joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513434
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x51352b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x5134fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5134ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
call fcn.00404b64
mov eax, dword [ebp - 4]
call fcn.00513108
mov eax, dword [ebp - 0x14]
push eax
movzx eax, word [ebp - 6]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
jne 0x5134d5
mov ecx, dword [0x717478]
mov dl, 1
mov eax, dword [0x441aa0]
call fcn.0042a5b8
call fcn.00406938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5134f3
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x51374c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x513805
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
je 0x5137d8
mov dx, word [ebp - 0xe]
mov eax, dword [0x4c2c70]
call fcn.004cbf28
test al, al
je 0x5137c3
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0xe]
mov eax, dword [ebp - 8]
call fcn.004cbe08
call fcn.00406a2c
jmp 0x51380c
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_EnumClipboardFormats
mov word [ebp - 0xe], ax
cmp word [ebp - 0xe], 0
jne 0x513780
mov ecx, dword [0x717620]
mov dl, 1
mov eax, dword [0x513010]
call fcn.0042a5b8
call fcn.00406938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51380c
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
mov esp, ebp
pop ebp
ret
Function at 0x513810
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x513870
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513877
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x51387c
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5138dc
push dword fs:[eax]
mov dword fs:[eax], esp
push 3
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
push 9
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov dx, 3
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x64]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5138e3
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x513960
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x5139d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00513108
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 8]
call fcn.004cbef0
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x14], 0
je 0x5139c0
mov eax, dword [ebp - 0x14]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5139dd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret
Function at 0x5139e4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x513a5b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00513108
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x68]
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x14], 0
je 0x513a45
mov eax, dword [ebp - 0x14]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513a62
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x513ac4
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x513b0a
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp - 6]
push eax
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513b11
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x513b18
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov word [ebp - 6], dx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
push ebp
push 0x513b6a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00513108
mov eax, dword [ebp - 0xc]
push eax
movzx eax, word [ebp - 6]
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x513b71
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x14]
ret

Function at 0x51b11c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x51b16d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x51b154
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x51b144
jmp 0x51b16d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x51b155
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x53d5e8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00407340
xor eax, eax
push ebp
push 0x53d751
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x53d724
xor eax, eax
push ebp
push 0x53d71d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x53d641
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x53d6f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x53d6e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x53d69c
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
call fcn.004080c4
mov ecx, dword [ebp - 0x1c]
add ecx, 2
mov edx, dword [ebp - 0x10]
call fcn.00404b64
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0xc]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d6e8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x7173b4]
mov dl, 1
mov eax, dword [0x41d9e4]
call fcn.0042a5b8
call fcn.00406938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53d758
lea eax, [ebp - 8]
call fcn.0040725c
ret

Function at 0x562ea4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00562f74
test eax, eax
je 0x562eeb
push pe_nt_image_headers32
lea eax, [ebp - 0x208]
push eax
mov eax, dword [ebp - 4]
call fcn.00562f74
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
lea edx, [ebp - 0x208]
mov eax, dword [ebp - 8]
call fcn.004073e4
jmp 0x562efb
mov ecx, dword [ebp - 8]
mov edx, 0x562f1c
mov eax, dword [ebp - 4]
call fcn.00562dc4
mov eax, dword [ebp - 4]
add eax, 0x1c
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call fcn.0040763c
mov esp, ebp
pop ebp
ret
Function at 0x5826b0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
mov dword [ebp - 8], edx
mov word [ebp - 2], ax
mov eax, dword [ebp - 8]
call fcn.0040725c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x582717
push pe_nt_image_headers32
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0xc]
inc ebp
hlt
push eax
call sub.user32.dll_GetKeyNameTextW
test eax, eax
je 0x58270f
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x20c]
mov ecx, pe_nt_image_headers32
call fcn.00408170
jmp 0x582717
mov eax, dword [ebp - 8]
call fcn.0040725c
mov esp, ebp
pop ebp
ret
Function at 0x588f30
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5890ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x7128ac], 0
mov word [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dl, 1
mov eax, dword [0x4ba180]
call fcn.004bb2cc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x589083
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.004bb3b4
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov ecx, 0xa
call fcn.00408170
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x5890c4
call fcn.00408320
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
call fcn.004bb640
test al, al
je 0x58906d
lea ecx, [ebp - 4]
mov edx, 0x589138
mov eax, dword [ebp - 0xc]
call fcn.004bbec8
mov edx, 0x8000
mov eax, dword [ebp - 4]
call fcn.0042d16c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x58906d
xor eax, eax
push ebp
push 0x589066
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x589150
mov eax, dword [ebp - 8]
push eax
call fcn.0040fe84
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x58904f
call dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x58904f
mov eax, dword [ebp + 8]
push eax
call fcn.00588ebc
pop ecx
test eax, eax
je 0x589036
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x58903f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and eax, 1
cmp eax, 1
sete byte [0x7128ac]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58906d
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_2
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58908a
mov eax, dword [ebp - 0xc]
call fcn.0040554c
ret

Function at 0x589178
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 1], 0
push 0xa5
mov eax, dword [0x7177a0]
mov eax, dword [eax]
call eax
test ax, ax
jge 0x5891c1
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [0x7128a8]
je 0x5891b9
push ebp
call fcn.00588f30
pop ecx
mov eax, dword [ebp - 8]
mov dword [0x7128a8], eax
mov al, byte [0x7128ac]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop ecx
pop ecx
pop ebp
ret
Function at 0x593994
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov byte [ebp - 6], cl
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xffffffec
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongW
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
cmp byte [ebp - 5], 0
je 0x5939d2
test byte [ebp - 0xa], 4
je 0x5939ef
cmp byte [ebp - 5], 0
jne 0x593ab2
mov eax, dword [ebp - 0xc]
and eax, 0x40000
cmp eax, 0x40000
jne 0x593ab2
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xe], al
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0xd]
or al, byte [ebp - 0xe]
je 0x593a26
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 5], 0
je 0x593a5a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xffffffec
mov eax, dword [ebp - 0xc]
or eax, 0x40000
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [ebp - 0x2c], eax
jmp 0x593a86
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xffffffec
mov eax, dword [ebp - 0xc]
and eax, 0xfffbffff
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x30]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [ebp - 0x3c], eax
mov al, byte [ebp - 6]
and al, byte [ebp - 0xd]
jne 0x593a94
cmp byte [ebp - 0xe], 0
je 0x593ab2
cmp byte [ebp - 0xe], 0
je 0x593aa7
push 6
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
jmp 0x593ab2
push 5
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret

Function at 0x593e20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], al
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
cmp byte [ebp - 1], 0
je 0x593e4b
lea eax, [ebp - 0xc]
push eax
push 0x593ddc
call sub.user32.dll_EnumWindows
jmp 0x593e5f
lea eax, [ebp - 0xc]
push eax
push 0x593db0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
mov al, byte [ebp - 8]
mov byte [ebp - 2], al
mov al, byte [ebp - 2]
mov esp, ebp
pop ebp
ret
Function at 0x59f06c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x59f07e
add esp, 0xfffffff0
call fcn.00405b58
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0045e3c4
mov eax, dword [0x7176c8]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x59f744
mov eax, dword [0x7176e0]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x59f764
mov eax, dword [ebp - 4]
call fcn.0059f794
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov dl, 1
mov eax, dword [0x441f50]
call fcn.0040551c
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x441f50]
call fcn.0040551c
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x441f50]
call fcn.0040551c
mov edx, dword [ebp - 4]
mov dword [edx + 0x5c], eax
mov dl, 1
mov eax, dword [0x441f50]
call fcn.0040551c
mov edx, dword [ebp - 4]
mov dword [edx + 0x60], eax
mov dl, 1
mov eax, dword [0x441f50]
call fcn.0040551c
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x60]
push eax
mov eax, 0x5989cc
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4bfe6c]
call fcn.004c62c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x4bfe6c]
call fcn.004c62c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x4bfe6c]
call fcn.004c62c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dl, 1
mov eax, dword [0x4bfe6c]
call fcn.004c62c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4bfe6c]
call fcn.004c62c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x90], eax
mov eax, dword [ebp - 4]
call fcn.0059ff94
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x59fc98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x59fc98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x59fc98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x8c]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x59fc98
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x59fc98
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x59f258
call fcn.00405bb0
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x59fa0c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc58
push ebx
xor edx, edx
mov dword [ebp - 0x3a8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x59fbd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x59fbb5
mov dl, 1
mov eax, dword [0x4456c4]
call fcn.00454060
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.0040725c
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x59fb9e
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.00503a90
test al, al
je 0x59fb92
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x3a4], eax
mov byte [ebp - 0x3a0], 0
lea ecx, [ebp - 0x3a4]
mov edx, 0x59fbe8
lea eax, [ebp - 0x39c]
call fcn.00424d5c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x59fb92
xor eax, eax
push ebp
push 0x59fb8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], 0x200
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0
push 0
push 0x59fc58
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x59fb74
lea eax, [ebp - 0x3a8]
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408170
mov edx, dword [ebp - 0x3a8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x59fb74
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x31c]
mov ecx, pe_nt_image_headers32
call fcn.00408170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fb92
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x59fa81
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dl, 1
call fcn.00453f9c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x59fbde
lea eax, [ebp - 0x3a8]
call fcn.0040725c
ret