joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475040
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c18]
test eax, eax
je 0x47505b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c18], 0
ret
push 0
push 0x46c6b0
push dword [0x6ccd58]
push 0x77
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c18], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475090
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c00]
test eax, eax
je 0x4750ab
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c00], 0
ret
push 0
push 0x46d920
push dword [0x6ccd58]
push 0x71
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c00], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4750e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c08]
test eax, eax
je 0x4750fb
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c08], 0
ret
push 0
push 0x46dde0
push dword [0x6ccd58]
push 0x73
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c08], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475130
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bf4]
test eax, eax
je 0x47514b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bf4], 0
ret
push 0
push 0x46e750
push dword [0x6ccd58]
push 0x6d
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bf4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475180
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c04]
test eax, eax
je 0x47519b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c04], 0
ret
push 0
push 0x46f050
push dword [0x6ccd58]
push 0x72
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c04], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4751d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bdc]
test eax, eax
je 0x4751eb
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bdc], 0
ret
push 0
push 0x46f650
push dword [0x6ccd58]
push 0x7b
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bdc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475300
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bf0]
test eax, eax
je 0x475325
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bf0], 0
mov dword [0x58b104], 0
ret
push 0
push fcn.0046fd00
push dword [0x6ccd58]
push 0x6c
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bf0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [0xaf4be4]
call fcn.004713b0
add esp, 8
ret
Function at 0x475570
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c10]
test eax, eax
je 0x47558b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c10], 0
ret
push 0
push 0x473760
push dword [0x6ccd58]
push 0x7a
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c10], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4755c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4be0]
test eax, eax
je 0x4755db
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4be0], 0
ret
push 0
push 0x473990
push dword [0x6ccd58]
push 0x67
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4be0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475610
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c1c]
test eax, eax
je 0x47562b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c1c], 0
ret
push 0
push 0x473ba0
push dword [0x6ccd58]
push 0x78
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c1c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475660
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bfc]
test eax, eax
je 0x47567b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bfc], 0
ret
push 0
push 0x474170
push dword [0x6ccd58]
push 0x70
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bfc], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x4756b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bf8]
test eax, eax
je 0x4756cb
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bf8], 0
ret
push 0
push 0x4745c0
push dword [0x6ccd58]
push 0x6f
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bf8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475700
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4c14]
test eax, eax
je 0x47571b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4c14], 0
ret
push 0
push 0x474c30
push dword [0x6ccd58]
push 0x76
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4c14], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret

Function at 0x475750
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0xaf4bec]
test eax, eax
je 0x47576b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0xaf4bec], 0
ret
push 0
push 0x4757a0
push dword [0x6ccd58]
push 0x6b
push dword [0x6ccd5c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0xaf4bec], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4770d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push dword [0xaf4bd4]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0x10]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x477136
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x477106
mov esi, dword [esi]
inc eax
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.004e53a0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
ret

Function at 0x4776f0
Capabilities:
Hide graphical window

Disassembly:
mov ax, word [esp + 4]
push esi
xor esi, esi
test ax, ax
je 0x477722
mov ecx, 0x7d0
cmp ax, cx
jae 0x477722
movzx eax, ax
mov eax, dword [eax*4 + 0x5c4ea4]
test eax, eax
je 0x477722
test byte [eax + 0x11], 1
jne 0x477722
cmp byte [eax + 0x31], 0
cmovne esi, eax
call fcn.00477860
test eax, eax
je 0x4777c6
test esi, esi
je 0x4777c6
cmp word [esi + 0x38], 0
jle 0x4777c6
mov al, byte [esi + 0x31]
cmp al, 6
je 0x477780
cmp al, 0xa
je 0x47775c
cmp dword [0xaf4be4], 0
jne 0x4777c6
pop esi
jmp fcn.004753f0
cmp byte [esi + 0x32], 0x14
je 0x477771
cmp dword [0xaf4be4], 0
jne 0x4777c6
pop esi
jmp fcn.004753f0
cmp dword [0xaf4cd8], 0
jne 0x4777c6
pop esi
jmp fcn.00475360
movzx eax, byte [esi + 0x32]
sub eax, 2
je 0x4777a9
sub eax, 4
jne 0x4777c6
cmp dword [0xaf4bec], eax
je 0x4777a3
cmp dword [0xaf4be4], eax
jne 0x4777a3
call fcn.004753f0
pop esi
jmp fcn.004731e0
cmp dword [0xaf4bf4], 0
je 0x4777c0
cmp dword [0xaf4be4], 0
jne 0x4777c0
call fcn.004753f0
pop esi
jmp fcn.00473130
pop esi
ret

Function at 0x4790b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x479133
cmp byte [esi + 0x3d], 0
je 0x479133
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4790fb
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x479103
sub eax, 1
je 0x479107
sub eax, 2
je 0x479133
pop edi
xor al, al
pop esi
add esp, 0x24
ret
mov byte [esi + 0x3d], 0
mov edi, dword [esp + 8]
lea eax, [esp + 0xc]
sub edi, eax
je 0x479126
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00512786
add esp, 0x10
cmp edi, eax
jne 0x4790fb
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
add esp, 0x24
ret
pop edi
mov al, 1
pop esi
add esp, 0x24
ret
Function at 0x47a810
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x47a82a
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x47a85c
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x47a85c
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x28
ret 4
cmp dword [esi + 0x4c], 0
je 0x47a93b
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x47a884
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47a8ad
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00511cf1
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x28
ret 4
mov byte [esp + 0xc], bl
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x40]
push eax
call edx
test eax, eax
js 0x47a93b
cmp eax, 1
jle 0x47a90a
cmp eax, 3
jne 0x47a93b
push dword [esi + 0x4c]
push dword [esp + 0x10]
call fcn.00469d60
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
add esp, 0x28
ret 4
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x14]
sub edi, eax
je 0x47a929
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00512786
add esp, 0x10
cmp edi, eax
jne 0x47a93b
lea eax, [esp + 0xc]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x10], eax
jne 0x47a851
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x28
ret 4
Function at 0x47b3a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x38], 0
je 0x47b47d
mov edx, dword [esp + 0x24]
mov ebx, edx
mov ecx, dword [esp + 0x20]
mov edi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
test edx, edx
jl 0x47b46d
jg 0x47b3e0
test ecx, ecx
je 0x47b46d
nop dword [eax]
mov ecx, ebp
call fcn.00479140
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x47b431
jg 0x47b3f9
test esi, esi
je 0x47b431
cmp ebx, eax
jg 0x47b409
jl 0x47b403
cmp edi, esi
jae 0x47b409
mov esi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebp + 0x1c]
push esi
push dword [eax]
push dword [esp + 0x24]
call fcn.004e53a0
mov eax, dword [ebp + 0x2c]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebp + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x1c]
jmp 0x47b451
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x47b465
mov eax, dword [esp + 0x1c]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
mov byte [eax], cl
add eax, esi
mov dword [esp + 0x1c], eax
test ebx, ebx
jg 0x47b3e0
jl 0x47b465
test edi, edi
jne 0x47b3e0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub ecx, edi
pop edi
pop esi
pop ebp
sbb edx, ebx
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], esi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x47b49d
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
jmp 0x47b49f
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x47b541
jg 0x47b4ba
test esi, esi
je 0x47b541
test eax, eax
jl 0x47b4f6
jg 0x47b4c4
test ebx, ebx
je 0x47b4f6
cmp edi, eax
jg 0x47b4d4
jl 0x47b4ce
cmp esi, ebx
jae 0x47b4d4
mov ebx, esi
mov dword [esp + 0x20], edi
push ebx
push ecx
push dword [esp + 0x24]
call fcn.004e53a0
mov eax, dword [ebp + 0x2c]
add esp, 0xc
add dword [esp + 0x1c], ebx
sub esi, ebx
sbb edi, dword [esp + 0x20]
sub dword [eax], ebx
mov eax, dword [ebp + 0x1c]
add dword [eax], ebx
mov ebx, dword [esp + 0x1c]
test edi, edi
jl 0x47b541
jg 0x47b504
test esi, esi
je 0x47b541
mov ecx, dword [ebp + 0x4c]
test ecx, ecx
je 0x47b541
mov edx, dword [ebp + 0xc]
lea eax, [ebp + 0x3c]
cmp dword [edx], eax
jne 0x47b52f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x50]
mov edx, dword [ebp + 0x54]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x2c]
mov dword [eax], edx
mov ecx, dword [ebp + 0x4c]
push ecx
push esi
push 1
push ebx
call fcn.00512038
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x47b640
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp + 0x38], 0
je 0x47b716
mov edx, dword [esp + 0x24]
mov ebx, edx
mov ecx, dword [esp + 0x20]
mov edi, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
test edx, edx
jl 0x47b706
jg 0x47b680
test ecx, ecx
je 0x47b706
nop dword [eax]
mov ecx, ebp
call fcn.00479360
mov esi, eax
mov eax, edx
mov dword [esp + 0x10], eax
test eax, eax
jl 0x47b6ce
jg 0x47b699
test esi, esi
je 0x47b6ce
cmp ebx, eax
jg 0x47b6a9
jl 0x47b6a3
cmp edi, esi
jae 0x47b6a9
mov esi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x1c]
push esi
push eax
mov eax, dword [ebp + 0x20]
push dword [eax]
call fcn.004e53a0
mov eax, dword [ebp + 0x30]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x10]
sub dword [eax], esi
mov eax, dword [ebp + 0x20]
add dword [eax], esi
jmp 0x47b6f0
mov eax, dword [ebp]
mov ecx, ebp
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax]
push eax
call edx
cmp eax, 0xffffffff
je 0x47b6fe
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x1c], esi
test ebx, ebx
jg 0x47b680
jl 0x47b6fe
test edi, edi
jne 0x47b680
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub ecx, edi
pop edi
pop esi
pop ebp
sbb edx, ebx
mov eax, ecx
pop ebx
add esp, 8
ret 0xc
mov eax, dword [ebp + 0x20]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x10], esi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x47b736
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
jmp 0x47b738
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x20], eax
test edi, edi
jl 0x47b7b2
jg 0x47b74b
test esi, esi
je 0x47b7b2
test eax, eax
jl 0x47b78b
jg 0x47b755
test ebx, ebx
je 0x47b78b
cmp edi, eax
jg 0x47b765
jl 0x47b75f
cmp esi, ebx
jae 0x47b765
mov ebx, esi
mov dword [esp + 0x20], edi
push ebx
push dword [esp + 0x20]
push ecx
call fcn.004e53a0
mov ecx, dword [esp + 0x28]
add esp, 0xc
mov eax, dword [ebp + 0x30]
add ecx, ebx
sub esi, ebx
sbb edi, dword [esp + 0x20]
sub dword [eax], ebx
mov eax, dword [ebp + 0x20]
add dword [eax], ebx
jmp 0x47b78f
mov ecx, dword [esp + 0x1c]
test edi, edi
jl 0x47b7b2
jg 0x47b799
test esi, esi
je 0x47b7b2
mov eax, dword [ebp + 0x4c]
test eax, eax
je 0x47b7b2
push eax
push esi
push 1
push ecx
call fcn.00512786
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x493e10
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
push 0xff
mov esi, ecx
call fcn.004e3749
push 0xff
mov edi, eax
push 0
push edi
call fcn.004e4d50
add esp, 0x10
push esi
push 0xff
push edi
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0xc]
push edi
call fcn.00446ef0
push edi
call fcn.004e3752
mov eax, dword [esp + 0x10]
add esp, 4
pop edi
pop esi
ret 0x10
Function at 0x49c160
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540be2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyboardType]
mov esi, 0x14
push 0
call edi
cmp eax, 7
jne 0x49c1af
push 1
call edi
and eax, 0xff00
mov esi, 9
cmp eax, 0xd00
mov ecx, 0x14
cmovne esi, ecx
jmp case.0x49c1dc.8
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx eax, ax
mov ecx, eax
shr ax, 0xa
and ecx, 0x3ff
movzx edx, ax
lea eax, [ecx - 7]
cmp eax, 0x16
ja case.0x49c1dc.8
movzx eax, byte [eax + 0x49c304]
jmp dword [eax*4 + 0x49c2dc]
xor esi, esi
mov eax, 0xb
cmp edx, 2
cmovne esi, eax
jmp case.0x49c1dc.8
mov eax, edx
sub eax, 1
jne case.0x49c1dc.8
lea esi, [eax + 0x15]
jmp case.0x49c1dc.8
mov esi, 0x12
jmp case.0x49c1dc.8
mov eax, edx
mov esi, 5
sub eax, 2
je 0x49c227
sub eax, 1
je 0x49c220
sub eax, 1
jne case.0x49c1dc.8
lea esi, [eax + 0x13]
jmp case.0x49c1dc.8
mov esi, 1
jmp case.0x49c1dc.8
xor esi, esi
jmp case.0x49c1dc.8
mov eax, edx
mov esi, 6
sub eax, 2
jne case.0x49c1dc.8
lea esi, [eax + 0x13]
jmp case.0x49c1dc.8
cmp edx, 2
mov esi, 0x13
mov eax, 8
cmovne esi, eax
jmp case.0x49c1dc.8
mov esi, 0xd
jmp case.0x49c1dc.8
mov esi, 0xf
jmp case.0x49c1dc.8
mov esi, 0x11
mov edi, dword [0xc27e7c]
test edi, edi
je 0x49c280
mov ecx, edi
call fcn.0049bc40
push 0x378
push edi
call fcn.004e373b
add esp, 8
push 0x378
mov dword [0xc27e7c], 0
call fcn.004e370b
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x49c2ba
push dword [esi*4 + 0x58b738]
mov ecx, eax
call fcn.0049bbb0
mov dword [0xc27e7c], eax
jmp 0x49c2c4
mov dword [0xc27e7c], 0
mov ecx, dword [ebp - 0xc]
mov dword [0x5cea21], esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4ae270
Capabilities:
Terminate process

Disassembly:
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push 0xffffffffffffffff
push 0x200
push 0xc6d820
call fcn.004af440
add esp, 0x14
push 0x10
push 0x55ab94
push 0xc6d820
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004af070
push 1
call fcn.00516695
int3

Function at 0x4ae2b0
Capabilities:
Terminate process

Disassembly:
lea eax, [esp + 0xc]
push eax
push 0
push dword [esp + 0x10]
push 0xffffffffffffffff
push 0x200
push 0xc6d820
call fcn.0043fb30
push dword [eax + 4]
push dword [eax]
call fcn.00501ac3
add esp, 0x20
push 0x30
push 0x55ab94
push 0xc6d820
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 4], 0
jne 0x4ae2f5
ret
call fcn.004af070
push 1
call fcn.00516695
int3

Function at 0x4ae6c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x100
lea eax, [esp + 0x80]
push esi
mov esi, dword [esp + 0x108]
push eax
push esi
call fcn.004ae7c0
movsx eax, si
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x14]
push str.ERROR_:::__s__ID:__i__n
push eax
call fcn.0043fb40
lea eax, [esp + 0x1c]
push eax
call fcn.00453cd0
add esp, 0x1c
lea eax, [esp + 4]
push 0
push 0x55ab94
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004af070
push 1
call fcn.00516695
pop esi
int3
Function at 0x4bec40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x540d10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004e370b
mov edi, eax
add esp, 4
test edi, edi
je 0x4bec8c
push 1
mov dword [ebp - 4], 0
call fcn.004c6fcb
add esp, 4
mov dword [edi + 4], eax
jmp 0x4bec8e
xor edi, edi
lea eax, [esi + 4]
mov dword [esi + 0x34], edi
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
lea eax, [esi + 0x14]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov ecx, esi
mov eax, dword [esi + 0x20]
push 0
push dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
call fcn.00479170
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c0390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x540db8
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004e370b
mov edi, eax
add esp, 4
test edi, edi
je 0x4c0422
push 1
mov dword [ebp - 4], 0
call fcn.004c6fcb
add esp, 4
mov dword [edi + 4], eax
jmp 0x4c0424
xor edi, edi
mov eax, dword [ebp + 8]
push ebx
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.004bead0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x20]
mov ecx, eax
call edx
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x4c0489
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x4c0489
mov ecx, dword [eax]
push 1
mov edx, dword [ecx]
mov ecx, eax
call edx
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], bl
mov dword [ebp - 4], 0xffffffff
pop ebx
jne 0x4c04aa
mov eax, dword [esi + 0xc]
mov ecx, esi
push 0
or eax, 4
push eax
call fcn.00479620
cmp byte [ebp + 0xc], 0
je 0x4c04b9
push esi
call fcn.004c82d1
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c0580
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push 0x563ce4
push dword [esp + 0x14]
call fcn.00510009
mov esi, eax
add esp, 8
test esi, esi
je 0x4c0602
push esi
push 5
lea eax, [esp + 0xc]
push 1
push eax
call fcn.00512038
add esp, 0x10
cmp eax, 5
jne 0x4c05f9
mov ecx, str.LEVL3
lea eax, [esp + 4]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c05e0
test dl, dl
je 0x4c05dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c05e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c05c0
xor eax, eax
jmp 0x4c05e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c05f9
push esi
call fcn.0050fcc7
add esp, 4
mov al, 1
pop esi
add esp, 8
ret
push esi
call fcn.0050fcc7
add esp, 4
xor al, al
pop esi
add esp, 8
ret
Function at 0x52a953
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052a54b

Function at 0x52a95e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052a6d5

Function at 0x5322ca
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00531c88

Function at 0x5326dc
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005325b0