[jill888888]

I think use data encryptor like boson light can protect it from reverse engineer

[Demporus]

Use wireshark in a vm and open the sample like 5 times, each time it initializes it calls home, and you've got your skid.
For keyloggers, you can sniff the traffic unless it's encrypted, if so try reverse engineering the binary manually.