
cmp dword [ebp - 8], 0
je 0x484c23
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x484cc4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x484d6c
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x484d3f
mov edx, ebx
mov eax, dword [0x4577f8]
call fcn.0045f664
test al, al
je 0x484d2f
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0045f57c
call fcn.00406418
jmp 0x484d73
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x484cf7
mov ecx, dword [0x736df0]
mov dl, 1
mov eax, dword [0x4848b0]
call fcn.0041affc
call fcn.00406324
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484d73
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x484d7c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x484dd8
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
mov edi, eax
push edi
mov ecx, esi
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484ddf
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x484de8
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor edx, edx
push ebp
push 0x484e3d
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484e44
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x484eb4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x484f29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048499c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0045f640
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x484f13
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484f30
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x484f38
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x484fad
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048499c
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x484f97
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484fb4
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x4b7864
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x73d1e8
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4b7886
shr eax, 1
xor eax, 0xedb88320
jmp 0x4b7888
shr eax, 1
dec edx
jne 0x4b7874
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4b786d
mov byte [0x73d5e8], 1
pop esi
pop ebx
ret

Function at 0x4b78a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x73d5e8], 0
jne 0x4b78bb
call fcn.004b7864
mov eax, edi
dec eax
test eax, eax
jl 0x4b78e3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x73d1e8]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4b78c5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4ba644
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4ba6de.0
jmp dword [ecx*4 + 0x4ba677]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4ba6a9
sub dl, 8
je 0x4ba6b8
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba2ec
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba344
jmp case.0x4ba6de.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4ba6de.0
movzx ecx, byte [ecx + 0x4ba6e5]
jmp dword [ecx*4 + 0x4ba6f6]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba3f0
jmp case.0x4ba6de.0
cmp dl, 3
jne 0x4ba723
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba448
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba404
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba48c
jmp case.0x4ba6de.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4ba74e
sub dl, 8
je 0x4ba75a
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba4b8
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba524
jmp case.0x4ba6de.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4ba779
sub dl, 8
je 0x4ba785
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba5e0
jmp case.0x4ba6de.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4ba608
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x4ba827
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004b97f0
test eax, eax
je 0x4ba827
mov eax, ebx
call fcn.004ba830
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x4ba7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ba830
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4ba861
dec al
je 0x4ba89c
dec al
je 0x4ba8e1
dec al
je 0x4ba94a
jmp 0x4ba9d4
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4ba9d4
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ba871
jmp 0x4ba9d4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba9d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4ba8ac
jmp 0x4ba9d4
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba9d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4ba910
xor ebp, ebp
jmp 0x4ba920
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4ba929
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ba8f1
jmp 0x4ba9d4
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4ba9d4
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4ba9a3
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004b78ec
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4ba95e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bedb8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
xor ebx, ebx
lea eax, [esi + 4]
mov edx, dword [ebp - 8]
call fcn.00407b00
cmp edi, dword [ebp - 4]
je 0x4bee2a
mov dword [esi + 0x10], edi
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
lea edx, [esi + 8]
mov eax, edi
mov ecx, 6
call fcn.00404504
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x10
push edi
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4bee2a
mov byte [edi], 0xe9
mov edx, dword [ebp - 4]
mov eax, edi
sub edx, eax
sub edx, 5
inc eax
mov dword [eax], edx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0x10
push edi
call sub.kernel32.dll_VirtualProtect
mov bl, 1
test bl, bl
jne 0x4bee33
xor eax, eax
mov dword [esi + 0x10], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4bf4a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10
mov eax, dword [esi + 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4bf4e4
mov edx, dword [esi + 0x10]
lea eax, [esi + 8]
mov ecx, 6
call fcn.00404504
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x10
mov eax, dword [esi + 0x10]
push eax
call sub.kernel32.dll_VirtualProtect
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4c1e9c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
mov dword [ebp - 0x114], 0x114
lea eax, [ebp - 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
cmp dword [ebp - 0x104], 2
jne 0x4c1edf
cmp dword [ebp - 0x110], 5
ja 0x4c1ee3
cmp dword [ebp - 0x110], 5
jne 0x4c1edf
cmp dword [ebp - 0x10c], 1
jae 0x4c1ee3
xor eax, eax
jmp 0x4c1ee5
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4c7a24
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00407b00
push 0
mov eax, esi
movzx eax, al
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x4c7a6b
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00407d00
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x4ccfe4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd11d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x45280c]
call fcn.004538c0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4cd0f3
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004539a8
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x20]
mov ecx, 0xa
call fcn.00407d00
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x4cd138
call fcn.00407fd4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00453b44
test al, al
je 0x4cd0dd
lea ecx, [ebp - 4]
mov edx, 0x4cd1ac
mov eax, dword [ebp - 0xc]
call fcn.004542c4
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0041de70
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4cd0d6
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4cd1c4
mov eax, dword [ebp - 8]
push eax
call fcn.0040d038
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x729fc0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd0dd
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd0fa
mov eax, dword [ebp - 0xc]
call fcn.0040575c
ret

Function at 0x4cd228
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x4cd26f
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cd252
add bx, 0x2000
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4cd263
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x4cd26f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4dc490
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x73d65c], 0
je 0x4dc5d1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x737638]
mov edx, dword [edx]
xor al, byte [edx + 0xbc]
je 0x4dc5d1
mov eax, dword [0x73d660]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x73d65c]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4dc5a0
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x73d65c]
call fcn.004395d8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4dc598
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1ea], 0
je 0x4dc598
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x5c]
test al, al
je 0x4dc598
mov eax, dword [ebp - 0x14]
call fcn.004e7afc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4dc598
push ebp
call fcn.004dc44c
pop ecx
test al, al
jne 0x4dc598
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00405a14
test al, al
je 0x4dc598
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00405a14
cmp byte [ebp - 1], 0
je 0x4dc598
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.0040bbac
test al, al
je 0x4dc598
mov edx, dword [ebp - 0x14]
mov eax, dword [0x73d660]
call fcn.004dbba8
inc edi
dec ebx
jne 0x4dc4f5
mov eax, dword [0x73d660]
cmp dword [eax + 8], 0
jle 0x4dc5b8
mov eax, dword [0x73d660]
call fcn.004dbc60
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4dc5d1
push ebp
mov eax, dword [ebp - 0x18]
call fcn.004dc2b0
pop ecx
test al, al
jne 0x4dc5d1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret