joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6783fde0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x67982e99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CWnd::CWnd
lea edi, [esi + 0x40]
mov dword [esp + 0x18], 0
mov ecx, edi
call sub.MFC42.DLL_CString::CString_4
lea ebp, [esi + 0x44]
mov byte [esp + 0x18], 1
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x48]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, ebp
mov byte [esp + 0x1c], 3
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPCommandBarKeyboardTip::vftable
mov dword [esi + 0x4c], eax
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
mov ecx, edi
mov dword [esi + 0x60], edx
call sub.MFC42.DLL_CString::Empty
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x64], eax
mov dword [esi + 0x58], edx
mov dword [esi + 0x5c], 1
mov dword [esi + 0x68], 0
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c
Function at 0x67840fe0
Capabilities:
Log keystrokes

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x74]
cmp dword [eax + 0x5c], 2
je 0x67841137
mov ecx, dword [esp + 0x14]
cmp ecx, 0x60
jb 0x6784100c
cmp ecx, 0x69
ja 0x6784100c
mov edx, dword [eax + 0x7c]
test edx, edx
je 0x67841137
push 2
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
test eax, eax
je 0x67841137
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x58]
mov ebp, eax
push ebp
call fcn.6783f100
mov esi, eax
mov eax, dword [edi + 0x84]
add esp, 4
neg esi
sbb esi, esi
xor ebx, ebx
and esi, ebp
test eax, eax
jle 0x67841082
push ebx
mov ecx, edi
call sym.MfcHlpr520.dll_public:_class_CMHPToolBar____thiscall_CMHPCommandBars::GetAt_int_const
mov ebp, eax
mov eax, dword [ebp + 0xcc]
test eax, eax
jne 0x67841080
mov ecx, dword [edi + 0x74]
test byte [ecx + 0x5c], 1
je 0x67841073
test esi, esi
jne 0x67841073
push ebp
call fcn.6783f100
add esp, 4
test eax, eax
je 0x67841073
mov esi, ebp
mov eax, dword [edi + 0x84]
inc ebx
cmp ebx, eax
jl 0x67841043
jmp 0x67841082
mov esi, ebp
test esi, esi
je 0x67841137
push esi
call fcn.6783f100
add esp, 4
test eax, eax
je 0x67841137
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x174]
test eax, eax
je 0x678410ba
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
lea eax, [esp + 0x14]
mov ecx, edi
push eax
push ebx
push esi
call sym.MfcHlpr520.dll_protected:_class_CMHPControl____thiscall_CMHPCommandBars::FindAccel_class_CMHPCommandBar___unsigned_int__int__const
mov ebp, eax
test ebp, ebp
je 0x67841137
mov esi, dword [ebp + 0x108]
mov ebx, dword [ebp + 0x84]
mov eax, dword [esi + 0xcc]
test eax, eax
jne 0x678410eb
mov ecx, edi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPCommandBars::ClosePopups_void_const
push 1
mov ecx, edi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPCommandBars::ShowKeyboardCues_int_
mov dword [edi + 0x44], 1
mov edx, dword [esi]
push 1
push 0
push 1
mov ecx, esi
call dword [edx + 0xc4]
mov eax, dword [esi]
push 1
push ebx
mov ecx, esi
call dword [eax + 0xcc]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x6784112b
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xb4]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
Function at 0x67843590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67983195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.6797d7b4
xor edi, edi
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x44]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x48]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 3
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 4
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x54]
mov byte [esp + 0x14], 5
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x58]
mov byte [esp + 0x14], 6
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x5c]
mov byte [esp + 0x14], 7
call sub.MFC42.DLL_CString::CString_4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], 0x67998cd8
mov dword [esi + 0x64], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x74], eax
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPControlAction::vftable
mov dword [esi + 0x3c], 1
mov dword [esi + 0x34], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x67847a80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
cmp esi, 8
mov edi, ecx
je 0x67847ac5
cmp esi, 0x21
jb 0x67847a9a
cmp esi, 0x2e
jbe 0x67847ac5
cmp esi, 0x43
je 0x67847aae
cmp esi, 0x56
je 0x67847aae
cmp esi, 0x58
je 0x67847aae
cmp esi, 0x5a
jne 0x67847abb
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x67847ac5
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0x20]
lea edx, [esp + 8]
mov dword [esp + 0x14], ecx
push edx
mov ecx, edi
mov dword [esp + 0x10], 0x100
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CWnd::IsDialogMessageA
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x1c
ret 8
Function at 0x67847cb0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x67847cc8
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov ebx, dword [esp + 0x28]
cmp ebx, 0x26
je 0x67847ce0
cmp ebx, 0x28
je 0x67847ce0
cmp ebx, 0x22
je 0x67847ce0
cmp ebx, 0x21
jne 0x67847ced
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x67847cf7
pop edi
xor eax, eax
pop ebx
add esp, 0x1c
ret 8
mov eax, dword [edi + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call esi
push 1
push eax
call esi
mov ecx, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
neg eax
sbb eax, eax
pop esi
pop edi
pop ebx
neg eax
add esp, 0x1c
ret 8

Function at 0x67847da0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x67847db0
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x6784a880
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x194]
mov ebx, dword [esp + 0x30]
mov ebp, eax
mov eax, dword [ebx + 0x18c]
test eax, eax
je 0x6784a8db
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x6784a9cd
mov eax, dword [esp + 0x34]
cmp eax, 0x26
je 0x6784a8ce
cmp eax, 0x28
je 0x6784a8ce
cmp eax, 0x21
je 0x6784a8ce
cmp eax, 0x22
jne 0x6784a9cd
mov ecx, dword [esp + 0x38]
push ecx
push eax
push 0x100
jmp 0x6784a94e
mov edi, dword [esp + 0x34]
cmp edi, 0x73
jne 0x6784a9ae
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x6784a9cd
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0x100
push ecx
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
mov edx, dword [esi + 0x20]
push 1
push 0x102
push 0x102
lea eax, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x6784a955
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
push 0x102
mov ecx, esi
call sub.MFC42.DLL_CWnd::DefWindowProcA
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x194]
cmp ebp, eax
je 0x6784a99f
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x16c]
mov esi, dword [ebx + 0x18c]
test esi, esi
je 0x6784a99f
mov eax, dword [esi + 0x20]
test eax, eax
je 0x6784a99f
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push ecx
call edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0xc
cmp edi, 0x26
je 0x6784a9bc
cmp edi, 0x28
jne 0x6784a8f9
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x6784a8f9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x6784df80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x78]
test eax, eax
je 0x6784e144
mov eax, dword [esi + 0x17c]
test eax, eax
je 0x6784e144
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x6784e144
test eax, eax
je 0x6784dfc1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x6784dfc1
pop edi
pop esi
mov eax, 2
pop ebx
ret 8
mov ebx, dword [esp + 0x10]
cmp ebx, 0xd
je 0x6784e144
cmp ebx, 9
je 0x6784e144
cmp ebx, 0x1b
jne 0x6784e00f
lea ecx, [esi + 0x19c]
push ecx
mov ecx, esi
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPControlEdit::SetEditText_class_CString_const__
mov edx, dword [esi]
push 0
mov ecx, esi
call dword [edx + 0x74]
mov eax, dword [esi + 0x108]
xor ecx, ecx
pop edi
pop esi
mov edx, dword [eax + 0xe4]
pop ebx
cmp edx, 2
sete cl
mov eax, ecx
ret 8
test eax, eax
je 0x6784e05b
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x6784e05b
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jge 0x6784e05b
push 0x11
call edi
test ax, ax
jl 0x6784e05b
mov ecx, dword [esi + 0x108]
call sym.MfcHlpr520.dll_public:_class_CMHPCommandBars____thiscall_CMHPCommandBar::GetCommandBars_void_const
test eax, eax
je 0x6784e05b
movsx edx, bl
push edx
mov ecx, eax
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBars::OnFrameAccel_unsigned_int_
test eax, eax
je 0x6784e05b
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov eax, dword [esi + 0xa0]
cmp eax, 0xffffffff
jne 0x6784e075
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x6784e075
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPControlAction::GetEnabled_void_const
test eax, eax
je 0x6784e106
mov eax, dword [esi + 0x1b4]
test eax, eax
je 0x6784e106
cmp ebx, 0x26
je 0x6784e091
cmp ebx, 0x28
jne 0x6784e106
mov ecx, esi
call sym.MfcHlpr520.dll_public:_unsigned_long_int___thiscall_CMHPControlColorSelector::GetColor_void_const
test eax, eax
jne 0x6784e106
sub ebx, 0x26
mov eax, dword [esi]
neg ebx
sbb ebx, ebx
mov ecx, esi
and ebx, 0xfffffffe
inc ebx
push ebx
push 1
call dword [eax + 0x16c]
mov eax, dword [esi + 0x17c]
test eax, eax
je 0x6784e0fb
jne 0x6784e0c4
xor edi, edi
jmp 0x6784e0c7
mov edi, dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
jne 0x6784e0fb
mov esi, dword [esi + 0x17c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push 0
mov ecx, dword [esi + 0x20]
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x20]
push 0
push 0
push 0xb7
push edx
call edi
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, dword [esi + 0x1a8]
mov edi, dword [esp + 0x14]
test ecx, ecx
je 0x6784e12a
push edi
push ebx
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPControlComboBoxAutoCompleteWnd::IsDialogCode_unsigned_int__long_int_
test eax, eax
je 0x6784e12a
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
mov ecx, dword [esi + 0x17c]
push edi
push ebx
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPMiniEdit::IsDialogCode_unsigned_int__long_int_
neg eax
sbb eax, eax
pop edi
pop esi
add eax, 2
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x6784e9c0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x67984078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
mov eax, ebx
xor edx, edx
imul eax, ebp
push edi
mov edi, ecx
test ebp, ebp
setle dl
lea ecx, [esp + 0xc]
add edx, 0x1010
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x24], eax
call sym.MfcHlpr520.dll_public:_long_int___thiscall_CMHPControl::NotifySite_unsigned_int__struct_NMMHPCONTROL__
test eax, eax
jne 0x6784ea97
lea eax, [esp + 0x34]
push esi
push eax
mov ecx, edi
call sym.MfcHlpr520.dll_public:_class_CString___thiscall_CMHPControlEdit::GetEditText_void_
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
lea ecx, [esp + 0x38]
mov esi, eax
call sub.MFC42.DLL_CString::CString
add esi, dword [esp + 0x20]
mov eax, esi
cdq
idiv ebx
test edx, edx
je 0x6784ea4c
add esi, ebp
mov eax, esi
cdq
idiv ebx
test edx, edx
jne 0x6784ea41
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString_4
push esi
lea ecx, [esp + 0x38]
push 0x67a72660
push ecx
mov dword [esp + 0x38], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x34]
mov ecx, edi
push edx
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPControlEdit::SetEditText_class_CString_const__
push 0x64
mov ecx, edi
call sym.MfcHlpr520.dll_public:_long_int___thiscall_CMHPControl::NotifySite_unsigned_int_
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop esi
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x67851070
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x18
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x678511a9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x108]
lea ecx, [esp + 0x10]
push ecx
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [esi + 0xc4]
mov edi, dword [esi + 0x1a4]
mov ebp, dword [esi + 0x1a8]
push 1
mov ebx, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x20], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x24], eax
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x28], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x67851125
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp eax, ecx
jl 0x678510fd
sub eax, ebx
mov edi, dword [esi + 0x184]
cdq
idiv dword [esi + 0x194]
inc eax
cmp edi, eax
jl 0x678510fd
mov edi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
cmp eax, ecx
jl 0x67851125
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x188]
sub eax, ebx
mov ebp, ecx
cdq
idiv dword [esi + 0x198]
inc eax
cmp ecx, eax
jl 0x67851125
mov ebp, eax
mov eax, dword [esi + 0x1a4]
mov ecx, dword [esi + 0x1a8]
cmp edi, eax
jne 0x67851139
cmp ebp, ecx
je 0x67851194
mov edx, dword [esi + 0x190]
mov eax, dword [esi + 0x18c]
push 1
push edx
mov dword [esi + 0x1a4], edi
push eax
mov ecx, esi
mov dword [esi + 0x1a8], ebp
call sym.MfcHlpr520.dll_protected:_void___thiscall_CMHPControlSelector::SetItemsActive_class_CSize__int_
mov ecx, dword [esi + 0x108]
mov dword [esi + 0x1ac], 1
mov edx, dword [ecx]
call dword [edx + 0x100]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x1ac], 0
call dword [eax + 0x100]
jmp 0x678511a9
push 0
sub esp, 8
mov ecx, esp
push 0
call fcn.67875660
mov ecx, esi
call sym.MfcHlpr520.dll_protected:_void___thiscall_CMHPControlSelector::SetItemsActive_class_CSize__int_
mov eax, dword [esp + 0x2c]
mov ecx, esi
push eax
call sym.MfcHlpr520.dll_protected_virtual:_int___thiscall_CMHPControl::OnSetSelected_int_
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x67851f20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x679844a8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
push edi
mov esi, ecx
call sym.MfcHlpr520.dll_public:_class_CMHPBarPaintManager____thiscall_CMHPControl::GetPaintManager_void_const
test eax, eax
jne 0x67851f55
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call sub.MFC42.DLL_CGdiObject::FromHandle
jmp 0x67851f5a
add eax, 0xf8
mov edi, dword [esp + 0x34]
push eax
push edi
lea ecx, [esp + 0x18]
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPFontDC::constructor_class_CDC___class_CFont__
mov eax, dword [esi]
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
mov dword [esp + 0x2c], 0
call dword [eax + 0x58]
mov eax, dword [eax]
lea edx, [esp + 8]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], ecx
lea ecx, [esp + 0x10]
mov dword [esi + 4], edx
call sym.MfcHlpr520.dll_public_virtual:_void___thiscall_CMHPFontDC::destructor_void_
mov ecx, dword [esp + 0x20]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x67852120
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [ecx + 0xf0]
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret

Function at 0x67852180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x679844fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.6797d7b4
xor edi, edi
lea ecx, [esi + 0x2c]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPControlGalleryItem::vftable
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x67852196
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x679844fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.6797d7b4
xor edi, edi
lea ecx, [esi + 0x2c]
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esi + 0x34]
mov byte [esp + 0x14], 2
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0xc]
or eax, 0xffffffff
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
xor eax, eax
mov dword [esi + 0x38], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPControlGalleryItem::vftable
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x678559a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPControlGallery::IsShowAsButton_void_const
test eax, eax
je 0x678559ca
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
push ecx
push edx
mov ecx, esi
call sym.MfcHlpr520.dll_protected_virtual:_void___thiscall_CMHPControlPopup::OnClick_int__class_CPoint_
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, esi
call sym.MfcHlpr520.dll_protected:_int___thiscall_CMHPControl::IsCustomizeMode_void_const
test eax, eax
je 0x67855a10
mov ecx, dword [esi + 0x108]
push 0
push 0xffffffffffffffff
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::SetPopuped_int__int_
mov ecx, dword [esi + 0x108]
push 0
push 0xffffffffffffffff
mov eax, dword [ecx]
call dword [eax + 0xcc]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x10c]
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [esi + 0xa0]
cmp eax, 0xffffffff
jne 0x67855a2a
mov ecx, dword [esi + 0x164]
test ecx, ecx
je 0x67855a2a
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPControlAction::GetEnabled_void_const
test eax, eax
je 0x67855ad2
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x67855ad2
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edx, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [edx + 0x100]
mov eax, dword [esi + 0x1e4]
cmp eax, 0x41
jne 0x67855a77
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x108]
push 0
push eax
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::SetPopuped_int__int_
pop edi
pop esi
pop ebx
ret 0xc
test eax, eax
je 0x67855aba
mov eax, dword [esi + 0x108]
push ebp
test eax, eax
jne 0x67855a8a
xor ebp, ebp
jmp 0x67855a8d
mov ebp, dword [eax + 0x20]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
lea edx, [esi + 0x190]
test ax, ax
setl cl
push ecx
push edx
push edi
push ebx
push ebp
lea ecx, [esi + 0x18c]
call sym.MfcHlpr520.dll_public:_void___thiscall_CMHPScrollBase::PerformTrackInit_struct_HWND_____class_CPoint__struct_CMHPScrollBase::SCROLLBARPOSINFO___int_
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esi + 0x108]
push 0
push 0xffffffffffffffff
call sym.MfcHlpr520.dll_public:_int___thiscall_CMHPCommandBar::SetPopuped_int__int_
push edi
push ebx
mov ecx, esi
call sym.MfcHlpr520.dll_protected:_void___thiscall_CMHPControlGallery::PerformMouseDown_class_CPoint_
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x67857560
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x67984892
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call sym.MfcHlpr520.dll_protected:_void___thiscall_CMHPControl::constructor_void_
xor ebx, ebx
push 0x44
mov dword [esp + 0x30], ebx
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPControlListBox::vftablefor__CCmdTarget
mov dword [esi + 0x20], sym.MfcHlpr520.dll_const_CMHPControlListBox::vftablefor__CMHPAccessible
call sub.MFC42.DLL_operatornew
mov edi, eax
add esp, 4
mov dword [esp + 0x10], edi
cmp edi, ebx
mov byte [esp + 0x2c], 1
je 0x678575c1
mov ecx, edi
call sub.MFC42.DLL_CWnd::CWnd
mov dword [edi], 0x6799b910
jmp 0x678575c3
xor edi, edi
push ebx
push ebx
lea eax, [esp + 0x1c]
push ebx
push eax
push 0x82200001
mov dword [esi + 0x17c], edi
push ebx
mov dword [edi + 0x40], esi
mov ecx, dword [esi + 0x17c]
push 0x67a73bdc
push ebx
mov byte [esp + 0x4c], bl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call sub.MFC42.DLL_CWnd::CreateEx_1
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x180], 1
mov dword [esi + 0x184], 0xc
mov dword [esi + 0x168], 0x64
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x6785ae50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67984b43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.6797d7b4
xor edi, edi
mov dword [esi + 0x24], 0x67998cd8
mov dword [esp + 0x14], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov ecx, esi
mov byte [esp + 0x14], 1
mov dword [esi], sym.MfcHlpr520.dll_const_CMHPControls::vftable
call sub.MFC42.DLL_CCmdTarget::EnableAutomation
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x20], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret