joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53c420
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov byte [esp + 0xb], 0
push edi
test esi, esi
jne 0x53c4b4
test ecx, ecx
jne 0x53c46f
mov eax, 0xc0000030
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
push 0
push 0x60
push 1
push 5
push 0x80
push 0
push 0x100081
push ecx
lea eax, [esp + 0x44]
push eax
call sym.SystemInformer.exe_Ordinal_1469
test eax, eax
jns 0x53c4ab
lfence
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x24]
mov byte [esp + 0xf], 1
push 5
push 0x18
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
js 0x53c5aa
movq xmm0, qword [esp + 0x60]
lea eax, [esp + 0x18]
movaps xmm1, xmmword [esp + 0x50]
push esi
push 0x8000000
push 2
push eax
lea eax, [esp + 0x48]
movq qword [esp + 0x70], xmm0
push eax
movaps xmm0, xmm1
mov dword [esp + 0x4c], 0x18
push 5
lea eax, [esp + 0x28]
psrldq xmm0, 8
psrldq xmm1, 0xc
push eax
movd dword [esp + 0x34], xmm0
movd dword [esp + 0x38], xmm1
mov dword [esp + 0x58], 0
mov dword [esp + 0x60], 0x20
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x53c5aa
mov eax, dword ds:[esp + 0x18]
push 2
push 0
push 2
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x53c5aa
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
cmp byte [esp + 0xf], 0
je 0x53c5b8
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
Function at 0x53c5e0
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 8]
push esi
mov esi, edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x30], eax
mov byte [esp + 0xb], 0
push edi
test esi, esi
jne 0x53c66d
test ecx, ecx
jne 0x53c62f
mov eax, 0xc0000030
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
push 0x60
push 1
push 5
push 0x80
push 0x100081
push ecx
lea eax, [esp + 0x3c]
push eax
call sym.SystemInformer.exe_Ordinal_1467
test eax, eax
jns 0x53c664
lfence
pop edi
pop esi
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
mov esi, dword [esp + 0x24]
mov byte [esp + 0xf], 1
push 5
push 0x18
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov edi, eax
test edi, edi
js 0x53c76a
movq xmm0, qword [esp + 0x60]
lea eax, [esp + 0x18]
movaps xmm1, xmmword [esp + 0x50]
push esi
push 0x8000000
push 2
push eax
lea eax, [esp + 0x48]
movq qword [esp + 0x70], xmm0
push eax
movaps xmm0, xmm1
mov dword [esp + 0x4c], 0x18
push 5
lea eax, [esp + 0x28]
psrldq xmm0, 8
psrldq xmm1, 0xc
push eax
movd dword [esp + 0x34], xmm0
movd dword [esp + 0x38], xmm1
mov dword [esp + 0x58], 0
mov dword [esp + 0x60], 0x20
mov dword [esp + 0x5c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
call dword [sym.imp.ntdll.dll_NtCreateSection]
mov edi, eax
test edi, edi
js 0x53c76a
mov eax, dword ds:[esp + 0x18]
push 2
push 0
push 2
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push 0xffffffffffffffff
push dword [esp + 0x34]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
js 0x53c76a
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [ecx], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
cmp byte [esp + 0xf], 0
je 0x53c778
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x7c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 8
Function at 0x53ca60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ecx
mov eax, dword [esp + 8]
mov dword [esp], ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, edx
mov dword [ebx + 4], esi
mov dword [ebx + 8], eax
cmp eax, 0x1000
jae 0x53ca88
pop esi
mov eax, 0xc0000017
pop ebx
pop ecx
ret 0xc
test esi, esi
je 0x53cc10
cmp esi, 0xffffffff
je 0x53cc10
push ebp
push edi
push 0x1000
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x1000
mov edi, eax
push 0
push edi
call fcn.005861d0
mov ebp, dword [esp + 0x28]
add esp, 0xc
push 0
push 0x1000
push edi
push esi
push dword [esp + 0x20]
test ebp, ebp
je 0x53cae2
mov ecx, ebp
call dword [0x5a9914]
call ebp
nop
jmp 0x53cae8
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov esi, eax
lfence
test esi, esi
js 0x53cc06
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x53cbed
mov ebp, dword [edi + 0x3c]
test ebp, ebp
je 0x53cbed
cmp ebp, dword [esp + 0x18]
jae 0x53cbed
nop
cmp ebp, 0x10000000
jae 0x53cbed
lea eax, [ebp + 0xf8]
cmp eax, 0x1000
jb 0x53cb45
mov esi, 0xc0000017
jmp 0x53cbf2
cmp dword [edi + ebp], 0x4550
lea edx, [edi + ebp]
je 0x53cb5b
mov esi, 0xc000007b
jmp 0x53cbf2
movzx eax, word [edx + 0x14]
mov ecx, 0xe0
cmp ax, cx
je 0x53cb7a
mov ecx, 0xf0
cmp ax, cx
je 0x53cb7a
mov esi, 0xc0000903
jmp 0x53cbf2
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
mov word [ebx + 0x18], ax
cmp ax, cx
je 0x53cb96
mov ecx, 0x20b
cmp ax, cx
jne 0x53cb51
movzx eax, word ds:[edx + 6]
mov dword [ebx + 0x10], eax
cmp eax, 0x7f
jae 0x53cb51
lea ecx, ds:[eax + eax*4]
movzx eax, word [edx + 0x14]
add eax, ebp
lea eax, [eax + ecx*8]
add eax, 0x110
cmp eax, 0x1000
jae 0x53cb39
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov dword [ebx + 0xc], edx
movzx eax, word [edx + 0x14]
add eax, 0x18
mov dword [ebx + 0x1c], edi
add eax, edx
mov dword [ebx + 0x14], eax
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0xc
mov esi, 0xc000012f
push edi
push 0
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
pop ecx
ret 0xc
pop esi
mov eax, 0xc000000d
pop ebx
pop ecx
ret 0xc
Function at 0x53cc20
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x148
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x144], eax
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [esp + 0x160]
mov ebp, ecx
push edi
push esi
push ebx
push dword [esp + 0x164]
mov edi, edx
call fcn.0053ca60
nop dword [eax + eax]
test eax, eax
jns 0x53ce67
cmp eax, 0xc0000017
jne 0x53ce67
mov eax, dword [esp + 0x15c]
mov dword [esi + 4], edi
mov dword [esi + 8], eax
cmp eax, 0x40
jb 0x53ce62
test edi, edi
je 0x53ce59
cmp edi, 0xffffffff
je 0x53ce59
lea eax, [esp + 0x18]
push 0
push 0x40
push eax
push edi
lfence
push ebp
test ebx, ebx
je 0x53ccb8
mov ecx, ebx
call dword [0x5a9914]
call ebx
jmp 0x53ccbe
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
nop
test eax, eax
jns 0x53cccc
lfence
jmp 0x53ce67
mov eax, 0x5a4d
cmp word [esp + 0x18], ax
je 0x53cce5
mov eax, 0xc000012f
jmp 0x53ce67
mov eax, dword [esp + 0x54]
test eax, eax
je 0x53ce62
cmp eax, dword [esp + 0x15c]
jae 0x53ce62
nop
cmp eax, 0x10000000
jae 0x53ce62
push 0
push 0xf8
add eax, edi
lea ecx, [esp + 0x60]
mov dword [esp + 0x18], eax
push ecx
push eax
lfence
push ebp
test ebx, ebx
je 0x53cd32
mov ecx, ebx
call dword [0x5a9914]
call ebx
jmp 0x53cd38
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x53ccc4
cmp dword [esp + 0x58], 0x4550
jne 0x53ce62
mov dx, word [esp + 0x6c]
mov eax, 0xe0
cmp dx, ax
je 0x53cd6f
mov eax, 0xf0
cmp dx, ax
je 0x53cd6f
mov eax, 0xc0000903
jmp 0x53ce67
mov ax, word ds:[esp + 0x70]
mov ecx, 0x10b
mov word [esi + 0x18], ax
cmp ax, cx
je 0x53cd93
mov ecx, 0x20b
cmp ax, cx
jne 0x53ce62
movzx eax, word ds:[esp + 0x5e]
mov dword [esi + 0x10], eax
cmp eax, 0x7f
jae 0x53ce62
lea edi, ds:[eax + eax*4]
movzx eax, dx
lea edi, [edi + 3]
lea edi, [eax + edi*8]
cmp edi, 0x100000
ja 0x53ce62
push edi
push 4
lfence
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push edi
push 0
push eax
mov dword [esp + 0x20], eax
call fcn.005861d0
mov eax, dword [esp + 0x20]
add esp, 0xc
mov dword [esi + 0xc], eax
lfence
push 0
push edi
test ebx, ebx
je 0x53ce13
push dword [esi + 0xc]
mov ecx, ebx
push dword [esp + 0x1c]
push ebp
call dword [0x5a9914]
call ebx
jmp 0x53ce1f
push eax
push dword [esp + 0x1c]
push ebp
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov edi, eax
lfence
test edi, edi
jns 0x53ce44
push dword [esi + 0xc]
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esi + 0xc], 0
mov eax, edi
jmp 0x53ce67
mov ecx, dword [esi + 0xc]
mov dword [esi], ebp
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
jmp 0x53ce67
mov eax, 0xc000000d
jmp 0x53ce67
mov eax, 0xc000007b
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x148
ret 0xc
Function at 0x542780
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 8
push ebx
push ecx
mov ebx, edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x54296a
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [ebx + 0x18]
mov esi, dword [ebx + 0x1c]
cmp ecx, esi
jle 0x5427b4
mov eax, esi
mov dword [ebx + 0x1c], ecx
mov esi, ecx
mov dword [ebx + 0x18], eax
mov ecx, eax
sub esi, ecx
cmp dword [ebx + 0x14], 1
push esi
push 0x42
je 0x54288c
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x54295d
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebx + 0x18]
add ecx, dword [ebx]
push esi
push ecx
push eax
call fcn.00586330
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esi + esi*2]
lea eax, [eax*2 + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x14], eax
test eax, eax
je 0x542886
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
mov edx, eax
test esi, esi
je 0x54286d
lea ebp, [edi + 0x20]
nop word [eax + eax]
mov ecx, dword [ebx + 0x18]
add ecx, dword [ebx]
movzx eax, byte [ecx + edi]
shr eax, 4
movsx eax, byte [eax + 0x61f470]
mov word [edx], ax
mov eax, dword [ebx + 0x18]
add eax, dword [ebx]
movzx eax, byte [eax + edi]
inc edi
and eax, 0xf
movsx eax, byte [eax + 0x61f470]
mov word [edx + 2], ax
mov word [edx + 4], bp
add edx, 6
cmp edi, esi
jb 0x542830
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
xor eax, eax
push esi
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebp
jmp 0x54294b
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, ds:[esi + 1]
mov edi, eax
push ecx
push 0x42
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test edi, edi
je 0x54295d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword ds:[ebx + 0x18]
add ecx, dword [ebx]
push esi
push ecx
push eax
call fcn.00586330
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebp, ebp
je 0x54294a
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebx + 0x18]
mov edi, eax
add ecx, dword [ebx]
push esi
push ecx
push edi
call fcn.00586330
add esp, 0xc
test esi, esi
je 0x54292d
mov ecx, 0x5e
cmp byte ds:[ebx + 0x28], 0
mov al, byte [edi]
movzx eax, al
jge 0x542917
push 0x117
push eax
call fcn.0058e7bb
add esp, 8
mov ecx, 0x5e
jmp 0x54291f
sub eax, 0x20
cmp ecx, eax
sbb eax, eax
inc eax
nop
test eax, eax
jne 0x542927
mov byte [edi], 0x2e
inc edi
sub esi, 1
jne 0x5428f5
push ebp
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, dword [esp + 0x14]
push edi
push str.BinaryData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
add esp, 8
ret
Function at 0x542980
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, edx
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x542ab6
push str.BinaryData
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
jne 0x5429c8
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebp, eax
test ebp, ebp
je 0x542aa9
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [edi + 0x18]
mov ebx, eax
mov edx, dword [edi + 0x1c]
mov esi, ecx
mov eax, dword [edi + 0x10]
mov dword [esp + 0x18], eax
cmp ecx, edx
jle 0x5429f9
mov esi, edx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], esi
mov edx, ecx
test byte [edi + 0x28], 0x10
je 0x542a56
nop
cmp esi, 0xffffffff
jne 0x542a27
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x542a13
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
mov ecx, dword ds:[esp + 0x10]
mov edx, edi
push ebx
push esi
call fcn.00542ba0
jmp 0x542a73
mov ecx, dword [esp + 0x10]
push edx
push esi
mov edx, edi
call fcn.00542ac0
mov ecx, dword ds:[esp + 0x10]
mov edx, edi
push ebx
push esi
call fcn.00542ba0
mov ecx, dword [esp + 0x10]
mov edx, edi
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00542600
jmp 0x542a73
cmp esi, 0xffffffff
jne 0x542a69
cmp dword [edi + 0x14], 3
mov esi, eax
jne 0x542a69
lea esi, [eax + 1]
mov dword [edi + 0x10], esi
mov eax, dword [edi + 4]
sub eax, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword ds:[edi]
push ebx
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.00586330
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x18]
push 0x105
push 0
push 0
push dword [esp + 0x1c]
mov dword [edi + 0x10], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x546420
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x60
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0
lea eax, [esp + 0x14]
mov edi, ecx
push eax
push edi
mov esi, edx
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x5465f1
mov eax, dword ds:[esp + 0x1c]
or eax, dword [esp + 0x14]
or eax, dword [esp + 0x18]
or eax, dword [esp + 0x10]
je 0x5465f1
cmp dword [esi + 0x1c4], 0
jg 0x5464cd
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov eax, dword [esi + 0x1c8]
test eax, eax
jne 0x54649b
mov dword [esi + 0x1c8], ebx
jmp 0x5464ad
push 2
push ebx
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
nop dword [eax]
test eax, eax
je 0x5465f1
jmp 0x5465e5
test dword [esi + 0x20], 0x200000
je 0x54656c
cmp dword [esi + 0x184], 0
jne 0x54656c
push dword [esi]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x54656c
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esi + 0x184], eax
test eax, eax
je 0x54656c
movups xmm0, xmmword [esi + 0x38]
movups xmmword [esi + 0x190], xmm0
mov eax, dword [esi + 0x198]
push dword [esi + 0x19c]
inc eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x18c], eax
test eax, eax
jne 0x546548
push dword [esi + 0x184]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x184], 0
jmp 0x54656c
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword ds:[esi + 0x18c]
push dword [esi + 0x184]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x188], eax
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov ebx, eax
test ebx, ebx
je 0x5465f1
movups xmm0, xmmword [esp + 0x28]
mov eax, dword [esi + 0x184]
mov edx, esi
movups xmmword [esp + 0x10], xmm0
test eax, eax
je 0x5465d3
lea ecx, ds:[esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0054bbc0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push 0xcc0020
push edx
push ecx
push dword [esi + 0x184]
sub eax, edx
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
push eax
push edx
push ecx
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x5465e5
lea eax, ds:[esp + 0x10]
mov ecx, edi
push eax
push ebx
call fcn.0054bbc0
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x60
ret
Function at 0x54ad20
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad69
cmp ebx, 0x28
je 0x54ad69
nop
cmp ebx, 0x24
je 0x54ad69
cmp ebx, 0x23
je 0x54ad69
cmp ebx, 0x21
je 0x54ad69
cmp ebx, 0x22
je 0x54ad69
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af2c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad89.36
jmp dword [eax*4 + 0x54af44]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad89.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad89.36
dec esi
jmp 0x54ae2b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad89.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54ae1e
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54adc9
mov esi, dword [esi + 0x20]
jmp 0x54adcb
xor esi, esi
test byte [edi + 0x20], 8
je 0x54add6
mov edx, dword [edi + 0x54]
jmp 0x54add8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af2c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af2c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54ae0b
cmp esi, edx
jbe 0x54ae03
mov esi, edx
jmp 0x54ae2b
cmp esi, eax
jb case.0x54ad89.36
sub esi, eax
jmp 0x54ae2b
add edx, eax
cmp edx, ecx
jb 0x54ae14
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54ae1c
mov esi, edx
jmp 0x54ae2b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae2b
lea esi, [ecx - 1]
jmp 0x54ae2b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a4a0
shr bx, 0xf
test bl, bl
je 0x54ae9d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae9d
cmp esi, eax
jbe 0x54ae8c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54aebc
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54aebc
cmp byte [esp + 0xc], 0
jne 0x54aeee
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a320
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a040
test al, al
je 0x54aeee
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a680
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af2c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
Function at 0x54ad90
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x26
je 0x54ad69
cmp ebx, 0x28
je 0x54ad69
nop
cmp ebx, 0x24
je 0x54ad69
cmp ebx, 0x23
je 0x54ad69
cmp ebx, 0x21
je 0x54ad69
cmp ebx, 0x22
je 0x54ad69
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret
mov eax, dword [edi + 0xd4]
mov ecx, dword [eax]
test ecx, ecx
je 0x54af2c
lea eax, ds:[ebx - 0x21]
cmp eax, 7
ja case.0x54ad89.36
jmp dword [eax*4 + 0x54af44]
mov eax, dword [edi + 0x6c]
test eax, eax
je case.0x54ad89.36
mov esi, dword ds:[eax + 0x20]
test esi, esi
je case.0x54ad89.36
dec esi
jmp 0x54ae2b
mov esi, dword [edi + 0x6c]
test esi, esi
je case.0x54ad89.36
mov esi, dword [esi + 0x20]
inc esi
jmp 0x54ae1e
mov esi, dword ds:[edi + 0x6c]
test esi, esi
je 0x54adc9
mov esi, dword [esi + 0x20]
jmp 0x54adcb
xor esi, esi
test byte [edi + 0x20], 8
je 0x54add6
mov edx, dword [edi + 0x54]
jmp 0x54add8
xor edx, edx
mov eax, dword [edi + 0x44]
sub eax, dword [edi + 0x48]
sub eax, edx
js 0x54af2c
cdq
idiv dword [edi + 0x4c]
sub eax, 1
js 0x54af2c
mov edx, dword [edi + 0x58]
cmp ebx, 0x21
jne 0x54ae0b
cmp esi, edx
jbe 0x54ae03
mov esi, edx
jmp 0x54ae2b
cmp esi, eax
jb case.0x54ad89.36
sub esi, eax
jmp 0x54ae2b
add edx, eax
cmp edx, ecx
jb 0x54ae14
lea edx, [ecx - 1]
cmp esi, edx
jae 0x54ae1c
mov esi, edx
jmp 0x54ae2b
add esi, eax
nop
cmp esi, ecx
jb 0x54ae2b
lea esi, [ecx - 1]
jmp 0x54ae2b
xor esi, esi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
push 0x10
mov word [esp + 0x10], ax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword ds:[edi + 0xd4]
mov bx, ax
push 0
mov ecx, dword [ecx + 8]
mov edx, dword [ecx + esi*4]
mov ecx, edi
mov dword [edi + 0x6c], edx
call fcn.0054a4a0
shr bx, 0xf
test bl, bl
je 0x54ae9d
mov eax, dword [edi + 0x74]
cmp eax, 0xffffffff
je 0x54ae9d
cmp esi, eax
jbe 0x54ae8c
lea ecx, [esp + 0xc]
mov edx, eax
push ecx
lea ecx, [esp + 0x14]
mov eax, esi
push ecx
push 4
push eax
jmp 0x54aebc
lea ecx, [esp + 0xc]
mov edx, esi
push ecx
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
jmp 0x54aebc
cmp byte [esp + 0xc], 0
jne 0x54aeee
mov eax, dword [edi + 0x6c]
mov edx, esi
mov eax, dword [eax + 0x20]
mov dword [edi + 0x74], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push 4
push esi
mov ecx, edi
call fcn.0054a320
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 1
push dword [esp + 0x14]
mov ecx, edi
call fcn.0054a040
test al, al
je 0x54aeee
push 0
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, esi
mov ecx, edi
call fcn.0054a680
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x54af2c
push 0
push 0
push 0x41c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0xf8], 0xffffffff
mov dword [edi + 0xfc], 0xffffffff
mov dword [edi + 0x11c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
add esp, 0x20
ret