joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4f60
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push edi
je 0x4d5108
mov edi, dword [esp + 0x828]
test edi, edi
je 0x4d5108
mov eax, dword [esp + 0x830]
test eax, eax
je 0x4d5108
push ebx
mov ebx, dword [0x5d2614]
push ebp
push esi
lea eax, [esp + 0x218]
push 0x623518
push eax
mov ebp, 0x80004005
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d4fee
lea ecx, [edi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x5d49c0
push str.udatfile
lea eax, [esp + 0x22c]
push eax
call esi
test eax, eax
jne 0x4d502c
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call ebx
add esp, 8
add edi, 0x410
push edi
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x5d49c0
push str.udatfile
lea eax, [esp + 0x63c]
push eax
call esi
test eax, eax
je 0x4d5051
push 0x104
lea ecx, [esp + 0x424]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [0x5d2618]
add esp, 0xc
xor ebp, ebp
mov word [esp + 0x216], bp
test ebp, ebp
jl 0x4d50bd
lea eax, [esp + 0x10]
test eax, eax
je 0x4d5074
mov ecx, eax
push ecx
call dword [0x5d2620]
mov ecx, dword [esp + 0x840]
add esp, 4
cmp eax, ecx
ja 0x4d509d
mov edx, dword [esp + 0x83c]
mov ecx, dword [esp + 0x838]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.004049b0
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov edx, dword [esp + 0x838]
mov ebp, 0x8004e03c
pop esi
mov eax, ebp
pop ebp
pop ebx
mov word [edx], 0
pop edi
add esp, 0x820
ret 0x10
mov eax, dword [esp + 0x840]
test eax, eax
je 0x4d50ed
mov ecx, dword [esp + 0x83c]
mov edx, dword [esp + 0x838]
push ecx
push eax
push edx
call fcn.004049b0
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov eax, dword [esp + 0x838]
pop esi
mov word [eax], 0
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov eax, 0x80070057
pop edi
add esp, 0x820
ret 0x10
Function at 0x4d5120
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push edi
je 0x4d52c8
mov edi, dword [esp + 0x828]
test edi, edi
je 0x4d52c8
mov eax, dword [esp + 0x830]
test eax, eax
je 0x4d52c8
push ebx
mov ebx, dword [0x5d2614]
push ebp
push esi
lea eax, [esp + 0x218]
push 0x623518
push eax
mov ebp, 0x80004005
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x218], 0
je 0x4d51ae
lea ecx, [edi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x5d49c0
push str.introproject
lea eax, [esp + 0x22c]
push eax
call esi
test eax, eax
jne 0x4d51ec
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call ebx
add esp, 8
add edi, 0x410
push edi
push 0x104
lea edx, [esp + 0x428]
push edx
push 0x5d49c0
push str.introproject
lea eax, [esp + 0x63c]
push eax
call esi
test eax, eax
je 0x4d5211
push 0x104
lea ecx, [esp + 0x424]
push ecx
lea edx, [esp + 0x18]
push edx
call dword [0x5d2618]
add esp, 0xc
xor ebp, ebp
mov word [esp + 0x216], bp
test ebp, ebp
jl 0x4d527d
lea eax, [esp + 0x10]
test eax, eax
je 0x4d5234
mov ecx, eax
push ecx
call dword [0x5d2620]
mov ecx, dword [esp + 0x840]
add esp, 4
cmp eax, ecx
ja 0x4d525d
mov edx, dword [esp + 0x83c]
mov ecx, dword [esp + 0x838]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.004049b0
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov edx, dword [esp + 0x838]
mov ebp, 0x8004e03c
pop esi
mov eax, ebp
pop ebp
pop ebx
mov word [edx], 0
pop edi
add esp, 0x820
ret 0x10
mov eax, dword [esp + 0x840]
test eax, eax
je 0x4d52ad
mov ecx, dword [esp + 0x83c]
mov edx, dword [esp + 0x838]
push ecx
push eax
push edx
call fcn.004049b0
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov eax, dword [esp + 0x838]
pop esi
mov word [eax], 0
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0x10
mov eax, 0x80070057
pop edi
add esp, 0x820
ret 0x10
Function at 0x4d52e0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push edi
je 0x4d53f9
mov edi, dword [esp + 0x828]
test edi, edi
je 0x4d53f9
push ebx
mov ebx, dword [0x5d2614]
push ebp
push esi
lea eax, [esp + 0x420]
push 0x623518
push eax
mov ebp, 0x80004005
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x420], 0
je 0x4d535c
lea ecx, [edi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.hideupsellcheckbox
lea eax, [esp + 0x434]
push eax
call esi
test eax, eax
jne 0x4d5397
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call ebx
add esp, 8
add edi, 0x410
push edi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.hideupsellcheckbox
lea eax, [esp + 0x63c]
push eax
call esi
test eax, eax
je 0x4d53bc
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x220]
push edx
call dword [0x5d2618]
add esp, 0xc
xor ebp, ebp
mov word [esp + 0x41e], bp
test ebp, ebp
mov esi, dword [esp + 0x838]
mov dword [esi], 1
jl 0x4d53ea
lea eax, [esp + 0x218]
push eax
push str.true
call dword [0x5d25ac]
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 8
mov eax, 0x80070057
pop edi
add esp, 0x820
ret 8

Function at 0x4d57e0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x820
test eax, eax
push edi
je 0x4d590b
mov edi, dword [esp + 0x828]
test edi, edi
je 0x4d590b
push ebx
mov ebx, dword [0x5d2614]
push ebp
push esi
lea eax, [esp + 0x420]
push 0x623518
push eax
mov ebp, 0x80004005
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 8
cmp word [esp + 0x420], 0
je 0x4d585c
lea ecx, [edi + 0x410]
push ecx
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.oemappgradelimitdemo
lea eax, [esp + 0x434]
push eax
call esi
test eax, eax
jne 0x4d5897
lea ecx, [esp + 0x628]
push 0x5ead80
push ecx
call ebx
add esp, 8
add edi, 0x410
push edi
push 0x104
lea edx, [esp + 0x18]
push edx
push 0x5d49c0
push str.oemappgradelimitdemo
lea eax, [esp + 0x63c]
push eax
call esi
test eax, eax
je 0x4d58ec
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x220]
push edx
call dword [0x5d2618]
lea eax, [esp + 0x224]
push eax
xor ebp, ebp
push str.true
mov word [esp + 0x432], bp
call dword [0x5d25ac]
mov ecx, dword [esp + 0x84c]
add esp, 0x14
neg eax
sbb eax, eax
inc eax
pop esi
mov dword [ecx], eax
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0xc
mov eax, dword [esp + 0x838]
mov edx, dword [esp + 0x83c]
pop esi
mov dword [eax], edx
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x820
ret 0xc
mov eax, 0x80070057
pop edi
add esp, 0x820
ret 0xc
Function at 0x4d5a10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb108
push 0x5c43d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x630
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
push 0x104
mov esi, dword [ebp + 8]
push esi
lea eax, [ebp - 0x230]
push eax
call dword [0x5d2618]
add esp, 0xc
mov word [ebp - 0x2a], di
lea ecx, [ebp - 0x230]
test ecx, ecx
je 0x4d5a74
mov edx, ecx
push edx
call dword [0x5d2620]
add esp, 4
lea eax, [ebp - 0x640]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x104
lea ecx, [ebp - 0x438]
push ecx
push esi
call sym.vidcap60.exe__SfGetPathNameFromFilePath_12
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
cmp esi, edi
jl 0x4d5b4d
jne 0x4d5abf
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], edi
push 0x8000
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
call ebx
mov dword [ebp - 0x24], eax
push 1
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.ole32.dll_CoLoadLibrary]
mov edi, eax
mov dword [ebp - 0x20], edi
cmp edi, 0xffffffff
je 0x4d5af0
xor esi, esi
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x24]
push ecx
call ebx
mov dword [ebp - 4], 0xffffffff
jmp 0x4d5b17
lea edx, [ebp - 0x640]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test esi, esi
jl 0x4d5b4b
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push edi
call sym.vidcap60.exe__SfDllCreateInstance_20
mov esi, eax
test esi, esi
jge 0x4d5b4b
push edi
call dword [sym.imp.ole32.dll_CoFreeLibrary]
xor edi, edi
cmp dword [ebp - 0x1c], edi
je 0x4d5b58
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4ed0a0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x218
push edi
mov edi, dword [esp + 0x224]
test edi, edi
je 0x4ed0c0
push edi
call dword [0x5d2620]
add esp, 4
test eax, eax
jne 0x4ed0cf
mov eax, 0x80004005
pop edi
add esp, 0x218
ret 8
push ebp
mov ebp, dword [esp + 0x224]
lea eax, [esp + 8]
push eax
push 0x2000000
push 0
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ed16d
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push eax
push eax
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x4ed159
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.004ed0a0
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x30]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
je 0x4ed120
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
xor eax, eax
pop edi
add esp, 0x218
ret 8

Function at 0x4ef080
Capabilities:
Execute anti-debugging instructions
Get system information on windows

Disassembly:
sub esp, 0x138
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x18], 0x24a
jne 0x4ef0f3
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x34], 2
je 0x4ef0f3
push ebx
push 0x6a3694
call dword [0x611690]
rdtsc
mov ebx, 0x6a368c
mov ecx, eax
sub eax, dword [ebx]
mov dword [ebx], ecx
mov ecx, edx
sbb edx, dword [ebx + 4]
mov dword [ebx + 4], ecx
rdtsc
mov ebx, 0x6a368c
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
cmp eax, 0x3e8
pop ebx
ja 0x4ef0f3
mov dword [0x6a3688], 1
add esp, 0x138
ret

Function at 0x4ef100
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x6a3688]
test eax, eax
je 0x4ef169
push ebx
push 0x6a3694
call dword [0x61168c]
mov ecx, eax
rdtsc
mov ebx, 0x6a368c
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
cmp ecx, 0x1f4
mov edx, eax
jae 0x4ef156
mov eax, 0x1f4
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x6a3694
call dword [0x61168c]
mov ecx, eax
rdtsc
mov ebx, 0x6a368c
sub eax, dword [ebx]
sbb edx, dword [ebx + 4]
mov edx, eax
cmp ecx, 0x1c2
pop ebx
jae 0x4ef16c
mov dword [0x6a3688], 0
xor eax, eax
ret
imul ecx, ecx, 0x3e8
mov eax, ecx
shr eax, 1
add eax, edx
xor edx, edx
div ecx
mov dword [0x611668], 0
mov dword [0x611674], 0x3e8
mov dword [0x611670], eax
imul eax, eax, 0x3e8
mov dword [0x61166c], eax
imul eax, eax, 0x3e8
mov dword [0x611664], eax
ret

Function at 0x4ef3f0
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [ecx + 0x18]
jmp 0x4ef7a0
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x20]
test ecx, ecx
pop esi
je 0x4ef7bc
jmp fcn.004f0b80
ret
Function at 0x4efbf0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1abc
call fcn.005c4400
push edi
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, dword [0x621c78]
push 0x104
lea eax, [esp + 0x5c]
push eax
push ecx
mov dword [esp + 0x20], 0x44
call sym.vidcap60.exe__SfGetModuleFileName_12
push 0x104
lea edx, [esp + 0x264]
push edx
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ecx, dword [esp + 0x1acc]
mov edx, dword [esp + 0x1ac8]
mov eax, dword [esp + 0x1ac4]
push ecx
push edx
push eax
lea ecx, [esp + 0x26c]
push ecx
lea edx, [esp + 0x478]
push str.RunDLL32.exe__s__SfDownload_WinMain_16__s_s_s
push edx
call sym.vidcap60.exe_SfPrintF
add esp, 0x18
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [esp + 0x488]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
add esp, 0x1abc
ret 0xc
Function at 0x4fb330
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x68
push esi
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, eax
test esi, esi
jne 0x4fb34e
pop esi
add esp, 0x68
ret 0x10
mov eax, dword [esp + 0x74]
cmp eax, 0x3e8
je 0x4fb372
cmp eax, 0x3e9
je 0x4fb372
cmp eax, 0x3ea
je 0x4fb372
cmp eax, 0x3eb
jne 0x4fb4b0
push ebp
mov ebp, dword [esp + 0x80]
cmp ebp, 0x200
je 0x4fb38e
cmp ebp, 0x300
jne 0x4fb4af
push ebx
push edi
add eax, 0xfffffc18
or edi, 0xffffffff
cmp eax, 3
ja case.default.0x4fb39d
jmp dword [eax*4 + 0x4fb4bc]
xor edi, edi
jmp case.default.0x4fb39d
mov edi, 1
jmp case.default.0x4fb39d
mov edi, 2
jmp case.default.0x4fb39d
mov edi, 3
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.004f60c0
mov eax, dword [esp + 0x84]
push 0x28
lea edx, [esp + 0x2c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
fld dword [esp + edi*4 + 0x18]
fmul dword [0x5e9648]
lea edi, [esp + edi*4 + 0x18]
push 0
push 0xff
fadd qword [0x5d8c68]
push 0
sub esp, 8
fstp qword [esp + 0x24]
fld qword [esp + 0x24]
fstp qword [esp]
call dword [0x5d24ec]
add esp, 8
call fcn.005c4484
push eax
lea ecx, [esp + 0x38]
push ecx
call sym.vidcap60.exe__SfTextToLongTokenEx_20
fld qword [esp + 0x10]
mov ebx, eax
sub esp, 8
fstp qword [esp]
mov dword [esp + 0x84], ebx
call dword [0x5d24ec]
add esp, 8
call fcn.005c4484
cmp eax, ebx
je 0x4fb49f
fild dword [esp + 0x7c]
lea edx, [esp + 0x18]
push edx
push esi
fmul dword [0x5e6a24]
fstp dword [edi]
call fcn.004f5ce0
mov edi, dword [esi + 8]
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
push ebx
push edi
call fcn.004fa880
push ebx
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
push esi
call fcn.004f68f0
mov eax, dword [esi + 8]
push eax
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [esi + 0xc]
movzx eax, ax
or eax, 0x7000000
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
cmp ebp, 0x200
pop edi
pop ebx
jne 0x4fb4af
push esi
call fcn.004f8740
pop ebp
mov eax, 1
pop esi
add esp, 0x68
ret 0x10
Function at 0x514690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push 0
push ebp
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x5146bb
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop ebp
pop ebx
add esp, 0x10
ret 0x14
push esi
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, ebp
jne 0x514760
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x51474a
mov eax, dword [ebx + 0x44]
test eax, eax
jl 0x51474a
push edi
push ebp
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebx + 0x3c]
mov edi, eax
mov eax, dword [ebx + 0x40]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x44]
xor edx, edx
cmp eax, edx
mov dword [esp + 0x10], ecx
jge 0x5146ff
mov dword [esp + 0x18], edx
jmp 0x514715
mov ecx, dword [ebx + 0x80]
sub ecx, dword [ebx + 0x78]
dec ecx
cmp eax, ecx
mov dword [esp + 0x18], ecx
jg 0x514715
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x48]
cmp eax, edx
jge 0x514722
mov dword [esp + 0x1c], edx
jmp 0x514738
mov ecx, dword [ebx + 0x84]
sub ecx, dword [ebx + 0x7c]
dec ecx
cmp eax, ecx
mov dword [esp + 0x1c], ecx
jg 0x514738
mov dword [esp + 0x1c], eax
lea esi, [esp + 0x10]
call fcn.00511e80
push edi
push ebp
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
mov dword [ebx + 0x50], 0
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
push ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.00513300
mov esi, eax
cmp esi, 0xffffffff
jne 0x514793
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x5147c4
push esi
push ebx
call fcn.00513d30
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x5147c4
movzx ecx, word [ebx + 0x34]
movzx edx, si
shl edx, 0x10
or edx, ecx
push edx
push 0
push 0x612
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x517f60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esi + 4]
test al, 1
jne 0x51812f
test ah, 0x40
jne 0x51812f
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
call ebp
xor ecx, ecx
test ax, ax
setl cl
push 0x11
mov dword [esp + 0x14], ecx
call ebp
xor edx, edx
test ax, ax
setl dl
push 0x12
mov edi, edx
call ebp
test ax, ax
mov eax, dword [esp + 0x10]
jge 0x518095
test eax, eax
fld qword [esi + 0x150]
fld qword [esi + 0x148]
fpatan
fstp qword [esp + 0x14]
fld qword [esi + 0x150]
fld qword [esi + 0x148]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fsqrt
fstp st(2)
fstp st(0)
je 0x517ff0
fstp st(0)
fld qword [0x5d6138]
test edi, edi
je 0x517ffc
fld qword [0x5ebc90]
jmp 0x518002
fld qword [0x5d99c0]
fimul dword [esp + 0x20]
fmul qword [0x5ebc88]
fadd qword [esp + 0x14]
fld st(0)
fcos
fmul st(2)
fcom qword [0x5d92f0]
fst qword [esi + 0x148]
fnstsw ax
test ah, 5
jp 0x518033
fstp st(0)
fld qword [0x5d92f0]
jmp 0x518048
fcom qword [0x5d6138]
fnstsw ax
test ah, 0x41
jne 0x518048
fstp st(0)
fld qword [0x5d6138]
fstp qword [esi + 0x148]
fsin
fmulp st(1)
fcom qword [0x5d92f0]
fst qword [esi + 0x150]
fnstsw ax
test ah, 5
jp 0x518078
fstp st(0)
fld qword [0x5d92f0]
fstp qword [esi + 0x150]
jmp 0x5180fb
fcom qword [0x5d6138]
fnstsw ax
test ah, 0x41
jne 0x51808d
fstp st(0)
fld qword [0x5d6138]
fstp qword [esi + 0x150]
jmp 0x5180fb
test eax, eax
je 0x5180bb
test ebx, ebx
jge 0x5180af
neg edi
sbb edi, edi
and edi, 0xfffffffb
add edi, 0x11
neg ebx
mov dword [esp + 0x20], ebx
jmp 0x5180dc
neg edi
sbb edi, edi
and edi, 0xfffffffa
add edi, 0x10
jmp 0x5180dc
test ebx, ebx
jge 0x5180d2
xor eax, eax
test edi, edi
sete al
neg ebx
mov dword [esp + 0x20], ebx
lea eax, [eax + eax + 0xd]
jmp 0x5180de
neg edi
sbb edi, edi
and edi, 0xfffffffd
add edi, 0xe
mov eax, edi
fild dword [esp + 0x20]
sub esp, 8
mov ecx, esi
fmul qword [0x611d58]
fmul qword [0x5ebc88]
fstp qword [esp]
call fcn.005177c0
push 0x2710
push 1
call fcn.005173d0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x2a4]
mov eax, 1
shl eax, cl
push 0
lea ecx, [esi + 0xc]
dec eax
push eax
mov eax, dword [esi + 0x40]
push ecx
push 5
push edx
push eax
push esi
call dword [esi + 0x2a8]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x519a70
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
cmp dword [ecx + 0x90], 5
jne 0x519ab9
test byte [esp + 0xc], 0xa
jne 0x519a84
xor eax, eax
jmp 0x519a89
mov eax, 1
mov edx, dword [ecx + 4]
shl eax, 9
xor eax, edx
and eax, 0x200
xor edx, eax
mov eax, dword [esp + 8]
mov dword [ecx + 4], edx
mov edx, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, 5
jmp fcn.00519050
ret 0xc
Function at 0x51f8f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
push ebx
mov ebx, dword [esi + 0xa0]
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0xa4]
push 0x11
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x51f924
lea edi, [edi + edi*4]
shl edi, 1
mov eax, dword [esp + 0x14]
cmp eax, 7
ja case.0x51f931.4
jmp dword [eax*4 + 0x51f9ec]
push ebp
push edi
lea eax, [esi + 0x1c]
push eax
push eax
push esi
call fcn.0051f1a0
pop edi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
push ebx
lea eax, [esi + 0x1c]
push eax
push eax
push esi
call fcn.0051f1a0
pop edi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
neg edi
push edi
lea eax, [esi + 0x1c]
push eax
push eax
push esi
call fcn.0051f1a0
pop edi
pop ebp
pop ebx
pop ecx
ret 8
push ebp
neg ebx
push ebx
lea eax, [esi + 0x1c]
push eax
push eax
push esi
call fcn.0051f1a0
pop edi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x18]
push ebp
push edx
lea eax, [esi + 0x1c]
push eax
push esi
call fcn.0051f200
pop edi
pop ebp
pop ebx
pop ecx
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x51f9d4
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x51f9d4
mov eax, dword [esp + 0x18]
test eax, eax
jge 0x51f9d4
push ebp
push 0
lea ecx, [esi + 0x1c]
push ecx
push esi
call fcn.0051f200
pop edi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0xc]
push ebp
push edx
lea eax, [esi + 0x1c]
push eax
push esi
call fcn.0051f200
pop edi
pop ebp
pop ebx
pop ecx
ret 8

Function at 0x51fb70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [eax + 0x10]
push ebp
mov ebp, dword [eax + 0x14]
push esi
mov esi, ecx
test esi, esi
push edi
mov edi, edx
jne 0x51fba1
mov ecx, ebp
sub ecx, ebx
add ecx, 5
mov eax, 0x66666667
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x51fba1
mov esi, 1
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x51fbb3
lea esi, [esi + esi*4]
shl esi, 1
mov eax, dword [esp + 0x14]
cmp eax, 7
ja case.0x51fbbc.4
jmp dword [eax*4 + 0x51fc10]
add edi, esi
jmp case.0x51fbbc.4
add edi, dword [esp + 0x18]
jmp case.0x51fbbc.4
sub edi, esi
jmp case.0x51fbbc.4
sub edi, dword [esp + 0x18]
jmp case.0x51fbbc.4
mov edi, ebx
cmp edi, ebp
mov eax, ebp
jg 0x51fbe1
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x51fc01
test ebp, ebp
jle 0x51fc01
test ebx, ebx
jge 0x51fc01
xor edi, edi
jmp case.0x51fbbc.4
mov edi, ebp
cmp edi, ebx
jge 0x51fbd9
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8