joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4517f4
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x451810
cmp dword [esi + 4], 0
je 0x45183d
test byte [ebx + 0x55], 1
jne 0x45182f
mov eax, ebx
call fcn.0044fbdc
test eax, eax
jne 0x45182f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x45194d
mov edx, esi
mov eax, ebx
call fcn.004511fc
jmp 0x45194d
push 0
call sub.USER32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.GDI32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.USER32.dll_ReleaseDC
push 0
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x451946
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045384c
push eax
call sub.USER32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0044d004
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.004517f4
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.GDI32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0045384c
push eax
call sub.USER32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45194d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.GDI32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.GDI32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458af0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x5023ac]
cmp byte [eax + 0xc], 0
je 0x458c5d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x458c56
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x506588], 0
jne 0x458b44
push 0x458c64
call sub.kernel32.dll_GetModuleHandleA
mov ebx, eax
push 0x458c6c
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x506588], eax
cmp dword [0x4fb81c], 0
jne 0x458c3f
push 0x458c7c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4fb81c], eax
cmp dword [0x4fb81c], 0
je 0x458c3f
push 0x458c88
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x50658c], eax
push 0x458c98
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x506590], eax
push 0x458cac
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x506594], eax
push 0x458cc4
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x506598], eax
push 0x458cdc
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x50659c], eax
push 0x458cf0
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5065a0], eax
push 0x458d08
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5065a4], eax
push 0x458d20
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5065a8], eax
push 0x458d3c
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5065ac], eax
push 0x458d48
mov eax, dword [0x4fb81c]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5065b0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458c5d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d388
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004057bc
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.USER32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x45d3d6
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00405a2c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x461458
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46158b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x16], 0
lea eax, [ebp - 0x16]
push eax
call sub.USER32.dll_GetKeyboardLayoutNameA
mov dl, 1
mov eax, dword [0x425bf0]
call fcn.00425cc0
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x461561
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00425d60
lea eax, [ebp - 0x20]
lea edx, [ebp - 0x16]
mov ecx, 0xa
call fcn.00405a2c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x4615a0
call fcn.00405acc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00425dc4
lea ecx, [ebp - 4]
mov edx, 0x4615dc
mov eax, dword [ebp - 0xc]
call fcn.00425ff4
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0040ffbc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x461544
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4615e8
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
call ebx
movzx eax, word [eax + 0x28]
and ax, 1
cmp ax, 1
sete byte [0x4fb928]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46154b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary
ret

Function at 0x461638
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov esi, eax
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ebx, byte [esp + 4]
test bx, bx
je 0x46167f
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x461662
add bx, 0x2000
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x461673
add bx, 0x4000
test byte [esp + 0xb], 0x20
je 0x46167f
add bx, 0x8000
mov eax, ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4649c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x24]
mov edi, dword [ebx + 0x34]
sub edi, dword [ebx + 0x6c]
sub edi, dword [ebx + 0x64]
jmp 0x4649f5
mov eax, dword [ebx + 0x24]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x64]
ja 0x464a74
push esi
mov eax, dword [ebx + 0x30]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.0046389c
add esp, 0xc
sub dword [ebx + 0x68], esi
sub dword [ebx + 0x64], esi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x3c]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x464a42
mov cx, word [esp]
sub cx, si
jmp 0x464a44
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x464a2b
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x38]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x464a6a
mov cx, word [esp]
sub cx, si
jmp 0x464a6c
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x464a53
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x464ad1
mov edx, dword [ebx + 0x30]
mov ecx, edi
add edx, dword [ebx + 0x64]
mov eax, ebp
add edx, dword [ebx + 0x6c]
call fcn.004646a8
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0x464abc
mov eax, dword [ebx + 0x30]
mov edx, dword [ebx + 0x64]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x64]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0x464ad1
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x4649d2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x469ce4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ecx, eax
or eax, 0xffffffff
dec edx
test edx, edx
jl 0x469d10
inc edx
movzx ebx, byte [ecx]
mov esi, eax
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x4ff20c]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0x469cf1
not eax
pop esi
pop ebx
ret

Function at 0x469e6c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor esi, esi
movzx ebx, byte [edx + esi]
xor bl, byte [eax + esi]
mov byte [ecx + esi], bl
inc esi
cmp esi, 8
jne 0x469e70
pop esi
pop ebx
ret
Function at 0x46a254
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x18]
mov edx, dword [ebp - 4]
add edx, 0x10
mov eax, 0x4ff654
mov ecx, 0x1000
call fcn.00402fd8
mov edx, dword [ebp - 4]
add edx, 0x1010
mov eax, 0x4ff60c
mov ecx, 0x48
call fcn.00402fd8
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov ecx, 8
call fcn.00402fd8
mov edx, dword [ebp - 4]
add edx, 8
mov eax, esi
mov ecx, 8
call fcn.00402fd8
xor eax, eax
mov dword [ebp - 0xc], eax
mov esi, 0x12
mov ebx, dword [ebp - 4]
add ebx, 0x1010
mov eax, dword [ebp - 0xc]
add eax, 3
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + edx]
mov eax, dword [ebp - 0xc]
add eax, 2
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
shl eax, 8
add ecx, eax
mov eax, dword [ebp - 0xc]
inc eax
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + edx]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
movzx eax, byte [eax + edx]
shl eax, 0x18
add eax, ecx
add ecx, eax
xor dword [ebx], ecx
mov eax, dword [ebp - 0xc]
add eax, 4
cdq
idiv dword [ebp - 8]
mov dword [ebp - 0xc], edx
add ebx, 4
dec esi
jne 0x46a2cf
mov eax, edi
xor ecx, ecx
mov edx, 8
call fcn.00403a8c
mov esi, 9
mov ebx, dword [ebp - 4]
add ebx, 0x1010
mov ecx, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00469e94
movzx eax, byte [edi + 3]
movzx edx, byte [edi + 2]
shl edx, 8
add eax, edx
movzx edx, byte [edi + 1]
shl edx, 0x10
add eax, edx
movzx edx, byte [edi]
shl edx, 0x18
add eax, edx
mov dword [ebx], eax
movzx eax, byte [edi + 7]
movzx edx, byte [edi + 6]
shl edx, 8
add eax, edx
movzx edx, byte [edi + 5]
shl edx, 0x10
add eax, edx
movzx edx, byte [edi + 4]
shl edx, 0x18
add eax, edx
mov dword [ebx + 4], eax
add ebx, 8
dec esi
jne 0x46a34c
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 4]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov esi, 0x80
mov eax, dword [ebp - 0x1c]
mov ebx, eax
mov ecx, edi
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00469e94
movzx eax, byte [edi + 3]
movzx edx, byte [edi + 2]
shl edx, 8
add eax, edx
movzx edx, byte [edi + 1]
shl edx, 0x10
add eax, edx
movzx edx, byte [edi]
shl edx, 0x18
add eax, edx
mov dword [ebx], eax
movzx eax, byte [edi + 7]
movzx edx, byte [edi + 6]
shl edx, 8
add eax, edx
movzx edx, byte [edi + 5]
shl edx, 0x10
add eax, edx
movzx edx, byte [edi + 4]
shl edx, 0x18
add eax, edx
mov dword [ebx + 4], eax
add ebx, 8
dec esi
jne 0x46a3ba
add dword [ebp - 0x1c], 0x400
dec dword [ebp - 0xc]
jne 0x46a3b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46e268
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46e296
mov eax, ebx
call fcn.0046ed1c
cmp dword [ebx + 0x40], 0
je 0x46e28f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46e307
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46e2f9
cmp dword [ebx + 8], 0
je 0x46e2b8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46e2ca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46e2f9
cmp dword [ebx + 8], 0
je 0x46e2ab
cmp eax, 3
je 0x46e2dd
dec eax
jne 0x46e2ab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46e2ab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46e2ab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46e325
cmp dword [ebx + 0x14], 0xcc
je 0x46e325
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046e330
pop ebx
ret

Function at 0x47f7fc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x506748
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x47f81e
shr eax, 1
xor eax, 0xedb88320
jmp 0x47f820
shr eax, 1
dec edx
jne 0x47f80c
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x47f805
mov byte [0x506b48], 1
pop esi
pop ebx
ret

Function at 0x47f83c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x506b48], 0
jne 0x47f853
call fcn.0047f7fc
mov eax, edi
dec eax
test eax, eax
jl 0x47f87b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x506748]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x47f85d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x481cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0x481d6a.0
jmp dword [ecx*4 + 0x481d03]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x481d35
sub dl, 8
je 0x481d44
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481a3c
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481a94
jmp case.0x481d6a.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0x481d6a.0
movzx ecx, byte [ecx + 0x481d71]
jmp dword [ecx*4 + 0x481d82]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481aec
jmp case.0x481d6a.0
cmp dl, 3
jne 0x481daf
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481b40
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481afc
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481b84
jmp case.0x481d6a.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x481dda
sub dl, 8
je 0x481de6
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481ba0
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481c0c
jmp case.0x481d6a.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0x481e05
sub dl, 8
je 0x481e11
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481c7c
jmp case.0x481d6a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x481ca4
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0x481ea1
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00481030
test eax, eax
je 0x481ea1
mov eax, ebx
call fcn.00481eac
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x481e41
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x481eac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x481edd
dec al
je 0x481f18
dec al
je 0x481f5d
dec al
je 0x481fc6
jmp 0x482050
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x482050
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x481eed
jmp 0x482050
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x482050
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x481f28
jmp 0x482050
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x482050
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x481f8c
xor ebp, ebp
jmp 0x481f9c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x481fa5
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x481f6d
jmp 0x482050
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x482050
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x48201f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0047f884
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x481fda
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48e3fc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00405ff0
push 0
movzx eax, byte [ebp - 2]
push eax
call sub.USER32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x48e44a
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.USER32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, 0x100
call fcn.00406158
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e450
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push 2
movzx eax, bx
push eax
call sub.USER32.dll_MapVirtualKeyW
mov edi, eax
mov eax, ebx
add eax, 0xffffffd0
sub ax, 0xa
jae 0x48e488
mov esi, ebx
sub si, 0x30
add si, 0x30
cmp si, di
je 0x48e488
push esi
call sub.USER32.dll_VkKeyScanW
cmp al, bl
jne 0x48e488
mov edi, esi
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x48ef04
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48f096
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.USER32.dll_GetKeyboardLayout
mov edx, dword [ebp - 8]
mov dword [edx + 0xbc], eax
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
jne 0x48ef45
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x48ef62
mov edi, dword [esi + 0x6c]
test edi, edi
je 0x48ef58
mov eax, edi
call fcn.0045e2f0
mov dword [ebp - 4], eax
jmp 0x48ef62
mov eax, esi
call fcn.0045e2f0
mov dword [ebp - 4], eax
mov eax, dword [0x501e88]
cmp byte [eax], 0
je 0x48f07b
mov eax, dword [ebp - 8]
cmp dword [eax + 0x64], 0
je 0x48f07b
test ebx, ebx
je 0x48f07b
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x1c]
and ax, word [0x48f0a4]
movzx edx, word [0x48f0a8]
cmp dx, ax
jne 0x48f07b
mov eax, dword [ebp - 8]
cmp byte [eax + 0x3e], 0
je 0x48f07b
push ebp
call fcn.0048eda4
pop ecx
test al, al
je 0x48f07b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0048ebb8
mov eax, dword [ebp - 8]
call fcn.0045fe3c
test eax, eax
jne 0x48f029
mov eax, dword [ebp - 8]
cmp word [eax + 0x60], 0
je 0x48f029
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
test esi, esi
je 0x48f002
cmp dword [esi + 0x64], 0
jne 0x48f002
mov eax, dword [esi + 4]
mov edx, dword [0x45cc68]
call fcn.00404ae4
test al, al
jne 0x48f029
push dword [ebp - 0xc]
push 0x48f0b0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x60]
call fcn.0048e490
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406270
push ebp
lea eax, [ebp - 0x14]
call fcn.0048ee00
pop ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.004062b8
je 0x48f07b
push ebp
mov eax, dword [ebp - 0xc]
call fcn.0048ee74
pop ecx
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x64]
cmp esi, dword [ebx + 0x34]
je 0x48f05b
cmp dword [esi + 0x6c], 0
je 0x48f07b
mov eax, ebx
mov edx, dword [0x45cc68]
call fcn.00404ae4
test al, al
je 0x48f07b
cmp dword [ebx + 0x38], 0
je 0x48f07b
mov eax, dword [ebx + 0x38]
push eax
call sub.USER32.dll_DrawMenuBar
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f09d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00406008
ret

Function at 0x490b44
Capabilities:
Set global application hook

Disassembly:
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
push 0x490ae4
push 3
call sub.USER32.dll_SetWindowsHookExW
mov dword [0x506be8], eax
cmp dword [0x506be8], 0
jne 0x490b6b
call fcn.0040f90c
ret