joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56d540
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x56d555
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
mov eax, dword [ecx]
push 4
push ecx
call dword [eax + 0x24]
test eax, eax
jns 0x56d591
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov ebx, eax
mov ecx, dword [edi + 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
cmp eax, 0x8007001e
jne 0x56d59b
call esi
sub eax, ebx
cmp eax, 0x14
jb 0x56d578
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test eax, eax
js 0x56d591
mov eax, dword [edi + 4]
lea edx, [ebp - 4]
mov ecx, dword [eax]
push edx
push 4
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x56d591
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x56e290
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x56e2bf
mov eax, dword [ecx]
push ecx
call dword [eax + 0x64]
test eax, eax
jns 0x56e2d2
mov eax, dword [esi + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret
push 0x50
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0063ac00
mov eax, dword [esi + 4]
add esp, 0xc
mov ecx, dword [eax]
lea edx, [ebp - 0x58]
push edx
push 0x50
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x56e332
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ebx, eax
nop
mov ecx, dword [esi + 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
cmp eax, 0x8007001e
jne 0x56e31b
call edi
sub eax, ebx
cmp eax, 0x14
jb 0x56e300
jmp 0x56e332
test eax, eax
js 0x56e332
mov eax, dword [esi + 4]
lea edx, [ebp - 0x58]
mov ecx, dword [eax]
push edx
push 0x50
push eax
call dword [ecx + 0x24]
test eax, eax
js 0x56e2bf
mov eax, dword [ebp - 0x58]
cmp eax, 0x7998
jl 0x56e343
mov ebx, 2
jmp 0x56e34d
xor ebx, ebx
cmp eax, 0xffff8667
setle bl
mov eax, dword [ebp - 0x54]
cmp eax, 0x7998
jl 0x56e35e
mov edi, 8
jmp 0x56e36d
xor edi, edi
mov ecx, 4
cmp eax, 0xffff8667
cmovle edi, ecx
movzx esi, byte [ebp - 0x1f]
movzx eax, byte [ebp - 0x20]
and eax, 0x80
and esi, 0x80
add esi, esi
or esi, eax
movzx eax, byte [ebp - 0x21]
and eax, 0x80
movzx edx, byte [ebp - 0x28]
add esi, esi
or esi, eax
movzx eax, byte [ebp - 0x22]
and eax, 0x80
movzx ecx, byte [ebp - 0x26]
add esi, esi
or esi, eax
movzx eax, byte [ebp - 0x23]
and eax, 0x80
add esi, esi
or esi, eax
movzx eax, byte [ebp - 0x24]
and eax, 0x80
add esi, esi
or esi, eax
movzx eax, byte [ebp - 0x27]
and eax, 0x80
shr edx, 1
and edx, 0x40
or eax, edx
shr eax, 1
and ecx, 0x80
or eax, ecx
movzx ecx, byte [ebp - 0x25]
shr eax, 1
add esi, esi
or eax, esi
and ecx, 0x80
or eax, ecx
mov ecx, dword [ebp - 4]
or eax, edi
pop edi
or eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.00633732
mov esp, ebp
pop ebp
ret
Function at 0x56faa0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x6b2f86
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x76f950]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
push edi
mov eax, dword [0x76f950]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
mov esi, dword [ebp + 8]
push 0x58
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.0063ac00
mov eax, dword [esi]
mov ecx, dword [esi + 4]
cdq
xor eax, edx
sub eax, edx
neg eax
mov dword [esp + 0x40], eax
mov eax, ecx
shr eax, 8
and al, 1
mov byte [esp + 0x54], al
mov eax, ecx
and eax, 0x200
neg eax
sbb eax, eax
and eax, 0x12c
add eax, 0x190
mov dword [esp + 0x50], eax
mov eax, ecx
shr eax, 0xa
and al, 1
mov byte [esp + 0x55], al
mov eax, dword [esi + 8]
shr ecx, 0xb
sub esp, 0xc
and cl, 1
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], eax
mov eax, esp
mov byte [esp + 0x62], cl
mov dword [esp + 0x2c], esp
push eax
lea ecx, [esi + 0xc]
mov word [esp + 0x67], 1
mov word [esp + 0x6a], 0
call fcn.00406a60
mov dword [esp + 0xc0], 0
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0xc4], 0xffffffff
call fcn.004ef440
mov dword [esp + 0xa8], 1
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push 0x1f
push eax
lea eax, [esp + 0x58]
push eax
call fcn.006343b8
mov esi, dword [edi + 8]
xor eax, eax
add esp, 0xc
mov word [esp + 0x8e], ax
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp dword [esi], 0xffffffff
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [esi + 8]
mov dword [esp + 0x1c], eax
je 0x56fbea
call ebx
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x56fbef
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esi], eax
lea eax, [edi + 0x14]
mov edi, eax
mov ecx, 0x17
lea esi, [esp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
push eax
mov ecx, dword [edi + 0x24]
mov esi, dword [edi + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [edi + 0x24], 0x190
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp dword [esi], 0xffffffff
push eax
push dword [esi + 8]
mov dword [esp + 0x1c], eax
je 0x56fc39
call ebx
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x56fc3e
call ebx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x24], eax
mov dword [edi + 0x10], 0
mov dword [esp + 0xa8], 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x56fc70
push dword [esp + 0x1c]
call fcn.00633f98
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00633732
mov esp, ebp
pop ebp
ret 4
Function at 0x570cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b319b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x2c
call fcn.006341f8
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x570d3e
push str.00IN
push esi
mov ecx, ebx
call fcn.00570520
mov byte [ebp - 4], 1
mov dword [ebx], vtable.tTVPSusiePicturePlugin.0
mov dword [ebx + 0x28], 1
mov byte [ebp - 4], 0
jmp 0x570d43
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], ebx
lea edx, [ebp - 0x10]
xor ecx, ecx
movsx eax, byte [edx]
add ecx, eax
imul ecx, ecx, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
inc edx
lea eax, [ebp - 0xc]
cmp edx, eax
jb 0x570d52
lea eax, [ecx + ecx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
or eax, 0xffffffff
test ecx, ecx
cmove ecx, eax
lea eax, [ebp - 0x18]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00570fc0
mov edi, dword [ebx + 0x1c]
cmp edi, dword [ebx + 0x20]
je 0x570e8d
mov edi, edi
cmp byte [0x77b0bb], 0
je 0x570e81
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 2
mov eax, dword [edi]
test eax, eax
je 0x570dc3
inc dword [eax]
mov eax, dword [edi]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x570cb0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 3
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x78a99c
call fcn.004f50b0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x570e05
mov eax, dword [ecx]
test eax, eax
jne 0x570e02
call fcn.004df580
jmp 0x570e05
dec eax
mov dword [ecx], eax
mov esi, dword [0x78a99c]
cmp esi, dword [0x78a9a0]
je 0x570e81
or ebx, 0xffffffff
mov eax, dword [esi]
test eax, eax
jne 0x570e20
xor ecx, ecx
jmp 0x570e66
mov edx, dword [eax + 4]
test edx, edx
jne 0x570e2a
lea edx, [eax + 8]
movzx ecx, word [edx]
xor eax, eax
test cx, cx
je 0x570e51
movzx ecx, cx
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
lea edx, [edx + 2]
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x570e34
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
test ecx, ecx
cmove ecx, ebx
push esi
push ecx
push esi
mov ecx, 0x789f90
call fcn.004f53f0
add esi, 0xc
cmp esi, dword [0x78a9a0]
jne 0x570e16
mov ebx, dword [ebp - 0x14]
add edi, 4
cmp edi, dword [ebx + 0x20]
jne 0x570da0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x570ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ecx
call fcn.00570f60
mov ebx, eax
test ebx, ebx
je 0x570f3f
mov edi, dword [ebx]
mov esi, dword [edi + 0x1c]
cmp esi, dword [edi + 0x20]
je 0x570ee5
cmp byte [0x77b0bb], 0
je 0x570edd
push dword [ebx]
push 0x570cb0
push esi
call fcn.004f1e10
add esi, 4
cmp esi, dword [edi + 0x20]
jne 0x570ec7
lea edx, [ebp - 4]
xor eax, eax
lea ebx, [ebx]
movsx ecx, byte [edx]
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
inc edx
lea ecx, [ebp]
cmp edx, ecx
jb 0x570ef0
lea eax, [eax + eax*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
or eax, 0xffffffff
test ecx, ecx
cmove ecx, eax
push ecx
lea eax, [ebp - 4]
push eax
call fcn.005710c0
mov ecx, dword [ebx]
test ecx, ecx
je 0x570f38
mov eax, dword [ecx]
push 1
call dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x789804]
mov ecx, dword [0x789800]
test eax, eax
cmovne ecx, eax
call fcn.00452890
int3
Function at 0x572f20
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b34b3
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x38], edi
mov esi, dword [ebp + 8]
push 8
call fcn.006341f8
add esp, 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x572f78
push esi
mov ecx, eax
call fcn.00425da0
jmp 0x572f7a
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x572f8d
lea eax, [ecx + 4]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.00406a60
mov dword [ebp - 4], 1
cmp dword [eax + 0x14], 8
jb 0x572fa7
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 4], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 8
jb 0x572fc9
push dword [ebp - 0x30]
call fcn.00633f98
add esp, 4
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], 0
xor eax, eax
mov word [ebp - 0x30], ax
cmp dword [edi + 4], eax
jne 0x573003
mov ecx, dword [edi]
test ecx, ecx
je 0x572fee
push ecx
call fcn.004215e0
mov ecx, dword [0x788e9c]
mov eax, dword [0x788ea0]
test eax, eax
cmovne ecx, eax
call fcn.00452890
mov dword [ebp - 4], 2
push str.GetVideoOverlayObject
push dword [edi + 4]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [edi + 0xc], eax
push str.GetVideoLayerObject
push dword [edi + 4]
call esi
mov dword [edi + 0x10], eax
push str.GetMixingVideoOverlayObject
push dword [edi + 4]
call esi
mov dword [edi + 0x14], eax
push str.GetMFVideoOverlayObject
push dword [edi + 4]
call esi
mov dword [edi + 0x18], eax
push str.GetAPIVersion
push dword [edi + 4]
call esi
mov dword [edi + 8], eax
push str.V2Link
push dword [edi + 4]
call esi
mov dword [edi + 0x1c], eax
push str.V2Unlink
push dword [edi + 4]
call esi
mov dword [edi + 0x20], eax
mov eax, dword [edi + 8]
test eax, eax
jne 0x573087
mov ecx, dword [0x7899ec]
mov eax, dword [0x7899f0]
test eax, eax
cmovne ecx, eax
call fcn.00452890
lea ecx, [ebp - 0x34]
push ecx
call eax
cmp dword [ebp - 0x34], 0x1000b
jne 0x573072
call fcn.00420fd0
push eax
mov ecx, dword [edi + 0x1c]
call ecx
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret 4
Function at 0x575170
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a28be
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push ecx
call fcn.004e7a50
mov dword [ebp - 4], 0
push ecx
lea ecx, [esi + 0x18]
mov dword [esi], vtable.tTVPVSyncTimingThread.0
call fcn.004e7cc0
mov byte [ebp - 4], 1
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x44]
mov dword [ecx + 4], 0
mov dword [ecx], vtable.NativeEventQueue_class_tTVPVSyncTimingThread_.0
mov dword [ecx + 0x38], 0x575400
mov dword [ecx + 0x3c], esi
mov dword [esi + 0x84], eax
mov eax, dword [ecx]
mov dword [esi + 0x14], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0x10
mov byte [esi + 0x40], 0
call dword [eax + 4]
mov ecx, esi
call fcn.00575590
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [esi + 8]
call edi
cmp eax, 1
jg 0x575216
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x575270
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6a28be
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.tTVPVSyncTimingThread.0
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [edi + 4], 1
push dword [edi + 8]
call esi
cmp eax, 1
jg 0x5752b1
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [edi + 0x44]
lea ecx, [edi + 0x44]
call dword [eax + 8]
mov byte [ebp - 4], 1
lea eax, [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov byte [ebp - 4], 0
push dword [edi + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x18], vtable.tTVPThreadEvent.0
call esi
mov dword [ebp - 4], 0xffffffff
push dword [edi + 8]
mov dword [edi], vtable.tTVPThread.0
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x578e10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x77e326], 0
je 0x578ebe
cmp byte [0x77e325], 0
je 0x578ebe
push 0xdc
lea eax, [ebp - 0xe0]
push 0
push eax
call fcn.0063ac00
mov eax, 0xdc
mov word [ebp - 0x9c], ax
mov eax, dword [0x77e348]
mov dword [ebp - 0x34], eax
mov eax, dword [0x77e34c]
mov dword [ebp - 0x30], eax
mov eax, dword [0x77e350]
add esp, 0xc
mov dword [ebp - 0x38], eax
push 4
lea eax, [ebp - 0xe0]
push eax
mov dword [ebp - 0x98], 0x1c0000
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
push 9
push dword [0x77e338]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x40
push dword [0x77e34c]
push dword [0x77e348]
push 0
push 0
push 0
push dword [0x77e338]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret

Function at 0x579080
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.0057ded0
mov ecx, dword [esi + 0x6c]
add esp, 4
test ecx, ecx
je 0x5790a5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 0x6c], 0
mov edi, dword [esi + 0x68]
test edi, edi
je 0x5790de
push 0
push dword [edi + 0x38]
mov dword [edi + 0xe0], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x38]
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x5790f8
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0xc]
mov dword [esi + 0x68], 0
mov ecx, dword [esi + 0x1c]
call fcn.00403710
mov ecx, esi
call fcn.00404230
pop edi
mov dword [esi + 0x1c], 0
pop esi
pop ebp
ret
call fcn.00451f20
int3

Function at 0x579700
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x57971c
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x144], eax
pop ebp
jmp fcn.0044f580
pop ebp
ret

Function at 0x579740
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x57975f
mov eax, dword [ecx + 0x148]
mov dword [ecx + 0x144], eax
pop ebp
jmp fcn.0044f580
pop ebp
ret
Function at 0x57db80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b44d1
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x76f950]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], vtable.TJS::tTJSNativeInstance.0
mov dword [ebp - 4], 0
mov dword [ecx + 4], vtable.iTVPWindow.0
mov dword [ecx + 8], vtable.iTVPLayerTreeOwner.0
mov dword [ecx], vtable.tTJSNI_BaseWindow.1.0
mov dword [ecx + 4], vtable.tTJSNI_BaseWindow.0
mov dword [ecx + 8], vtable.tTJSNI_BaseWindow.2.0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
lea eax, [ecx + 0x48]
mov dword [ebp - 0x14], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov byte [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 4
mov byte [ecx + 0x64], 0
mov byte [ecx + 0x18], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x30], 0
mov byte [ecx + 0x44], 0
mov dword [ecx + 0x2c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x58bde0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x58bdeb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0058be00
Function at 0x58c530
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0xca
jne 0x58c581
mov eax, dword [esi + 4]
push 0x1c
mov eax, dword [eax]
push 1
push esi
call eax
mov dword [esi + 0x180], eax
add esp, 0xc
mov ecx, esi
mov dword [eax], 0x58fa50
mov dword [eax + 4], 0x58fbb0
mov byte [eax + 8], 0
call fcn.0058f860
cmp byte [esi + 0x40], 0
je 0x58c57a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x58c601
mov eax, dword [esi + 0x190]
cmp byte [eax + 0x10], 0
je 0x58c5ef
mov eax, dword [esi + 8]
test eax, eax
je 0x58c5a7
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x58c5ea
cmp eax, 2
je 0x58c5ef
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x58c598
cmp eax, 3
je 0x58c5cf
cmp eax, 1
jne 0x58c598
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x58c598
mov eax, dword [esi + 0x11c]
add eax, edi
mov dword [edx + 8], eax
jmp 0x58c598
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
pop edi
mov dword [esi + 0x84], eax
mov ecx, esi
pop esi
jmp 0x58c630
cmp eax, 0xcc
je 0x58c623
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x14
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
pop edi
mov ecx, esi
pop esi
jmp 0x58c630
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
je 0x58c65a
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x180]
cmp byte [eax + 8], 0
je 0x58c6e2
lea ebx, [esi + 0x78]
lea esp, [esp]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x58c6b6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x58c695
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x184]
mov edi, dword [ebx]
mov eax, dword [eax + 4]
push 0
push ebx
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x58c6f8
cmp eax, dword [esi + 0x60]
jb 0x58c677
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x180]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
mov eax, dword [esi + 0x180]
add esp, 8
cmp byte [eax + 8], 0
jne 0x58c670
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
pop esi
mov al, 1
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x593060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1a8]
mov dword [ebp - 0x1c], esi
jne 0x593088
mov eax, 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x59308d
xor eax, eax
mov byte [esi + 0x1c], al
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
mov eax, dword [ecx + 8]
push 1
push edi
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 0xc], ebx
cmp dword [edi + 0x64], ebx
jle 0x593188
jmp 0x5930c0
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
je 0x5930dd
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 8], eax
lea eax, [ecx + 0xfe]
cdq
idiv edi
mov ecx, dword [ebp - 8]
xor ebx, ebx
xor esi, esi
mov edx, eax
nop
cmp esi, edx
jle 0x59312c
mov ecx, dword [ebp - 0x14]
mov eax, ebx
imul eax, eax, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
mov eax, ecx
cdq
idiv edi
inc ebx
mov edx, eax
cmp esi, edx
jg 0x593117
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x10]
imul bl
mov byte [esi + ecx], al
inc esi
cmp esi, 0xff
jle 0x593100
cmp dword [ebp - 4], 0
je 0x59316f
mov ebx, dword [ebp - 8]
mov ecx, 1
lea edx, [ebx - 1]
mov edi, edi
movzx eax, byte [ebx]
mov byte [edx], al
movzx eax, byte [ebx + 0xff]
mov byte [ebx + ecx + 0xff], al
inc ecx
lea edx, [edx - 1]
cmp ecx, 0xff
jle 0x593150
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
jl 0x5930c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret