joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55c90b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x414]
mov word [ebp - 0x20c], bx
call fcn.0053680f
cmp word [ebp - 0x414], bx
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, 0x6788c4
je 0x55c98f
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401f51
lea eax, [ebp - 0x20c]
push eax
call fcn.00401e3b
test al, al
lea eax, [ebp - 0x20c]
je 0x55c980
push eax
call fcn.004cc342
test al, al
je 0x55ca3a
jmp 0x55c98f
push ebx
push eax
call esi
test eax, eax
jne 0x55c98f
mov word [ebp - 0x20c], bx
cmp word [ebp - 0x20c], bx
jne 0x55c9d2
lea eax, [ebp - 0x414]
call fcn.00536821
cmp word [ebp - 0x414], bx
je 0x55ca3a
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00401f51
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x55ca3a
cmp dword [str.VideoPad], ebx
mov dword [ebp - 4], ebx
je 0x55ca3a
mov esi, 0x6a5c78
push str..lnk
push dword [esi + 4]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
call fcn.0053768f
push dword [esi]
mov eax, 0x104
push str._extfind__s
lea edi, [ebp - 0x824]
call fcn.005383cd
pop ecx
pop ecx
push dword [esi + 4]
lea eax, [ebp - 0x61c]
push dword [ebp + 8]
mov esi, edi
push eax
call fcn.0055bf5a
inc dword [ebp - 4]
mov esi, dword [ebp - 4]
lea esi, [esi*8 + 0x6a5c78]
cmp dword [esi], ebx
jne 0x55c9e2
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x55e691
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
movzx edi, word [ebp + 8]
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx esi, word [ebp + 8]
cmp esi, 0x25
mov dword [ebp - 4], eax
je 0x55e6f1
cmp esi, 0x27
je 0x55e6f1
cmp esi, 0x26
je 0x55e6f1
cmp esi, 0x28
je 0x55e6f1
cmp esi, 0x2d
je 0x55e6f1
cmp esi, 0x21
je 0x55e6f1
cmp esi, 0x22
je 0x55e6f1
cmp esi, 0x2e
je 0x55e6f1
cmp esi, 0x24
je 0x55e6f1
cmp esi, 0x23
je 0x55e6f1
cmp esi, 0x5b
je 0x55e6f1
cmp esi, 0x5c
je 0x55e6f1
cmp esi, 0x5d
jne 0x55e6f8
or dword [ebp - 4], 0x100
and word [ebp - 0x20c], 0
push 0x104
lea eax, [ebp - 0x20c]
push eax
movzx eax, word [ebp - 4]
shl eax, 0x10
or eax, edi
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp word [ebp - 0x20c], 0
jne 0x55e759
cmp esi, 0x13
jne 0x55e759
push 0x50
xor ecx, ecx
pop eax
mov edx, 0x68a366
cmp ecx, 0x103
jae 0x55e750
mov word [ebp + ecx*2 - 0x20c], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
test ax, ax
jne 0x55e735
and word [ebp + ecx*2 - 0x20c], 0
test dword [ebp + 8], 0x40000
mov eax, 0x631a7c
je 0x55e772
cmp dword [ebp - 4], 0x2a
mov edx, str.Shift
jne 0x55e774
mov edx, eax
test dword [ebp + 8], 0x10000
je 0x55e788
cmp dword [ebp - 4], 0x38
mov ecx, str.Alt
jne 0x55e78a
mov ecx, eax
test dword [ebp + 8], 0x20000
je 0x55e79e
cmp dword [ebp - 4], 0x1d
je 0x55e79e
mov eax, str.Ctrl
mov edi, dword [ebp + 0xc]
lea esi, [ebp - 0x20c]
push esi
push edx
push ecx
push eax
push str._s_s_s_s
mov eax, 0x104
call fcn.005383cd
add esp, 0x14
pop edi
pop esi
leave
ret 8
Function at 0x55e7c3
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x444
push ebx
push esi
add eax, 0xffffff00
cmp eax, 0xf
push edi
mov esi, ecx
ja case.0x55e7e9.259
movzx eax, byte [eax + 0x55e9af]
jmp dword [eax*4 + 0x55e993]
mov ebx, dword [ebp + 0x10]
cmp ebx, 0xe5
jne 0x55e813
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetVirtualKey
call fcn.0055e9bf
test al, al
je 0x55e813
mov al, 1
jmp 0x55e92d
movzx eax, word [ebp + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov dword [esi + 4], eax
call edi
test ax, 0x100
je 0x55e830
or ebx, 0x20000
push 0x12
call edi
test ax, 0x100
je 0x55e840
or ebx, 0x10000
push 0x10
call edi
test ax, 0x100
je 0x55e850
or ebx, 0x40000
test dword [ebp + 0x14], 0x40000000
mov eax, dword [esi]
push ebx
mov ecx, esi
jne 0x55e866
call dword [eax + 4]
jmp 0x55e92d
call dword [eax + 8]
jmp 0x55e92d
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetVirtualKey
cmp eax, 0xe5
jne 0x55e88b
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0055ea31
push dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, esi
mov dword [esi + 4], 1
call dword [eax + 0xc]
jmp 0x55e92d
push dword [ebp + 0x10]
mov eax, dword [esi]
call dword [eax]
jmp 0x55e92d
mov eax, dword [esi]
call dword [eax + 0x10]
test al, al
je case.0x55e7e9.259
mov edi, dword [esi]
xor ecx, ecx
lea eax, [ebp - 0x221]
mov byte [esi + 8], 0
call fcn.0055e665
push eax
mov ecx, esi
call dword [edi + 0x14]
push dword [ebp - 8]
call fcn.005f858a
pop ecx
jmp 0x55e80c
mov eax, dword [esi]
call dword [eax + 0x10]
test al, al
je case.0x55e7e9.259
mov edi, dword [esi]
push 2
pop ecx
lea eax, [ebp - 0x442]
call fcn.0055e665
push eax
mov ecx, esi
call dword [edi + 0x14]
push dword [ebp - 0x229]
call fcn.005f858a
pop ecx
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je case.0x55e7e9.259
push 0
push 0
push 0x11
push esi
call sub.IMM32.dll_ImmNotifyIME
push esi
push dword [ebp + 8]
call sub.IMM32.dll_ImmReleaseContext
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [esi]
call dword [eax + 0x10]
test al, al
je case.0x55e7e9.259
push dword [ebp + 8]
call sub.IMM32.dll_ImmGetContext
mov edi, eax
test edi, edi
je 0x55e80c
mov ebx, dword [ebp + 0x14]
invalid
invalid
Function at 0x55ea98
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x55eb59
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 0x800
push dword [ebp + 8]
mov byte [esi + 8], bl
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, ebx
jle 0x55eb59
shr eax, 1
push 2
mov word [ebp + eax*2 - 0x42c], bx
pop ecx
lea eax, [ebp - 0x224]
call fcn.0055e665
movzx eax, word [ebp - 0x42c]
xor ecx, ecx
cmp word [ebp - 0x42c], bx
lea edx, [ebp - 0x42a]
je 0x55eb1c
cmp ecx, 0x103
jae 0x55eb1c
mov word [ebp + ecx*2 - 0x220], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, bx
jne 0x55eb01
lea eax, [ebp - 0x42c]
mov word [ebp + ecx*2 - 0x220], bx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x55eb2d
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x18], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov byte [ebp - 0xc], 1
call dword [eax + 0x14]
push dword [ebp - 0xb]
call fcn.005f858a
pop ecx
pop ebx
leave
ret 4

Function at 0x55eb5e
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x55ec38
push 0x104
lea eax, [ebp - 0x42c]
push eax
push 8
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
cmp eax, esi
jle 0x55ec38
push ebx
push edi
shr eax, 1
xor edi, edi
xor ebx, ebx
test byte [ebp + 0x10], 0x10
mov word [ebp + eax*2 - 0x42c], si
je 0x55ebbd
push esi
push dword [ebp + 0xc]
call fcn.0055ec3d
mov edi, eax
push edi
push dword [ebp + 0xc]
call fcn.0055ec3d
mov ebx, eax
xor ecx, ecx
inc ecx
lea eax, [ebp - 0x224]
call fcn.0055e665
movzx eax, word [ebp - 0x42c]
xor ecx, ecx
cmp word [ebp - 0x42c], si
lea edx, [ebp - 0x42a]
je 0x55ebfe
cmp ecx, 0x103
jae 0x55ebfe
mov word [ebp + ecx*2 - 0x220], ax
movzx eax, word [edx]
inc ecx
inc edx
inc edx
cmp ax, si
jne 0x55ebe3
push esi
push esi
push 0x80
push dword [ebp + 0xc]
mov word [ebp + ecx*2 - 0x220], si
call sub.IMM32.dll_ImmGetCompositionStringW
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x224]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx]
push edx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], ebx
call dword [eax + 0x14]
push dword [ebp - 0xb]
call fcn.005f858a
pop ecx
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x55ec98
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
xor eax, eax
cmp dword [ebp + 0xc], eax
push ebx
mov ebx, dword [ebp + 8]
je 0x55ed25
push esi
push edi
push eax
push eax
push 0x20
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
mov edi, eax
lea esi, [ebp - 8]
call fcn.0049a2f3
mov esi, dword [ebp - 8]
mov eax, edi
shl eax, 2
push eax
push 0
push esi
call fcn.005fc0d0
add esp, 0xc
push edi
push esi
push 0x20
push dword [ebp + 0xc]
call sub.IMM32.dll_ImmGetCompositionStringW
push 3
pop ecx
lea eax, [ebp - 0x22c]
call fcn.0055e665
push dword [ebp - 0x13]
call fcn.005f858a
mov eax, dword [ebp - 4]
pop ecx
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0xf], eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [ebp - 0x13], esi
call dword [eax + 0x14]
push dword [ebp - 0x13]
call fcn.005f858a
push 0
call fcn.005f858a
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x55f307
Capabilities:
Log keystrokes

Disassembly:
push edi
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
cmp eax, dword [esi + 4]
je 0x55f386
push ebx
call edi
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call edi
push 0
push dword [esi + 4]
mov ebx, eax
call edi
mov edi, eax
cmp ebx, edi
je 0x55f35a
push ebp
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push edi
push ebx
call ebp
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push edi
push ebx
call ebp
pop ebp
jmp 0x55f363
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
setne al
neg al
sbb eax, eax
and eax, 0xfffffffa
add eax, 9
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop edi
ret
Function at 0x565121
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push ebx
push esi
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.00536736
push str.notifications_en.txt
lea eax, [ebp - 0x418]
push eax
push dword [ebp + 0xc]
call fcn.00401f51
push 0
call fcn.005f83ff
pop ecx
push 0
mov edi, str.Polled
push edi
mov esi, str.PushNotifications
push esi
mov ebx, eax
call fcn.00401828
test eax, eax
jle 0x565186
add eax, 0x93a80
cmp eax, ebx
jl 0x565186
push dword [ebp + 0xc]
call fcn.00401e3b
pop edi
pop esi
pop ebx
leave
ret 8
lea eax, [ebp - 0x210]
push eax
call fcn.004cc140
lea eax, [ebp - 0x210]
push eax
push str.http:__www.audiochannel.net_components_notifications_picopdf.txt
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.004d17c6
cmp dword [ebp - 4], 1
jne 0x5651c5
lea eax, [ebp - 0x210]
push eax
mov eax, 0x1f4
call fcn.00536630
xor al, al
jmp 0x56517f
push ebx
push edi
push esi
call fcn.0040177b
cmp dword [ebp - 4], 2
lea eax, [ebp - 0x210]
je 0x5651b6
push 3
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x565203
xor bl, bl
lea eax, [ebp - 0x210]
push eax
mov eax, 0x1f4
call fcn.00536630
mov al, bl
jmp 0x56517f
and word [ebp - 0x210], 0
mov bl, 1
jmp 0x5651eb

Function at 0x56565b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
xor ebx, ebx
push 0xff
lea eax, [ebp - 0xff]
push ebx
push eax
mov byte [ebp - 0x100], bl
call fcn.005fc0d0
mov esi, dword [sym.imp.USER32.dll_GetKeyboardState]
add esp, 0xc
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.USER32.dll_keybd_event]
je 0x5656ae
test byte [ebp - 0xee], 0x80
jne 0x5656ae
push ebx
push 1
push ebx
push 0x12
call edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
lea eax, [ebp - 0x100]
push eax
call esi
test eax, eax
je 0x5656d5
test byte [ebp - 0xee], 0x80
jne 0x5656d5
push ebx
push 3
push ebx
push 0x12
call edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x568208
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, 0x3e8
push edi
mov ebp, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, 0x4ff
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [esp + 0x18], eax
xor eax, eax
push eax
push eax
push eax
call esi
mov edi, 0x102
jmp 0x568265
push dword [esp + 0x18]
call fcn.005681bf
test al, al
jne 0x568273
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x10]
cmp eax, ebp
jbe 0x568256
mov eax, ebp
add dword [esp + 0x10], eax
push ebx
sub ebp, eax
push ebp
xor eax, eax
push eax
push eax
push eax
call esi
cmp eax, edi
jne 0x568239
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
xor al, al
jmp 0x56826b
Function at 0x56e4a0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, eax
mov eax, dword [ebp + 8]
push edi
call fcn.0054d00b
mov edi, dword [esi + 8]
mov ebx, dword [esi + 0xc]
sub edi, dword [esi]
sub ebx, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40cc0020
push dword [esi + 4]
push dword [esi]
push dword [ebp - 8]
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x2c
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.005fc0d0
add esp, 0xc
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0x58], 0x28
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_GetDIBits]
mov eax, dword [ebp - 0x44]
cmp eax, ebx
ja 0x56e56c
mov eax, dword [ebp - 0x50]
movzx ecx, word [ebp - 0x4a]
cdq
xor eax, edx
sub eax, edx
add ecx, 7
imul eax, ecx
imul eax, dword [ebp - 0x54]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp - 0x44], eax
mov esi, eax
lea edi, [ebp - 4]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 4], ebx
call fcn.0058d0a0
cmp dword [ebp - 4], ebx
push ebx
je 0x56e631
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 4]
push dword [ebp - 0x50]
push ebx
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_GetDIBits]
mov esi, dword [ebp - 0x44]
add esi, 0x36
mov word [ebp - 0x2c], 0x4d42
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2a], esi
mov word [ebp - 0x26], bx
mov word [ebp - 0x24], bx
mov dword [ebp - 0x22], 0x36
call fcn.004b38cb
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x56e5cf
push dword [ebp - 4]
jmp 0x56e631
mov edi, eax
lea esi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xa
pop ecx
lea edi, [eax + 0xe]
lea esi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x44]
add eax, 0x36
push dword [ebp - 4]
push eax
call fcn.005fbd60
add esp, 0xc
push dword [ebp - 8]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
call fcn.005f858a
pop ecx
push dword [ebp - 0x1c]
xor edx, edx
push dword [ebp - 0x14]
inc edx
push dword [ebp + 8]
call fcn.0054beb7
push dword [ebp - 0x14]
call fcn.005f858a
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x57308d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
push edi
lea esi, [ebp - 0x28]
call fcn.00402c60
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x112]
mov ecx, dword [esi + 0x2a]
imul eax, eax, 0x227
xor edi, edi
add eax, ecx
xor dl, dl
cmp dword [eax + 0x214], edi
mov byte [ebp - 5], 0
mov dword [ebp - 0x14], edi
jle 0x573236
mov dword [ebp - 0x10], edi
mov ebx, dword [eax + 0x210]
add ebx, dword [ebp - 0x10]
cmp byte [ebx + 0x44f], 0
jne 0x5731d4
cmp byte [ebx + 0x450], 0
jne 0x5731d4
mov eax, ebx
call fcn.00570bc6
test al, al
je 0x57310e
test dl, dl
je 0x5731d4
mov byte [ebp - 5], 1
jmp 0x5731d4
cmp byte [ebp - 5], 0
je 0x573128
push edi
push edi
push 0x800
push dword [ebp - 0x24]
mov byte [ebp - 5], 0
call dword [sym.imp.USER32.dll_AppendMenuW]
mov edi, dword [ebx + 0x446]
mov eax, edi
shr eax, 3
and al, 1
je 0x573146
mov ecx, edi
shr ecx, 4
test cl, 1
jne 0x573146
mov ecx, dword [ebx + 0x10]
jmp 0x573149
mov ecx, dword [ebx + 0xc]
test al, al
mov dword [ebp - 0xc], ecx
mov eax, str._s...
jne 0x57315a
mov eax, 0x666b2c
lea ecx, [ebx + 0x16]
push ecx
push eax
mov eax, 0x104
lea edi, [ebp - 0x234]
call fcn.005383cd
mov eax, dword [ebx + 0x455]
test eax, eax
pop ecx
pop ecx
jne 0x57318e
mov eax, edi
push eax
push dword [ebp - 0xc]
lea esi, [ebp - 0x28]
call fcn.00562117
mov esi, dword [ebp + 8]
jmp 0x5731a2
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.0056217e
movzx eax, byte [ebx + 0x44e]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x28]
push eax
call fcn.00402c91
mov al, byte [ebx + 0x453]
neg al
sbb eax, eax
and eax, 8
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dl, 1
xor edi, edi
mov eax, dword [esi + 0x112]
mov ecx, dword [esi + 0x2a]
imul eax, eax, 0x227
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x671
add eax, ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 0x214]
jl 0x5730cf
test dl, dl
je 0x573236
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x6ac310]
add ecx, 2
cmp ecx, eax
ja 0x573236
mov ecx, dword [esi + 0x1e]
test ecx, ecx
je 0x573236
push dword [ebp - 0x24]
lea eax, [esi + 0x1ca]
push dword [ebp - 0x28]
call fcn.0040317b
call edi
mov dword [0x6ac310], eax
push dword [ebp - 0x28]
call dword [sym.imp.USER32.dll_DestroyMenu]
lea edi, [ebp - 0x18]
call fcn.004977ef
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x57a603
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push 0x3e8
push 3
push 1
push SysReAllocString
push dword [ebp + 0x10]
call fcn.005365d4
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
call fcn.00401cf8
mov esi, eax
test esi, esi
je 0x57a6de
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
fld qword [ebp + 0x14]
push ecx
push ecx
mov dword [ebp - 8], eax
fstp qword [esp]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
test esi, esi
mov dword [ebp - 0xc], esi
fild dword [ebp - 0xc]
jge 0x57a661
fadd qword [0x6941f8]
fdivr qword [ebp + 0x1c]
fstp qword [ebp - 0x14]
jmp 0x57a6cb
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x20]
push edi
push eax
call fcn.0057a557
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x57a6fb
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
test al, al
jne 0x57a6de
call ebx
mov ecx, eax
sub ecx, dword [ebp - 8]
cmp ecx, 0x1f4
jbe 0x57a6cb
mov esi, dword [edi]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
add esi, 0x24
call fcn.00401cc5
test eax, eax
mov dword [ebp - 0xc], eax
fild dword [ebp - 0xc]
jge 0x57a6bc
fadd qword [0x6941f8]
fmul qword [ebp - 0x14]
push ecx
push ecx
mov ecx, edi
fadd qword [ebp + 0x14]
fstp qword [esp]
call dword [esi]
push 0x39
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x10]
push eax
call fcn.00401f89
test eax, eax
jne 0x57a669
mov esi, dword [ebp + 8]
and dword [esi], 0
cmp dword [ebp + 0x10], 0xffffffff
je 0x57a6f3
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
leave
ret 0x1c
mov esi, dword [ebp + 8]
mov dword [esi], eax
jmp 0x57a6e4
Function at 0x57b79b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
push esi
push edi
push 0x631a7c
push str.Default_Mail_Account
push str.softwaremicrosoftiam
push SysReAllocString
lea eax, [ebp - 0x428]
call fcn.00401162
test al, al
jne 0x57b7d3
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
xor esi, esi
cmp word [ebp - 0x428], si
je 0x57b7ca
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push 0x1c
push esi
mov word [ebp - 0x220], si
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
mov ebx, 0x104
push str._s_microsoft_windows_mail_local_folders__s
mov eax, ebx
lea edi, [ebp - 0x630]
call fcn.005383cd
add esp, 0xc
mov eax, edi
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x838]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x13], esi
mov dword [ebp - 0xf], esi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0xb], esi
mov dword [ebp - 7], esi
call fcn.004cfe31
push str.MessageAccount
lea eax, [ebp - 0x18]
call fcn.005436fb
mov edi, eax
cmp edi, esi
jne 0x57b864
lea esi, [ebp - 0x18]
call fcn.004cfba0
jmp 0x57b7ca
push 0x68d908
call fcn.0054373d
cmp eax, esi
je 0x57b857
push ebx
mov ecx, eax
call fcn.005436e0
mov esi, dword [ebp + 8]
mov edx, eax
call fcn.0053838b
push 0x68d920
mov eax, edi
call fcn.0054373d
test eax, eax
jne 0x57b8a5
xor bl, bl
lea esi, [ebp - 0x18]
call fcn.004cfba0
mov al, bl
jmp 0x57b7cc
push ebx
mov ecx, eax
call fcn.005436e0
mov esi, dword [ebp + 0xc]
mov edx, eax
call fcn.0053838b
mov bl, 1
jmp 0x57b896

Function at 0x57b93f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 8]
push eax
push 1
push 0
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x57b9a4
push ebx
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x208
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
pop ebx
jne 0x57b9a4
mov eax, dword [ebp - 4]
shr eax, 1
cmp eax, 0x104
jb 0x57b99b
mov eax, 0x103
and word [esi + eax*2], 0
mov al, 1
jmp 0x57b9bd
mov eax, 0x631a7c
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x57b9ad
xor al, al
leave
ret 8
Function at 0x57beea
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call fcn.0057b9c1
test al, al
je 0x57bf00
mov al, 1
ret 8
jmp fcn.0057bc58