joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54e0e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5e4ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x18], ecx
mov edi, dword [esp + 0x80]
test edi, edi
je 0x54e11d
mov eax, dword [edi + 4]
test eax, eax
jne 0x54e124
xor eax, eax
jmp 0x54e2a8
mov esi, dword [esp + 0x88]
test esi, esi
jne 0x54e154
cmp dword [esp + 0x84], esi
jne 0x54e154
push eax
call sub.mfc90u.dll_AfxGetModuleState
mov eax, dword [eax + 0x94]
mov ecx, dword [eax]
call fcn.005183a0
mov dword [esp + 0x88], eax
mov esi, eax
cmp dword [esp + 0x8c], 0
jne 0x54e1b7
cmp dword [esp + 0x90], 0
jne 0x54e1b7
test esi, esi
jle 0x54e1b7
mov eax, dword [edi + 4]
lea ecx, [esp + 0x2c]
push ecx
push 0
push eax
call sub.mfc90u.dll_AfxGetModuleState
mov edx, dword [eax + 0x94]
mov ecx, dword [edx]
call fcn.005491d0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x1c]
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], ecx
mov eax, dword [edi + 4]
push eax
call sub.mfc90u.dll_AfxGetModuleState
mov edx, dword [eax + 0x94]
mov ecx, dword [edx]
call fcn.005183a0
xor ecx, ecx
cmp eax, esi
sete cl
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x14], ecx
test esi, esi
jle 0x54e2a3
mov eax, dword [esp + 0x84]
test eax, eax
je 0x54e200
cmp dword [esp + 0x14], 0
jne 0x54e200
cmp dword [eax + ebp*4], 0
je 0x54e29a
mov eax, dword [edi + 4]
push 0
push ebx
push eax
call sub.mfc90u.dll_AfxGetModuleState
mov edx, dword [eax + 0x94]
mov ecx, dword [edx]
call fcn.005185f0
mov esi, eax
test esi, esi
je 0x54e11d
mov eax, dword [esp + 0x84]
test eax, eax
je 0x54e233
mov edi, dword [eax + ebp*4]
jmp 0x54e235
mov edi, ebp
push 1
push esi
lea ecx, [esp + 0x54]
call fcn.0054bb70
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
push ecx
mov ecx, dword [esp + 0x20]
push edx
push edi
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x8c], 0
call fcn.0054dd80
lea ecx, [esp + 0x4c]
mov dword [esp + 0x78], 0xffffffff
call fcn.0054bcc0
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov esi, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
inc ebx
inc ebp
cmp ebp, esi
jl 0x54e1e4
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0x18
Function at 0x54ee70
Capabilities:
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x5e4c60
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov esi, ecx
push 0x400
lea ecx, [esp + 0x14]
call sub.mfc90u.dll_CMemFile::CMemFile_1
push 0
push 0x1000
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x98], 0
call fcn.005dfde0
mov edx, dword [esp + 0x90]
lea ecx, [esp + 0x38]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x90], 1
call fcn.0054eb20
lea ecx, [esp + 0x38]
call sub.mfc90u.dll_CArchive::Flush
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_CMemFile::GetPosition
lea ecx, [esp + 0x10]
mov edi, eax
call sub.mfc90u.dll_CMemFile::Detach
push edi
push 2
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x54ef3f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebp
push edi
push eax
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
movzx eax, word [0x7407c0]
push esi
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
lea ecx, [esp + 0x38]
call sub.mfc90u.dll_CArchive::Close
lea ecx, [esp + 0x10]
call sub.mfc90u.dll_CMemFile::Close
push ebp
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
lea ecx, [esp + 0x38]
mov byte [esp + 0x88], 0
call sub.mfc90u.dll_CArchive::CArchive
lea ecx, [esp + 0x10]
mov dword [esp + 0x88], 0xffffffff
call sub.mfc90u.dll_CMemFile::CMemFile
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x7c
ret 4
Function at 0x551280
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
je 0x55141c
mov eax, dword [esi + 0x174]
test eax, eax
je 0x55141c
cmp dword [eax + 0x20], 0
je 0x55141c
test eax, eax
je 0x5512bd
cmp dword [eax + 0x54], 0
je 0x5512bd
mov eax, 2
pop esi
ret 8
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xd
je 0x551415
cmp edi, 9
je 0x551415
cmp edi, 0x1b
jne 0x551309
lea eax, [esi + 0x194]
push eax
mov ecx, esi
call fcn.005511f0
mov edx, dword [esi]
mov eax, dword [edx + 0x70]
push 0
mov ecx, esi
call eax
mov ecx, dword [esi + 0x100]
xor eax, eax
cmp dword [ecx + 0xf8], 2
pop edi
sete al
pop esi
ret 8
push ebx
test eax, eax
je 0x55134e
cmp dword [eax + 0x20], 0
je 0x55134e
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
test ax, ax
jge 0x55134e
push 0x11
call ebx
test ax, ax
jl 0x55134e
mov ecx, dword [esi + 0x100]
call fcn.00538eb0
test eax, eax
je 0x55134e
movzx edx, di
push edx
mov ecx, eax
call fcn.00529f40
test eax, eax
jne 0x5513d7
mov ecx, esi
call fcn.0051c050
test eax, eax
je 0x5513e2
cmp dword [esi + 0x1ac], 0
je 0x5513e2
cmp edi, 0x26
je 0x551370
cmp edi, 0x28
jne 0x5513e2
mov ecx, esi
call fcn.0054fec0
test eax, eax
jne 0x5513e2
mov eax, dword [esi]
mov edx, dword [eax + 0x168]
xor ecx, ecx
cmp edi, 0x26
sete cl
lea ecx, [ecx + ecx - 1]
push ecx
push 1
mov ecx, esi
call edx
mov eax, dword [esi + 0x174]
test eax, eax
je 0x5513d7
mov edi, dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x5513d7
mov esi, dword [esi + 0x174]
mov eax, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop ebx
pop edi
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x1a0]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x5513fb
push ebx
push edi
call fcn.005315d0
test eax, eax
jne 0x5513d7
mov ecx, dword [esi + 0x174]
push ebx
push edi
call fcn.00531420
neg eax
pop ebx
sbb eax, eax
pop edi
add eax, 2
pop esi
ret 8
pop edi
xor eax, eax
pop esi
ret 8
xor eax, eax
pop esi
ret 8
Function at 0x5576d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1ac], 0
push edi
mov edi, dword [esp + 0xc]
je 0x55771c
cmp edi, 0x28
jne 0x55771c
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x557715
mov eax, dword [esi + 0xcc]
mov ecx, dword [esi + 0xfc]
push 1
push 0
push 1
push 1
push eax
call fcn.00523900
cmp eax, dword [esi + 0xcc]
jg 0x55771c
mov ecx, esi
call fcn.00556e10
mov ecx, dword [esp + 0x10]
push ecx
push edi
mov ecx, esi
call fcn.0053ca70
pop edi
pop esi
ret 8
Function at 0x560bb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.0055ef70
mov ecx, eax
jmp fcn.00560170

Function at 0x5628c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e5ffb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0056b8e0
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x15
call edi
push 3
mov dword [esi + 4], eax
call edi
push 2
mov dword [esi + 8], eax
call edi
push 0x14
mov dword [esi + 0x10], eax
call edi
mov edi, dword [esi + 0x28]
push ecx
mov ecx, esp
mov dword [esp + 0x10], esp
push str.ControlGallerySelected
mov dword [esi + 0xc], eax
mov dword [esi + 0x2c], 0x15
mov dword [esi + 0x30], 0x13
call dword [0x612678]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.Toolbar
mov dword [esp + 0x28], 0
call dword [0x612678]
mov ecx, edi
call fcn.005617e0
mov ecx, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.00599a70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ControlGalleryNormal
mov dword [esi + 0x38], eax
call dword [0x612678]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Toolbar
mov dword [esp + 0x28], 1
call dword [0x612678]
mov ecx, edi
call fcn.005617e0
mov ecx, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.00599a70
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.ControlGalleryBorder
mov dword [esi + 0x3c], eax
call dword [0x612678]
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Toolbar
mov dword [esp + 0x28], 2
call dword [0x612678]
mov ecx, edi
call fcn.005617e0
mov ecx, eax
mov dword [esp + 0x24], 0xffffffff
call fcn.00599a70
mov dword [esi + 0x40], eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x5693b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebx + 0x60]
test esi, esi
je 0x569451
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
shr eax, 8
push edi
mov edi, dword [esi + 0x34]
cmp al, 2
jne 0x56944f
test edi, edi
je 0x56944f
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
lea eax, [esi + 4]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x569401
mov edx, dword [ebx]
mov eax, dword [edx + 0x24]
mov ecx, ebx
call eax
cmp dword [eax + 0x14], 0
jne 0x569401
mov eax, dword [edi + 0x2c]
jmp 0x569429
mov ecx, dword [esi + 0x34]
cmp dword [ecx + 0x58], 0
mov ecx, dword [esp + 0x1c]
jne 0x569412
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x1c]
add eax, ecx
mov ecx, dword [edi + 0x40]
cmp eax, ecx
jl 0x569427
mov edx, dword [edi + 0x3c]
add ecx, edx
cmp eax, ecx
jl 0x569429
mov eax, ecx
push eax
mov ecx, ebx
call fcn.00569320
cmp ebp, 0x202
je 0x569446
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x56944f
push 0
mov ecx, ebx
call fcn.00569220
pop edi
pop ebp
pop esi
pop ebx
ret 0xc
Function at 0x56c660
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
call fcn.0056b0c0
test eax, eax
je 0x56c686
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00553b90
pop esi
ret 0xc
mov ecx, esi
call fcn.0052bff0
test eax, eax
je 0x56c6ce
mov ecx, dword [esi + 0x100]
push 0
push 0xffffffffffffffff
call fcn.0053af60
mov ecx, dword [esi + 0x100]
mov eax, dword [ecx]
mov edx, dword [eax + 0x150]
push 0
push 0xffffffffffffffff
call edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [esp + 0xc]
mov eax, dword [eax + 0x108]
push ecx
push edx
mov ecx, esi
call eax
pop esi
ret 0xc
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
jne 0x56c6e8
mov ecx, dword [esi + 0x15c]
test ecx, ecx
je 0x56c6e8
call fcn.0052c5b0
test eax, eax
je 0x56c79d
cmp dword [esp + 8], 0
jne 0x56c79d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esi]
mov edx, dword [edx + 0xfc]
push eax
push ecx
mov ecx, esi
call edx
mov eax, dword [esi + 0x1dc]
cmp eax, 0x41
jne 0x56c734
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x100]
push 0
push eax
call fcn.0053af60
pop esi
ret 0xc
test eax, eax
je 0x56c77d
mov eax, dword [esi + 0x100]
push edi
test eax, eax
jne 0x56c747
xor edi, edi
jmp 0x56c74a
mov edi, dword [eax + 0x20]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
mov eax, dword [esp + 0x14]
setl cl
lea edx, [esi + 0x188]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
push edi
lea ecx, [esi + 0x184]
call fcn.0056abe0
pop edi
pop esi
ret 0xc
mov ecx, dword [esi + 0x100]
push 0
push 0xffffffffffffffff
call fcn.0053af60
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, esi
call fcn.0056bf90
pop esi
ret 0xc
Function at 0x56e670
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x74]
call edx
test eax, eax
je case.0x56e6f5.10
cmp dword [esi + 0x1fc], 0xffffffff
jne 0x56e6ca
mov eax, dword [esi]
mov edx, dword [eax + 0x8c]
mov ecx, esi
call edx
test eax, eax
je 0x56e6ca
mov eax, dword [esp + 8]
cmp eax, 0xd
je 0x56e6ad
cmp eax, 0x20
jne case.0x56e6f5.10
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0x100]
push 0
push eax
call fcn.0053af60
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x100]
lea ecx, [esp + 8]
push ecx
push edx
call fcn.0055d3c0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
add esp, 8
cmp eax, 0x1f
ja case.0x56e6f5.10
movzx eax, byte [eax + 0x56e8e0]
jmp dword [eax*4 + 0x56e8b4]
push 1
push 0xffffffffffffffff
mov ecx, esi
call fcn.0056c270
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
push 0xffffffffffffffff
jmp 0x56e6fe
mov ecx, dword [esi + 0x1fc]
push 0xffffffffffffffff
push ecx
mov ecx, esi
call fcn.0056dd60
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 1
push edx
mov ecx, esi
call fcn.0056dd60
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1fc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0056e0c0
cmp eax, 0xffffffff
jne 0x56e707
mov edx, dword [esi + 0x80]
mov ecx, dword [esi + 0xf8]
push 1
push 0
push 1
push eax
push edx
call fcn.00523900
cmp eax, dword [esi + 0x80]
jne case.0x56e6f5.10
push 0xffffffffffffffff
push 0xffffffffffffffff
mov ecx, esi
call fcn.0056c270
cmp eax, 0xffffffff
je case.0x56e6f5.10
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov eax, dword [esi + 0x1fc]
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0056df20
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov ecx, dword [esi + 0x1fc]
push 1
push ecx
mov ecx, esi
call fcn.0056df20
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 1
push edx
mov ecx, esi
call fcn.0056e0c0
cmp eax, 0xffffffff
jne 0x56e707
mov eax, dword [esi + 0x80]
mov ecx, dword [esi + 0xf8]
push 1
push 0
push 1
push 1
push eax
call fcn.00523900
cmp eax, dword [esi + 0x80]
jne case.0x56e6f5.10
push 1
jmp 0x56e79a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x56e877
mov ecx, dword [esi + 0x1fc]
push 1
push ecx
mov ecx, esi
call fcn.0056c270
cmp eax, dword [esi + 0x1fc]
jle case.0x56e6f5.10
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov edx, dword [esi + 0x1fc]
push 0xffffffffffffffff
push edx
mov ecx, esi
call fcn.0056c270
cmp eax, dword [esi + 0x1fc]
jge case.0x56e6f5.10
push eax
mov ecx, esi
call fcn.0056e200
mov eax, 1
pop esi
ret 8
mov eax, dword [esi]
mov edx, dword [eax + 0x98]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 8
Function at 0x570910
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e6770
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x72d630]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, ecx
mov eax, 0x55
mov edx, eax
mov ecx, 0xaa
mov word [esp + 0x2c], ax
mov eax, ecx
mov word [esp + 0x2e], cx
mov ecx, edx
mov word [esp + 0x30], dx
mov edx, eax
mov word [esp + 0x32], ax
mov eax, ecx
mov word [esp + 0x34], cx
mov ecx, edx
xor ebx, ebx
mov word [esp + 0x36], dx
mov word [esp + 0x38], ax
mov word [esp + 0x3a], cx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBitmap.0
lea edx, [esp + 0x2c]
push edx
push 1
push 1
push 8
push 8
mov dword [esp + 0x5c], ebx
call dword [sym.imp.GDI32.dll_CreateBitmap]
push eax
lea ecx, [esp + 0x24]
call sub.mfc90u.dll_CGdiObject::Attach
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], vtable.CBrush.0
mov eax, dword [esp + 0x24]
push eax
mov byte [esp + 0x4c], 1
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
lea ecx, [esp + 0x1c]
call sub.mfc90u.dll_CGdiObject::Attach
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject
mov edx, dword [esi]
push 0xf
mov ecx, ebp
mov ebx, eax
mov dword [esp + 0x18], edx
call fcn.0051c180
push eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax + 0x34]
mov ecx, esi
call edx
mov dword [esp + 0x28], eax
mov eax, dword [esi]
push 0x14
mov ecx, ebp
mov dword [esp + 0x18], eax
call fcn.0051c180
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [edx + 0x38]
mov ecx, esi
call eax
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov ebp, eax
mov eax, dword [edi + 0xc]
mov edi, dword [edi + 8]
push 0xf00021
sub eax, ecx
push eax
sub edi, edx
push edi
push ecx
mov ecx, dword [esi + 4]
push edx
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
push ebx
mov ecx, esi
call sub.mfc90u.dll_CDC::SelectObject
mov edx, dword [esi]
mov eax, dword [esp + 0x28]
mov edx, dword [edx + 0x34]
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
push ebp
mov ecx, esi
call edx
lea ecx, [esp + 0x18]
call sub.mfc90u.dll_CGdiObject::DeleteObject
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 0
mov dword [esp + 0x18], vtable.CBrush.0
call fcn.00401a60
lea ecx, [esp + 0x20]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x20], vtable.CBitmap.0
call fcn.00401a60
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.005e038a
add esp, 0x38
ret 8
Function at 0x57bc90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e6e38
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0057bc40
lea ecx, [esi + 0x5e4]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.CXTPVisualStudio2008Theme.0
call fcn.0055e560
lea ecx, [esi + 0x604]
call fcn.0055e540
lea ecx, [esi + 0x610]
call fcn.0055e540
mov eax, dword [esi + 0x46c]
mov dword [esi + 0x80], 0xa
mov dword [eax + 0x30], 1
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x582d30
Capabilities:
Create process on windows

Disassembly:
push 5
push 0
push 0
add ecx, 0xe8
call dword [sym.imp.mfc90u.dll_]
push eax
push 0x6bf954
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
Function at 0x583da0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
cmp dword [esp + 0x1c], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x583ee1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x100]
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0xc4]
mov ecx, dword [esi + 0xc8]
mov edx, dword [esi + 0xcc]
mov ebx, dword [esi + 0xc0]
mov edi, dword [esi + 0x19c]
mov ebp, dword [esi + 0x1a0]
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x583e53
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x20]
jl 0x583e31
sub eax, ebx
cdq
idiv dword [esi + 0x18c]
mov edi, dword [esi + 0x17c]
inc eax
cmp edi, eax
jl 0x583e31
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x24]
jl 0x583e53
sub eax, dword [esp + 0x1c]
mov ebp, dword [esi + 0x180]
cdq
idiv dword [esi + 0x190]
inc eax
cmp ebp, eax
jl 0x583e53
mov ebp, eax
mov eax, dword [esi + 0x19c]
mov ecx, dword [esi + 0x1a0]
cmp edi, eax
jne 0x583e67
cmp ebp, ecx
je 0x583ec6
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x184]
push 1
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x19c], edi
mov dword [esi + 0x1a0], ebp
call fcn.00582820
mov ecx, dword [esi + 0x100]
mov dword [esi + 0x1a4], 1
mov edx, dword [ecx]
mov eax, dword [edx + 0x184]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0xfc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x1a4], 0
call edx
jmp 0x583ee1
push 0
sub esp, 8
mov eax, esp
mov ecx, esi
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00582820
mov eax, dword [esp + 0x2c]
push eax
mov ecx, esi
call fcn.0052e110
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x5846e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e7218
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0052c080
test eax, eax
jne 0x584720
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call sub.mfc90u.dll_CGdiObject::FromHandle
jmp 0x584725
add eax, 0x104
mov edi, dword [esp + 0x38]
push eax
push edi
lea ecx, [esp + 0x1c]
call fcn.0055cc20
mov eax, dword [esi]
mov edx, dword [eax + 0x58]
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
mov dword [esp + 0x30], 0
call edx
mov esi, eax
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.mfc90u.dll_]
mov ecx, dword [edi + 8]
push eax
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x38]
mov dword [esi], edx
mov dword [esi + 4], eax
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0055cc60
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 8
Function at 0x5870c0
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
je 0x5870f6
cmp dword [esi + 4], 0
jne 0x58710b
push edi
call sub.mfc90u.dll_AfxGetModuleState
mov edi, dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x586f90
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop edi
mov dword [esi + 4], eax
pop esi
ret 4
mov eax, dword [esi + 4]
test eax, eax
je 0x58710b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esi + 4], 0
pop esi
ret 4