joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, edx
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, eax
test eax, eax
je 0x44c25f
cmp byte [eax], dl
je 0x44c257
inc edi
cmp byte [edi], dl
jne 0x44c252
sub edi, eax
and edi, 0x3fffffff
xor ebx, ebx
cmp dword [esi + 4], edx
jle 0x44c30b
nop word [eax + eax]
mov eax, ebx
mov ecx, ebx
xor eax, 1
cmp ebx, 2
cmovl ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x44c2db
mov edx, ecx
mov ecx, dword [esi + 8]
add edx, edx
mov esi, dword [ecx + edx*8]
mov ecx, eax
mov cl, byte [ecx]
test cl, cl
je 0x44c2bd
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x545b78]
cmp cl, byte [edx + 0x545b78]
jne 0x44c2bd
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x44c2a0
movzx ecx, byte [esi]
movzx eax, byte [eax]
mov esi, dword [ebp - 8]
movzx ecx, byte [ecx + 0x545b78]
movzx eax, byte [eax + 0x545b78]
sub eax, ecx
jne 0x44c2fe
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi + 8]
add ecx, ecx
mov edx, dword [ebp - 0x10]
push edi
mov ecx, dword [eax + ecx*8 + 0xc]
add ecx, 8
call fcn.0041c790
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x44c30b
jmp 0x44c301
mov edx, dword [ebp - 4]
inc ebx
cmp ebx, dword [esi + 4]
jl 0x44c270
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44c3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, edx
xor edx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
push ebx
push edi
mov edi, eax
test eax, eax
je 0x44c3ed
cmp byte [eax], dl
je 0x44c3e5
nop dword [eax]
inc edi
cmp byte [edi], dl
jne 0x44c3e0
sub edi, eax
and edi, 0x3fffffff
mov eax, dword [ecx + 4]
xor ebx, ebx
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x44c499
push esi
mov esi, dword [ecx + 8]
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov eax, ebx
xor ecx, 1
cmp ebx, 2
cmovl eax, ecx
mov ecx, dword [ebp + 8]
shl eax, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 8], eax
test ecx, ecx
je 0x44c46b
mov esi, dword [esi]
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x44c450
nop dword [eax]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x545b78]
cmp cl, byte [edx + 0x545b78]
jne 0x44c44d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x44c430
mov edx, dword [ebp - 4]
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x545b78]
movzx ecx, byte [ecx + 0x545b78]
sub eax, ecx
jne 0x44c483
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
lea ecx, [eax + 0x18]
push edi
call fcn.0041c790
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
jne 0x44c490
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x44c404
pop esi
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c4b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
add edx, edx
mov ecx, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 8]
mov eax, dword [eax + edx*8 + 0xc]
add eax, 0x18
mov dword [ebp - 8], eax
test ecx, ecx
je 0x44c4ee
cmp byte [ecx], 0
je 0x44c4e6
nop dword [eax + eax]
inc esi
cmp byte [esi], 0
jne 0x44c4e0
sub esi, ecx
and esi, 0x3fffffff
mov edx, dword [eax]
xor ebx, ebx
mov dword [ebp - 0x10], edx
test edx, edx
je 0x44c537
mov eax, ecx
mov dword [ebp - 4], eax
test esi, esi
je 0x44c52b
mov edi, esi
movzx eax, byte [eax]
lea ecx, [ebx*8]
dec edi
movzx edx, byte [eax + 0x545b78]
mov eax, dword [ebp - 4]
xor edx, ecx
inc eax
xor ebx, edx
mov dword [ebp - 4], eax
test edi, edi
jg 0x44c504
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ebx, edx
push ebx
mov edx, ecx
mov ecx, eax
push esi
call fcn.0041c680
add esp, 8
test eax, eax
je 0x44c59c
mov ecx, dword [ebp - 8]
mov edx, eax
mov esi, dword [eax + 8]
push ebx
call fcn.0041c730
add esp, 4
test esi, esi
je 0x44c59c
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x10]
cmp ecx, esi
jne 0x44c570
mov eax, dword [esi + 0x20]
mov dword [edx + 0x10], eax
jmp 0x44c589
test ecx, ecx
je 0x44c589
mov eax, dword [ecx + 0x20]
cmp eax, esi
je 0x44c583
mov ecx, eax
test ecx, ecx
jne 0x44c574
jmp 0x44c589
mov eax, dword [esi + 0x20]
mov dword [ecx + 0x20], eax
push dword [esi + 0x1c]
push edi
call fcn.004190a0
push esi
push edi
call fcn.004190a0
add esp, 0x10
or dword [edi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
test edx, edx
je 0x44c93d
test edi, edi
je 0x44c7b6
cmp dword [edi + 0x1f8], 0
jne 0x44c7c5
mov eax, 0xffff
add word [edx + 0x20], ax
jne 0x44c93d
mov ebx, dword [edx + 0x10]
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x44c8b2
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x24], eax
test edi, edi
je 0x44c7ea
cmp dword [edi + 0x1f8], 0
jne 0x44c88f
mov esi, dword [ebx]
mov ecx, esi
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x44c80e
cmp byte [esi], 0
je 0x44c806
nop word [eax + eax]
inc ecx
cmp byte [ecx], 0
jne 0x44c800
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x24]
add eax, 0x18
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
test edx, edx
je 0x44c868
xor ebx, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], esi
test ecx, ecx
je 0x44c859
mov edi, ecx
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [ebx*8]
dec edi
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x545b78]
xor esi, edx
xor ebx, esi
test edi, edi
jg 0x44c833
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov eax, ebx
xor edx, edx
div dword [ebp - 0x20]
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
jmp 0x44c86a
xor edx, edx
push edx
mov dword [ebp - 4], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.0041c680
add esp, 8
test eax, eax
je 0x44c88f
push dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov edx, eax
call fcn.0041c730
add esp, 4
push dword [ebx + 0x1c]
push edi
call fcn.004190a0
push ebx
push edi
call fcn.004190a0
mov eax, dword [ebp - 0x24]
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, eax
test eax, eax
jne 0x44c7d3
mov ebx, dword [ebp - 0x28]
mov ecx, edi
mov edx, ebx
call fcn.00456c90
mov edx, ebx
mov ecx, edi
call fcn.0044c720
push dword [ebx]
push edi
call fcn.004190a0
push dword [ebx + 0x28]
push edi
call fcn.004190a0
mov edx, dword [ebx + 0x1c]
add esp, 0x10
mov ecx, edi
call fcn.0045e650
mov edx, dword [ebx + 0x2c]
mov ecx, edi
call fcn.004441d0
test edi, edi
je 0x44c8fc
cmp dword [edi + 0x1f8], 0
jne 0x44c905
mov edx, ebx
xor ecx, ecx
call fcn.00469d30
cmp dword [ebx + 0x3c], 0
je 0x44c933
xor esi, esi
cmp dword [ebx + 0x38], esi
jle 0x44c927
mov eax, dword [ebx + 0x3c]
push dword [eax + esi*4]
push edi
call fcn.004190a0
inc esi
add esp, 8
cmp esi, dword [ebx + 0x38]
jl 0x44c912
push dword [ebx + 0x3c]
push edi
call fcn.004190a0
add esp, 8
push ebx
push edi
call fcn.004190a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
shl edx, 4
mov ecx, dword [ebp + 8]
push ebx
push esi
add edx, dword [eax + 8]
mov esi, ecx
mov dword [ebp - 0x14], eax
push edi
test ecx, ecx
je 0x44c980
cmp byte [ecx], 0
je 0x44c978
inc esi
cmp byte [esi], 0
jne 0x44c972
sub esi, ecx
and esi, 0x3fffffff
mov ebx, dword [edx + 0xc]
xor edi, edi
add ebx, 8
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x44c9cf
mov ebx, esi
test esi, esi
je 0x44c9c3
mov esi, ecx
nop
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x545b78]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x44c9a0
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, edi
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0xc]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0041c680
add esp, 8
test eax, eax
je 0x44c9f3
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0041c730
add esp, 4
jmp 0x44c9f5
xor esi, esi
mov edx, esi
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.0044c790
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
add edx, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push ebx
mov eax, dword [eax + 8]
push esi
push edi
mov esi, ecx
mov ebx, dword [eax + edx*8 + 0xc]
add ebx, 0x28
mov dword [ebp - 0x10], ebx
test ecx, ecx
je 0x466eae
cmp byte [ecx], 0
je 0x466ea6
nop dword [eax + eax]
inc esi
cmp byte [esi], 0
jne 0x466ea0
sub esi, ecx
and esi, 0x3fffffff
mov eax, dword [ebx]
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x466ef3
mov ebx, esi
test esi, esi
je 0x466ee7
mov esi, ecx
movzx eax, byte [esi]
lea ecx, [edi*8]
dec ebx
lea esi, [esi + 1]
movzx edx, byte [eax + 0x545b78]
xor edx, ecx
xor edi, edx
test ebx, ebx
jg 0x466ec4
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, edi
mov ebx, dword [ebp - 0x10]
xor edx, edx
div dword [ebp - 0xc]
mov edi, edx
push edi
mov edx, ecx
mov ecx, ebx
push esi
call fcn.0041c680
add esp, 8
test eax, eax
je 0x466f54
mov esi, dword [eax + 8]
mov edx, eax
push edi
mov ecx, ebx
call fcn.0041c730
add esp, 4
test esi, esi
je 0x466f54
mov eax, dword [esi + 0x14]
cmp eax, dword [esi + 0x18]
jne 0x466f41
mov ecx, esi
call fcn.00466bd0
lea ecx, [eax + 0x40]
mov eax, dword [ecx]
cmp eax, esi
je 0x466f3a
lea ecx, [eax + 0x20]
mov eax, dword [ecx]
cmp eax, esi
jne 0x466f31
mov eax, dword [ecx]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
mov edx, esi
mov esi, dword [ebp - 0x14]
mov ecx, esi
call fcn.004669d0
or dword [esi + 0xc], 0x200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x477e20
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x55c380]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
mov dword [ebp - 0x2c], edi
xor eax, eax
mov dword [ebp - 0x28], edx
mov ebx, dword [edi + 0x1c]
sub ebx, 6
mov dword [ebp - 0x34], ebx
test ebx, ebx
jle 0x477e58
mov ecx, ebx
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
xor esi, esi
test ebx, ebx
jle 0x477ea2
mov ecx, 8
mov dword [ebp - 0x30], ecx
cmp edx, dword [edi + 0x1c]
ja 0x477fe4
cmp esi, ebx
jge 0x477e8e
cmp eax, 4
jge 0x477e8b
lea edx, [ecx + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc esi
mov dword [edi + edx*4], ecx
mov ecx, dword [ebp - 0x30]
inc eax
cmp esi, ebx
jl 0x477e73
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x477e9e
inc edx
add ecx, eax
mov dword [ebp - 0x28], edx
xor eax, eax
mov dword [ebp - 0x30], ecx
cmp esi, ebx
jl 0x477e66
cmp edx, dword [edi + 0x1c]
ja 0x477fe4
mov esi, 0x545788
movzx ecx, byte [ebp + ebx*4 - 0x27]
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + str.cw]
mov byte [ebp - 0x24], dl
mov edx, 1
movzx ecx, byte [ebp + ebx*4 - 0x26]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp + ebx*4 - 0x25]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp + ebx*4 - 0x28]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x21], cl
movzx ecx, byte [esi]
add esi, 4
xor byte [ebp - 0x24], cl
mov dword [ebp - 0x30], esi
cmp ebx, 8
je 0x477f20
cmp ebx, edx
jle 0x477f7e
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, ebx
jl 0x477f10
jmp 0x477f7e
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 4
jl 0x477f20
movzx ecx, byte [ebp - 0x18]
mov edx, 5
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x14], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x13], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x12], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + str.cw]
xor byte [ebp - 0x11], cl
nop dword [eax + eax]
mov ecx, dword [ebp + edx*4 - 0x28]
xor dword [ebp + edx*4 - 0x24], ecx
inc edx
cmp edx, 8
jl 0x477f70
xor esi, esi
test ebx, ebx
jle 0x477fd5
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
lea edi, [edx*4 + 8]
cmp edx, dword [ecx + 0x1c]
ja 0x477fd2
cmp esi, ebx
jge 0x477fc1
nop word [eax + eax]
cmp eax, 4
jge 0x477fbb
mov ebx, dword [ebp - 0x2c]
lea edx, [edi + eax]
mov ecx, dword [ebp + esi*4 - 0x24]
inc eax
inc esi
mov dword [ebx + edx*4], ecx
mov ebx, dword [ebp - 0x34]
cmp esi, ebx
jl 0x477fa0
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
cmp eax, 4
jne 0x477fce
inc edx
add edi, eax
mov dword [ebp - 0x28], edx
xor eax, eax
cmp esi, ebx
jl 0x477f91
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
cmp ecx, dword [edi + 0x1c]
jbe 0x477eb0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f5c8b
mov esp, ebp
pop ebp
ret
Function at 0x478000
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
mov edi, ecx
mov ebx, 1
cmp dword [edi + 0x1c], ebx
jbe 0x4780ea
lea eax, [edi + 0x32]
push esi
nop word [eax + eax]
movzx ecx, byte [eax + 1]
lea eax, [eax + 0x10]
movzx edx, byte [eax - 0x11]
inc ebx
mov esi, dword [ecx*4 + 0x560250]
xor esi, dword [edx*4 + 0x55f530]
movzx ecx, byte [eax - 0x10]
xor esi, dword [ecx*4 + 0x55d980]
movzx ecx, byte [eax - 0x12]
xor esi, dword [ecx*4 + 0x560650]
mov dword [eax - 0x12], esi
movzx ecx, byte [eax - 0xb]
movzx edx, byte [eax - 0xc]
mov esi, dword [ecx*4 + 0x560250]
xor esi, dword [edx*4 + 0x55d980]
movzx ecx, byte [eax - 0xd]
xor esi, dword [ecx*4 + 0x55f530]
movzx ecx, byte [eax - 0xe]
xor esi, dword [ecx*4 + 0x560650]
mov dword [eax - 0xe], esi
movzx ecx, byte [eax - 7]
movzx edx, byte [eax - 8]
mov esi, dword [ecx*4 + 0x560250]
xor esi, dword [edx*4 + 0x55d980]
movzx ecx, byte [eax - 9]
xor esi, dword [ecx*4 + 0x55f530]
movzx ecx, byte [eax - 0xa]
xor esi, dword [ecx*4 + 0x560650]
mov dword [eax - 0xa], esi
movzx ecx, byte [eax - 3]
movzx edx, byte [eax - 4]
mov esi, dword [ecx*4 + 0x560250]
movzx ecx, byte [eax - 5]
xor esi, dword [edx*4 + 0x55d980]
xor esi, dword [ecx*4 + 0x55f530]
movzx ecx, byte [eax - 6]
xor esi, dword [ecx*4 + 0x560650]
mov dword [eax - 6], esi
cmp ebx, dword [edi + 0x1c]
jb 0x478020
pop esi
pop edi
pop ebx
ret
Function at 0x478b20
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
mov eax, dword [0x55c380]
xor eax, esp
mov dword [esp + 0xb0], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [esp + 0x94], 0x6a09e667
lea ecx, [esp + 0xc]
mov dword [esp + 0x98], 0xbb67ae85
mov dword [esp + 0x9c], 0x3c6ef372
mov dword [esp + 0xa0], 0xa54ff53a
mov dword [esp + 0xa4], 0x510e527f
mov dword [esp + 0xa8], 0x9b05688c
mov dword [esp + 0xac], 0x1f83d9ab
mov dword [esp + 0xb0], 0x5be0cd19
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call fcn.00478be0
add esp, 4
lea ecx, [esp + 8]
mov edx, esi
call fcn.00478c80
mov ecx, dword [esp + 0xb4]
pop esi
xor ecx, esp
call fcn.004f5c8b
mov esp, ebp
pop ebp
ret

Function at 0x479730
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
mov eax, dword [0x55c380]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
mov esi, dword [ebp + 0xc]
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.00478f60
add esp, 4
lea edx, [esp + 8]
mov ecx, esi
call fcn.00478eb0
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call fcn.004f5c8b
mov esp, ebp
pop ebp
ret

Function at 0x47d030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51ffb6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x55c380]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004f5ed8
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.004f41c1
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4865db
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x510]
call fcn.00489bb2
mov edi, dword [ebp + 8]
test eax, eax
jle 0x486631
push ebx
lea ecx, [esi + 0x510]
mov byte [ebp + 0xb], 0
call fcn.004889df
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x486691
lea ecx, [esi + 0x510]
inc ebx
call fcn.00489bb2
cmp ebx, eax
jl 0x4865fa
sub edi, 0x100
je 0x4866f7
sub edi, 4
je 0x486695
dec edi
sub edi, 1
jne 0x4866ec
push dword [ebp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
call fcn.004fc493
pop ecx
mov ecx, dword [esi + 0x40c]
lea edx, [ebp + 8]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x488109
call dword [eax + 0x120]
mov esi, eax
test esi, esi
je 0x4866ec
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xf8]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4866ee
cmp dword [esi + 0x410], 0
je 0x4866ec
xor eax, eax
lea edi, [ebp - 0x1c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x420]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x424]
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x10], eax
call fcn.004bb048
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x410]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x12c]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4866ec
mov ecx, dword [esi + 0x410]
test ecx, ecx
je 0x486750
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x486750
mov ecx, dword [esi + 0x410]
mov eax, dword [ecx]
call dword [eax + 0xd4]
test al, al
je 0x486750
mov ecx, dword [esi + 0x410]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.004f8cca
pop ecx
pop ecx
test eax, eax
je 0x486750
mov ecx, dword [esi + 0x410]
call fcn.004980a4
test al, al
jne 0x4866ec
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.00487657
jmp 0x486691
Function at 0x487419
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [ebp + 8]
cmp eax, dword [ebx]
je 0x487440
cmp esi, dword [ebx + 0x410]
je 0x487440
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebx + 0x410]
cmp esi, eax
je 0x487517
push edi
test eax, eax
je 0x48749f
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x410]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x12c]
xor edi, edi
mov ecx, ebx
push edi
push edi
push edi
push str.killfocus
push dword [ebx + 0x410]
call fcn.00487043
mov dword [ebx + 0x410], edi
test esi, esi
je 0x487516
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x487516
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc8]
test al, al
je 0x487516
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
test al, al
je 0x487516
push 7
pop ecx
xor eax, eax
mov dword [ebx + 0x410], esi
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x410]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x12c]
xor eax, eax
mov ecx, ebx
push eax
push eax
push eax
push str.setfocus
push dword [ebx + 0x410]
call fcn.00487043
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x489e3d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x489e6f
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8