joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54c600
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x6c]
call edx
test eax, eax
je case.0x54c685.10
cmp dword [esi + 0x1fc], 0xffffffff
jne 0x54c65a
mov eax, dword [esi]
mov edx, dword [eax + 0x84]
mov ecx, esi
call edx
test eax, eax
je 0x54c65a
mov eax, dword [esp + 8]
cmp eax, 0xd
je 0x54c63d
cmp eax, 0x20
jne case.0x54c685.10
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x100]
push 0
push eax
call fcn.00509840
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x100]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.004dc720
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
add esp, 8
cmp eax, 0x1f
ja case.0x54c685.10
movzx eax, byte [eax + 0x54c870]
jmp dword [eax*4 + 0x54c844]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.0054aaf0
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
push 0xffffffffffffffff
jmp 0x54c68e
mov ecx, dword [esi + 0x1fc]
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.0054bd70
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 1
push edx
mov ecx, esi
call fcn.0054bd70
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1fc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0054c0d0
cmp eax, 0xffffffff
jne 0x54c697
mov edx, dword [esi + 0x80]
mov ecx, dword [esi + 0xf8]
push 1
push 0
push 1
push eax
push edx
call fcn.0050ce80
cmp eax, dword [esi + 0x80]
jne case.0x54c685.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.0054aaf0
cmp eax, 0xffffffff
je case.0x54c685.10
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1fc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0054bf30
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x1fc]
push 1
push ecx
mov ecx, esi
call fcn.0054bf30
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 1
push edx
mov ecx, esi
call fcn.0054c0d0
cmp eax, 0xffffffff
jne 0x54c697
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0xf8]
push 1
push 0
push 1
push 1
push eax
call fcn.0050ce80
cmp eax, dword [esi + 0x80]
jne case.0x54c685.10
push 1
jmp 0x54c72a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x54c807
mov ecx, dword [esi + 0x1fc]
push 1
push ecx
mov ecx, esi
call fcn.0054aaf0
cmp eax, dword [esi + 0x1fc]
jle case.0x54c685.10
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 0xffffffffffffffff
push edx
mov ecx, esi
call fcn.0054aaf0
cmp eax, dword [esi + 0x1fc]
jge case.0x54c685.10
push eax
mov ecx, esi
call fcn.0054c210
mov eax, 1
pop esi
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x90]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 8
Function at 0x54f490
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x6c]
call edx
test eax, eax
je 0x54f62c
mov eax, dword [esi + 0x174]
test eax, eax
je 0x54f62c
cmp dword [eax + 0x20], 0
je 0x54f62c
test eax, eax
je 0x54f4cd
cmp dword [eax + 0x54], 0
je 0x54f4cd
mov eax, 2
pop esi
ret 8
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xd
je 0x54f625
cmp edi, 9
je 0x54f625
cmp edi, 0x1b
jne 0x54f519
lea eax, [esi + 0x194]
push eax
mov ecx, esi
call fcn.0054f3f0
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push 0
mov ecx, esi
call eax
mov ecx, dword [esi + 0x100]
xor eax, eax
cmp dword [ecx + 0xf8], 2
pop edi
sete al
pop esi
ret 8
push ebx
test eax, eax
je 0x54f55e
cmp dword [eax + 0x20], 0
je 0x54f55e
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
test ax, ax
jge 0x54f55e
push 0x11
call ebx
test ax, ax
jl 0x54f55e
mov ecx, dword [esi + 0x100]
call fcn.005083f0
test eax, eax
je 0x54f55e
movzx edx, di
push edx
mov ecx, eax
call fcn.004ff470
test eax, eax
jne 0x54f5e7
mov ecx, esi
call fcn.004f3570
test eax, eax
je 0x54f5f2
cmp dword [esi + 0x1ac], 0
je 0x54f5f2
cmp edi, 0x26
je 0x54f580
cmp edi, 0x28
jne 0x54f5f2
mov ecx, esi
call fcn.0054dae0
test eax, eax
jne 0x54f5f2
mov eax, dword [esi]
mov edx, dword [eax + 0x160]
xor ecx, ecx
cmp edi, 0x26
sete cl
lea ecx, [ecx + ecx - 1]
push ecx
push 1
mov ecx, esi
call edx
mov eax, dword [esi + 0x174]
test eax, eax
je 0x54f5e7
mov edi, dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x54f5e7
mov esi, dword [esi + 0x174]
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop ebx
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x1a0]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x54f60b
push ebx
push edi
call fcn.00550550
test eax, eax
jne 0x54f5e7
mov ecx, dword [esi + 0x174]
push ebx
push edi
call fcn.005503a0
neg eax
pop ebx
sbb eax, eax
pop edi
add eax, 2
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
xor eax, eax
pop esi
ret 8

Function at 0x5503a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
cmp esi, 8
je 0x5503e5
cmp esi, 0x21
jb 0x5503ba
cmp esi, 0x2e
jbe 0x5503e5
cmp esi, 0x43
je 0x5503ce
cmp esi, 0x56
je 0x5503ce
cmp esi, 0x58
je 0x5503ce
cmp esi, 0x5a
jne 0x5503db
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5503e5
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x20]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
call fcn.00482bfa
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x1c
ret 8
Function at 0x550550
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push edi
mov edi, ecx
cmp dword [edi + 8], 0
jne 0x550565
xor eax, eax
pop edi
add esp, 0x1c
ret 8
push ebx
mov ebx, dword [esp + 0x28]
cmp ebx, 0x26
je 0x55057e
cmp ebx, 0x28
je 0x55057e
cmp ebx, 0x22
je 0x55057e
cmp ebx, 0x21
jne 0x55058b
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x550595
pop ebx
xor eax, eax
pop edi
add esp, 0x1c
ret 8
mov eax, dword [edi + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 1
push eax
call esi
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
push edx
push eax
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
neg eax
pop esi
sbb eax, eax
pop ebx
neg eax
pop edi
add esp, 0x1c
ret 8

Function at 0x5518a5
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x214]
push edi
call edx
mov ebx, dword [esp + 0x30]
cmp dword [ebx + 0x184], 0
mov ebp, eax
je 0x551903
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5518f7
mov eax, dword [esp + 0x34]
cmp eax, 0x26
je 0x5518e7
cmp eax, 0x28
je 0x5518e7
cmp eax, 0x21
je 0x5518e7
cmp eax, 0x22
jne 0x5518f7
mov ecx, dword [esp + 0x38]
push ecx
push eax
push 0x100
jmp 0x551987
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
mov edi, dword [esp + 0x34]
cmp edi, 0x73
jne 0x55191b
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x5518f7
jmp 0x551932
cmp edi, 0x26
je 0x551925
cmp edi, 0x28
jne 0x551932
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x5518f7
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
mov dword [esp + 0x1c], 0x100
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
mov edx, dword [esi + 0x20]
push 1
push 0x102
push 0x102
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x55198e
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 0x102
mov ecx, esi
call fcn.0047d0d7
mov eax, dword [esi]
mov edx, dword [eax + 0x214]
mov ecx, esi
call edx
cmp ebp, eax
je 0x5519de
mov eax, dword [ebx]
mov edx, dword [eax + 0x160]
mov ecx, ebx
call edx
mov esi, dword [ebx + 0x184]
test esi, esi
je 0x5519de
cmp dword [esi + 0x20], 0
je 0x5519de
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x554950
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x6c]
call edx
test eax, eax
jne 0x554962
pop esi
ret 8
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0x2e
je 0x554975
cmp edi, 8
je 0x554975
xor eax, eax
jmp 0x55497a
mov eax, 1
mov dword [esi + 0x1b0], eax
mov eax, dword [esi + 0x184]
test eax, eax
je 0x55499a
cmp dword [eax + 0x54], 0
je 0x55499a
pop edi
mov eax, 2
pop esi
ret 8
cmp edi, 9
jne 0x5549b8
cmp dword [esi + 0x1d0], 0
je 0x5549b1
test byte [esi + 0x1b4], 8
jne 0x554a10
pop edi
xor eax, eax
pop esi
ret 8
cmp edi, 0xd
je 0x5549b1
cmp edi, 0x1b
jne 0x554a10
mov ecx, dword [esi + 0x178]
mov eax, dword [ecx]
mov edx, dword [eax + 0x180]
call edx
mov eax, dword [esi + 0x190]
push eax
mov ecx, esi
call fcn.00550870
lea ecx, [esi + 0x194]
push ecx
mov ecx, esi
call fcn.00554620
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push 0
mov ecx, esi
call eax
mov ecx, dword [esi + 0x100]
xor eax, eax
cmp dword [ecx + 0xf8], 2
pop edi
sete al
pop esi
ret 8
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
test eax, eax
je 0x554a55
cmp dword [eax + 0x20], 0
je 0x554a55
push 0x12
call ebp
test ax, ax
jge 0x554a55
push 0x11
call ebp
test ax, ax
jl 0x554a55
mov ecx, dword [esi + 0x100]
call fcn.005083f0
test eax, eax
je 0x554a55
movzx edx, di
push edx
mov ecx, eax
call fcn.004ff470
test eax, eax
jne 0x554af3
cmp edi, 0x73
jne 0x554acd
push 0x12
call ebp
test ax, ax
jge 0x554ae0
mov ecx, dword [esi + 0x1d0]
push ebx
mov ebx, dword [esp + 0x18]
test ecx, ecx
je 0x554a7d
push ebx
push edi
call fcn.00550550
test eax, eax
jne 0x554ac1
cmp dword [esi + 0x184], 0
je 0x554aa3
cmp edi, 0x26
je 0x554a9a
cmp edi, 0x28
je 0x554a9a
cmp edi, 0x22
je 0x554a9a
cmp edi, 0x21
jne 0x554afe
push 0x12
call ebp
test ax, ax
jl 0x554afe
mov ecx, esi
call fcn.00551530
test eax, eax
je 0x554afe
mov ecx, dword [esi + 0x178]
mov edx, dword [ecx]
mov eax, dword [edx + 0x22c]
push ebx
push edi
push esi
call eax
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
ret 8
cmp edi, 0x26
je 0x554ad7
cmp edi, 0x28
jne 0x554a63
push 0x12
call ebp
test ax, ax
jge 0x554a63
mov edx, dword [esi]
xor ecx, ecx
push ecx
xor eax, eax
push eax
mov eax, dword [edx + 0xcc]
push ecx
mov ecx, esi
call eax
pop ebp
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x184]
test ecx, ecx
je 0x554b1e
cmp dword [ecx + 0x20], 0
je 0x554b1e
push ebx
push edi
call fcn.005503a0
test eax, eax
mov eax, 1
jne 0x554b23
mov eax, 2
pop ebx
pop ebp
pop edi
pop esi
ret 8
Function at 0x557460
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
cmp ebx, 0x112
ja 0x557556
je 0x5574af
cmp ebx, 5
je 0x55748a
cmp ebx, 0x47
jne 0x557654
mov eax, dword [esp + 0x14]
cmp eax, dword [edi + 0x164]
jne 0x557654
mov ecx, dword [edi - 0x34]
push 0
push 0x2fbf
push 0x113
push ecx
jmp 0x55764e
lea esi, [edi - 0x54]
mov ecx, esi
call fcn.00533a80
test eax, eax
je 0x557654
push 0x4c5500
mov ecx, 0x64305c
call fcn.004906e4
test eax, eax
jne 0x5574d9
call fcn.0047b415
cmp dword [eax + 4], 0
jg 0x557654
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x557654
mov ecx, esi
call fcn.00508420
test eax, eax
jne 0x557654
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
and eax, 0xfff0
cmp eax, 0xf100
jne 0x557654
cmp dword [ebp], 0
jne 0x557654
mov edx, dword [esi]
mov eax, dword [edx + 0x1f4]
push 0x12
mov ecx, esi
call eax
test eax, eax
jne 0x55754a
mov ecx, esi
call fcn.005083f0
test eax, eax
je 0x55754a
push 0
push esi
mov ecx, eax
call fcn.004fdf60
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
cmp ebx, 0x220
jb 0x557654
cmp ebx, 0x222
jbe 0x55763e
cmp ebx, 0x230
jne 0x557654
mov edx, dword [edi - 0x54]
mov eax, dword [edx + 0x160]
lea esi, [edi - 0x54]
mov ecx, esi
call eax
mov ecx, esi
test eax, eax
je 0x55761a
call fcn.00508420
test eax, eax
je 0x5575c5
mov ecx, esi
call fcn.005099e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [ecx], 0
mov eax, 1
pop ebx
ret 0x14
test dword [edi + 0x98], 0x400
mov ebx, dword [esp + 0x1c]
jne 0x5575ef
mov eax, dword [ebx]
test eax, eax
jne 0x5575e7
mov edi, dword [edi + 0x168]
test edi, edi
je 0x5575ef
mov eax, edi
push eax
mov ecx, esi
call fcn.00556f10
mov ecx, esi
call fcn.005099e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x70]
push 0
call eax
mov ecx, esi
call fcn.00556e30
pop edi
pop esi
pop ebp
mov dword [ebx], 0
mov eax, 1
pop ebx
ret 0x14
call fcn.005099e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x6c]
call eax
test eax, eax
jne 0x557654
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, 1
pop ebx
ret 0x14
mov edx, dword [edi - 0x34]
push 0
push 0x2fbf
push 0x113
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push eax
push ebp
push ecx
push ebx
push edx
mov ecx, edi
call fcn.00509940
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x55b360
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
je 0x55b396
cmp dword [esi + 4], 0
jne 0x55b3ab
push edi
call fcn.004840f7
mov edi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x55b280
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop edi
mov dword [esi + 4], eax
pop esi
ret 4
mov eax, dword [esi + 4]
test eax, eax
je 0x55b3ab
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 4], 0
pop esi
ret 4
Function at 0x55b5e0
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
push 0x5bd11b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x62ece4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov edi, dword [esp + 0x14c]
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x55b641
movzx ecx, word [esp + 0x148]
add edi, 0xffffffd0
xor eax, eax
cmp ecx, edi
sete al
jmp 0x55b7bc
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
test ax, ax
je 0x55b6e1
mov esi, dword [esp + 0x148]
push esi
call fcn.0055b550
movzx eax, ax
add esp, 4
mov dword [esp + 0x18], eax
cmp si, di
je 0x55b7b7
cmp ax, di
je 0x55b7b7
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
call esi
mov ebx, eax
mov dword [esp + 0x1c], ebx
cmp ebx, 1
jbe 0x55b6e1
lea ecx, [esp + 0x20]
call fcn.0055b580
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x148], 0
call fcn.0057d590
mov ebp, dword [esp + 0x24]
push ebp
push ebx
call esi
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x55b6e8
lea ecx, [esp + 0x20]
mov dword [esp + 0x140], 0xffffffff
call fcn.0055b5a0
xor eax, eax
jmp 0x55b7bc
xor esi, esi
test ebx, ebx
jbe 0x55b6cd
mov dword [esp + 0x14], 0
test esi, esi
jl 0x55b7e4
cmp esi, dword [esp + 0x28]
jge 0x55b7e4
mov eax, dword [ebp + esi*4]
push eax
push 0
push 1
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x55b747
mov eax, dword [esp + 0x14]
cmp word [esp + 0x148], ax
je 0x55b7a3
push eax
call fcn.0055b550
add esp, 4
cmp word [esp + 0x18], ax
je 0x55b7a3
mov bl, byte [esp + 0x44]
mov byte [esp + 0x44], 0x81
mov eax, dword [ebp + esi*4]
push eax
push 0
push 1
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 1
jne 0x55b78f
mov eax, dword [esp + 0x14]
cmp word [esp + 0x148], ax
je 0x55b7a3
push eax
call fcn.0055b550
add esp, 4
cmp word [esp + 0x18], ax
je 0x55b7a3
inc esi
mov byte [esp + 0x44], bl
cmp esi, dword [esp + 0x1c]
jb 0x55b6ee
jmp 0x55b6cd
lea ecx, [esp + 0x20]
mov dword [esp + 0x140], 0xffffffff
call fcn.0055b5a0
mov eax, 1
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00499aa8
add esp, 0x130
ret
call fcn.0047b415
int3
Function at 0x567830
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x5679da
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x567888
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x56789b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x5678af
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x5678f6.3
jmp 0x5678c0
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x5678cc
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x5678d1
mov esi, 1
inc eax
cmp eax, edi
jl 0x5678c0
cmp si, cx
je case.0x5678f6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x5678f6.3
movzx eax, byte [eax + 0x5679f4]
jmp dword [eax*4 + 0x5679e0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x5678f6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x567910
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x5678f6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x567950
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5678f6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x567976
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5678f6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x5679a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x57ae20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bdff9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x62ece4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004827ec
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esi], vtable.CXTPTabManagerItem.0
call fcn.0047b8ad
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x57ae75
push 0x80004005
call fcn.004072a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x54], eax
mov ebx, 1
mov byte [esp + 0x1c], bl
call fcn.0047b8ad
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x57aea7
push 0x80004005
call fcn.004072a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x58], eax
lea ecx, [esi + 0x6c]
call fcn.0057a4e0
mov ecx, esi
mov byte [esp + 0x1c], 3
call fcn.0059b31f
or eax, 0xffffffff
lea ecx, [esi + 0x44]
push ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x40], edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esi + 0x64], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x68], ebx
mov dword [esi + 0x60], edi
mov dword [esi + 0x84], edi
mov dword [esi + 0x80], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x57b103
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x57b26d
cmp dword [esi + 0x20], eax
je 0x57b26d
mov eax, dword [esp + 0x28]
push ebx
push ebp
push edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], 0
call ebp
mov ebx, eax
lea edi, [esi + 0x10]
cmp dword [esi + 0x20], 0
je 0x57b15e
call ebp
sub eax, ebx
cmp eax, 0x14
jbe 0x57b15e
call ebp
mov edx, dword [esi]
mov ebx, eax
mov eax, dword [edx + 0x18]
push 1
mov ecx, esi
call eax
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_PtInRect]
cmp eax, dword [esi + 0x24]
je 0x57b184
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push 1
push edi
call edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x57b140
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetMessageW]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [esp + 0x34]
jne 0x57b212
mov eax, dword [esp + 0x18]
cmp eax, 0x200
ja 0x57b1f6
je 0x57b1de
cmp eax, 0x1f
je 0x57b226
cmp eax, 0x100
jne 0x57b202
cmp dword [esp + 0x1c], 0x1b
jne 0x57b140
jmp 0x57b226
mov eax, dword [esp + 0x20]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
jmp 0x57b140
sub eax, 0x202
je 0x57b21f
sub eax, 2
je 0x57b226
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x57b140
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x57b226
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x24], 0
call fcn.0057ac40
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x38]
push 0
push 0
call eax
cmp dword [esp + 0x10], 0
pop edi
pop ebp
pop ebx
je 0x57b26d
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
push 0
mov ecx, esi
call eax
pop esi
add esp, 0x20
ret 0xc