joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a77c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
xorps xmm0, xmm0
mov dword [esp], 0x44
xor eax, eax
movlpd qword [esp + 4], xmm0
push ebx
mov ebx, dword [esp + 0x50]
mov word [esp + 0x46], ax
mov ax, word [esp + 0x58]
movlpd qword [esp + 0x10], xmm0
movlpd qword [esp + 0x18], xmm0
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x28], xmm0
movlpd qword [esp + 0x36], xmm0
movlpd qword [esp + 0x3e], xmm0
mov dword [esp + 0x30], 1
mov word [esp + 0x34], ax
push esi
mov esi, ecx
push edi
test ebx, ebx
je 0x4a7823
cmp word [ebx], 0
jne 0x4a7825
xor ebx, ebx
mov eax, dword [esi + 0x704]
mov ecx, 0x4f6190
test eax, eax
je 0x4a783f
mov eax, dword [eax]
mov edx, ecx
test eax, eax
cmovne edx, eax
jmp 0x4a7844
mov edx, 0x4f6190
mov eax, dword [esi + 0x710]
test eax, eax
je 0x4a7859
mov eax, dword [eax]
mov edi, ecx
test eax, eax
cmovne edi, eax
jmp 0x4a785e
mov edi, 0x4f6190
mov eax, dword [esi + 0x6f8]
test eax, eax
je 0x4a7871
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
jmp 0x4a7876
mov ecx, 0x4f6190
mov esi, dword [esp + 0x68]
lea eax, [esp + 0xc]
push esi
push eax
push ebx
push 0
push 0
push dword [esp + 0x68]
push 0
push 1
push edx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
je 0x4a78d9
mov eax, dword [esp + 0x6c]
mov byte [eax], 1
mov eax, dword [esi + 4]
test eax, eax
je 0x4a78af
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x70]
mov ecx, dword [esi]
mov dword [eax], ecx
mov ecx, dword [esp + 0x64]
test ecx, ecx
je 0x4a78e5
push 0x11
push 0
push dword [esi + 8]
call fcn.004e6de0
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x44
ret 0x24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x74]
mov dword [ecx], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x44
ret 0x24

Function at 0x4a801b
Capabilities:
Delete file

Disassembly:
sub esp, 0x230
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x234]
push esi
mov esi, ecx
test eax, eax
je 0x4a80ce
cmp word [eax], 0
je 0x4a80ce
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.004a8d20
lea eax, [esp + 0x2c]
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a8045
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
cmp eax, 0x20c
jae 0x4a80f7
xor ecx, ecx
mov dword [esp + 8], 3
mov word [esp + eax + 0x24], cx
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, 0x4054
mov word [esp + 0x14], ax
lea eax, [esp + 4]
push eax
mov dword [esp + 0x1e], ecx
mov dword [esp + 0x22], ecx
mov dword [esp + 0x1a], ecx
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
mov ecx, esi
setne al
movzx eax, al
push eax
call fcn.0046e450
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004ebadf
add esp, 0x230
ret 4
push 0x4f5b70
push 9
push str.Parameter_1_must_not_be_blank_in_this_case.
call fcn.00462280
mov ecx, dword [esp + 0x230]
pop esi
xor ecx, esp
call fcn.004ebadf
add esp, 0x230
ret 4
call fcn.004ebef9
int3
Function at 0x4a81b0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x23c]
push esi
push edi
push 0
push 0
push 1
push 0
push ebp
call fcn.004e47f0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
test eax, eax
je 0x4a8244
push ebp
call fcn.004e6170
mov esi, eax
add esp, 4
test esi, esi
je 0x4a824e
push esi
push 0
push 0x101000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4a824e
push edi
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, esi
jne 0x4a8226
push 0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x4a82c7
cmp ebx, 0x102
jne 0x4a8248
mov eax, esi
jmp 0x4a82c9
xor esi, esi
jmp 0x4a824e
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
mov dword [esp + 0x18], 0x22c
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x4a82c4
nop dword [eax + eax]
test esi, esi
je 0x4a828a
cmp esi, dword [esp + 0x18]
je 0x4a82e2
lea eax, [esp + 0x34]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_wcsrchr
add esp, 8
test eax, eax
je 0x4a82a2
add eax, 2
jmp 0x4a82a6
lea eax, [esp + 0x34]
push ebp
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4a82e9
lea eax, [esp + 0x10]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a8280
push edi
call ebx
xor eax, eax
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x230
ret
push edi
call ebx
mov eax, esi
jmp 0x4a82c9
push edi
call ebx
mov eax, dword [esp + 0x18]
jmp 0x4a82c9
Function at 0x4a8f70
Capabilities:
Terminate process

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push eax
push 0x1f4
push 2
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4a8fd1
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
test eax, eax
je 0x4a8fd1
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4a8fd1
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
add esp, 8
ret
Function at 0x4b75a0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push 2
lea ecx, [esi + 0x68]
call fcn.0049a390
test eax, eax
jne 0x4b75bb
mov ecx, esi
pop esi
jmp fcn.004b7500
push 0
push 0x2af80002
push 0x414
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret

Function at 0x4b7d40
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
push 0
push 0x147
push dword [ebx + 0x34]
call ebp
push dword [ebx + 0x34]
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [esp + 0x18], eax
lea ecx, [eax*2 + 2]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x4b7d92
mov ecx, dword [esp + 0x14]
call fcn.004655d0
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
inc eax
push eax
push esi
push dword [ebx + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 0x18], eax
cmp edi, 0xffffffff
je 0x4b7dd1
mov ecx, dword [ebx + 0x34]
test eax, eax
jne 0x4b7dc0
push eax
push edi
push 0x149
push ecx
call ebp
test eax, eax
jmp 0x4b7dcf
push esi
lea eax, [edi - 1]
push eax
push 0x158
push ecx
call ebp
cmp edi, eax
je 0x4b7e0a
push esi
push 0xffffffffffffffff
push 0x158
push dword [ebx + 0x34]
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x4b7e0a
cmp dword [esp + 0x1c], 0
je 0x4b7e0a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [eax + 0x14], esi
mov dword [eax], esi
pop esi
pop ebp
mov dword [eax + 8], 0
mov dword [eax + 4], ecx
pop ebx
ret 0xc
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x4b7e79
cmp eax, 2
jne 0x4b7e26
test byte [ebx + 0x4d], al
jne 0x4b7e79
push 0
push edi
push 0x149
push dword [ebx + 0x34]
call ebp
cmp eax, 0xffffffff
je 0x4b7e8d
mov esi, dword [esp + 0x14]
push eax
push 0
push esi
call fcn.004a29d0
add esp, 0xc
test eax, eax
je 0x4b7e8d
push dword [esi]
push edi
push 0x148
push dword [ebx + 0x34]
call ebp
cmp eax, 0xffffffff
jne 0x4b7e8d
pop edi
mov dword [esi + 8], 0
mov dword [esi], 0x4f5b70
mov dword [esi + 4], 0
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
lea eax, [edi + 1]
cdq
mov dword [ecx + 8], 1
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x4b8700
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x14
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
mov dword [esp + 8], connect
movzx eax, byte [esi + 0x4c]
add eax, 0xfffffff7
cmp eax, 8
ja case.default.0x4b8731
push edi
jmp dword [eax*4 + 0x4b8838]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x19f
push dword [esi + 0x34]
call edi
cmp eax, 0xffffffff
je case.0x4b8731.12
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x198
push dword [esi + 0x34]
call edi
jmp case.0x4b8731.12
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi + 0x34]
call edi
cmp eax, 0xffffffff
je case.0x4b8731.12
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 2
push ecx
push eax
push 0x100e
push dword [esi + 0x34]
call edi
jmp case.0x4b8731.12
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push dword [esi + 0x34]
call edi
test eax, eax
je case.0x4b8731.12
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0x1104
push dword [esi + 0x34]
call edi
jmp case.0x4b8731.12
lea eax, [esp + 0xc]
push eax
push 0
push 0x419
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
cmp dword [esp + 8], 0x80000000
lea ecx, [esp + 8]
mov eax, dword [esi + 0x34]
jne 0x4b87fa
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4b8806
push 2
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [ebx], eax
mov eax, dword [esp + 0x14]
sub eax, ecx
add ecx, 2
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov ecx, dword [esp + 0x18]
pop esi
mov dword [ebx + 4], eax
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x14
ret 8

Function at 0x4b8860
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [esp + 0x10]
mov ebx, eax
push ebx
push 0
push esi
call fcn.004a29d0
add esp, 0xc
cmp eax, 1
je 0x4b888f
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
lea eax, [ebx + 1]
push eax
push dword [esi]
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esi + 4], eax
test eax, eax
je 0x4b88b3
mov ecx, dword [esi]
cmp word [ecx + eax*2 - 2], 0
jne 0x4b88b3
dec eax
mov dword [esi + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
Function at 0x4bcf00
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
movzx ecx, word [esi]
cmp ecx, 0x20
je 0x4bcf15
cmp ecx, 9
jne 0x4bcf1a
add esi, 2
jmp 0x4bcf08
test cx, cx
je 0x4bd08e
cmp word [esi + 2], 0
lea eax, [esi + 2]
jne 0x4bcf3f
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov word [eax + 2], cx
mov byte [eax], 0
mov al, 1
pop ebx
ret
mov ebp, dword [esp + 0x18]
push 0x2b
push eax
mov byte [esp + 0x1c], 0
mov byte [ebp], 1
call sub.VCRUNTIME140.dll_wcschr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x4bd017
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
lea edi, [ebx - 2]
cmp edi, esi
jbe 0x4bcf84
nop
movzx eax, word [edi]
cmp eax, 0x20
je 0x4bcf7d
cmp eax, 9
jne 0x4bcf84
sub edi, 2
cmp edi, esi
ja 0x4bcf70
sub edi, esi
sar edi, 1
inc edi
push edi
push str.Ctrl
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x4bcfa1
mov al, byte [esp + 0x14]
or al, 1
jmp 0x4bcfd3
push edi
push 0x4f82ec
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x4bcfb9
mov al, byte [esp + 0x14]
or al, 4
jmp 0x4bcfd3
push edi
push str.Shift
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x4bd08e
mov al, byte [esp + 0x14]
or al, 0x10
mov byte [esp + 0x14], al
lea esi, [ebx + 2]
nop word [eax + eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x4bcfed
cmp eax, 9
jne 0x4bcff2
add esi, 2
jmp 0x4bcfe0
test ax, ax
je 0x4bd08e
lea eax, [esi + 2]
push 0x2b
push eax
call sub.VCRUNTIME140.dll_wcschr
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4bcf67
mov ebp, dword [esp + 0x18]
cmp word [esi + 2], 0
push 0
jne 0x4bd048
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, word [esi]
mov edi, eax
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
push 1
movzx ecx, ax
lea eax, [esp + 0x18]
push edi
push eax
push ecx
call fcn.0043cef0
add esp, 0x10
jmp 0x4bd05e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 0
push 0
push esi
call fcn.00443470
add esp, 0x14
movzx eax, al
mov word [ebp + 2], ax
mov al, byte [esp + 0x14]
test al, 1
je 0x4bd071
or byte [ebp], 8
test al, 4
je 0x4bd079
or byte [ebp], 0x10
test al, 0x10
je 0x4bd081
or byte [ebp], 4
cmp word [ebp + 2], 0
pop edi
pop esi
pop ebp
setne al
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x4bd8c0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x4bda94
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x4bd904
push 0x1c
push eax
call fcn.004ebb73
push 0x1c
push dword [esi + 0xf4]
call fcn.004ebb73
add esp, 0x10
mov dword [esi + 0xf4], 0
mov dword [esi + 0xf0], 0
mov eax, dword [esi + 0x40]
push ebx
push ebp
push edi
test eax, eax
je 0x4bd94d
push 0
push 0
push 0x406
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x4bd94d
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
nop dword [eax]
push 0
push edi
push 0x414
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4bd948
push eax
call ebp
inc edi
cmp edi, ebx
jl 0x4bd930
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bd989
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_SetMenu]
cmp byte [esi + 0xe8], 0
jne 0x4bd989
push dword [esi + 0x38]
mov byte [esi + 0xe8], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [esi + 0x34], 0
mov ebp, dword [0x62271c]
mov ecx, dword fs:[0x2c]
jne 0x4bd9bf
mov eax, dword [ecx + ebp*4]
cmp byte [eax + 0x2198], 0
jne 0x4bd9b4
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp*4]
cmp esi, dword [eax + 0x18c]
jne 0x4bda24
mov eax, dword [esi + 0x34]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4bd9cf
lea edi, [eax + 0x30]
jmp 0x4bd9f0
mov eax, dword [ecx + ebp*4]
cmp byte [eax + 0x2198], 0
jne 0x4bd9e7
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov edi, dword [ecx + ebp*4]
add edi, 0x18c
mov ebx, dword [esi + 0x30]
test ebx, ebx
je 0x4bd9fc
lea eax, [ebx + 0x34]
jmp 0x4bda1c
mov eax, dword [ecx + ebp*4]
cmp byte [eax + 0x2198], 0
jne 0x4bda14
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp*4]
add eax, 0x188
mov ecx, dword [esp + 0x10]
mov dword [edi], ebx
mov dword [eax], ecx
mov ecx, esi
mov dword [esi + 0x38], 0
call fcn.004bdb10
cmp byte [esi + 0xed], 0
je 0x4bda41
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp*4]
cmp byte [eax + 0x2198], 0
jne 0x4bda60
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp*4]
cmp dword [eax + 0x214], 0
je 0x4bda91
cmp byte [eax + 0x2198], 0
jne 0x4bda81
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + ebp*4]
push 4
mov ecx, dword [ecx + 0x298]
call fcn.00458cf0
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret
Function at 0x4bdd10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov dword [esp + 8], eax
cmp ebp, dword [eax + 0x78]
jae 0x4bdeba
mov eax, dword [eax + 0x48]
push edi
mov edi, dword [eax + ebp*4]
cmp dword [edi + 0x44], 0
je 0x4bdeb9
test byte [edi + 0x4d], 0x20
jne 0x4bdeb9
mov esi, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
cmp bx, 0x11
jne 0x4bdd7f
push 2
push esi
lea ecx, [edi + 0x3c]
call fcn.0049a390
test eax, eax
je 0x4bdd7b
mov eax, ebp
shl eax, 0x10
push esi
or eax, 0x11
push eax
mov eax, dword [esp + 0x18]
push 0x414
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_PostMessageW]
xor ebx, ebx
jmp 0x4bdd88
test bx, bx
jne case.0x4bdd9f.3
mov cl, byte [edi + 0x4c]
movzx eax, cl
dec eax
cmp eax, 0x10
ja case.0x4bdd9f.3
movzx eax, byte [eax + 0x4bdee4]
jmp dword [eax*4 + 0x4bdec0]
cmp esi, 7
ja case.0x4bddaf.1
jmp dword [esi*4 + 0x4bdef8]
cmp cl, 6
jne 0x4bddd5
push 0
push 0
push 0xf0
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je case.0x4bddaf.1
mov ebx, 7
jmp case.0x4bdd9f.3
mov ebx, 0x10
jmp case.0x4bdd9f.3
dec esi
cmp esi, 4
ja case.0x4bddaf.1
jmp dword [esi*4 + 0x4bdf18]
mov ebx, 8
jmp case.0x4bdd9f.3
dec esi
cmp esi, 4
ja case.0x4bddaf.1
jmp dword [esi*4 + 0x4bdf2c]
push 0
push 0
push 0x19f
push dword [edi + 0x34]
mov ebx, 8
call dword [sym.imp.USER32.dll_SendMessageW]
inc eax
mov dword [esp + 0x24], eax
jmp case.0x4bdd9f.3
cmp esi, 0x100
je case.0x4bddaf.6
cmp esi, 0x200
je case.0x4bddaf.7
cmp esi, 0x300
jne case.0x4bddaf.1
jmp case.0x4bddf3.1
mov ebx, 0xf
jmp case.0x4bdd9f.3
sub esi, 0
je 0x4bddd5
sub esi, 1
jne case.0x4bddaf.1
lea ebx, [esi + 8]
jmp case.0x4bdd9f.3
cmp esi, 4
jne case.0x4bddaf.1
jmp case.0x4bddf3.1
cmp esi, 5
je 0x4bde78
cmp esi, 8
jne 0x4bde7e
test byte [edi + 0x4d], 2
je case.0x4bddaf.1
mov dword [esp + 0x24], esi
mov ebx, 6
push 0
movzx eax, bl
lea ecx, [edi + 0x3c]
push eax
call fcn.0049a390
test eax, eax
je case.0x4bddaf.1
push dword [esp + 0x24]
shl ebp, 0x10
movzx eax, bx
or ebp, eax
mov eax, dword [esp + 0x14]
push ebp
push 0x414
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_PostMessageW]
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret 0x10
Function at 0x4c1ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push esi
push edi
mov edi, dword [esp + 0x14]
push 0
push 0
push 0x1304
push dword [edi + 0x34]
call ebp
mov esi, eax
test esi, esi
je 0x4c1fe0
push 0
push 0
push 0x130b
push dword [edi + 0x34]
call ebp
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4c1f1b
xor ecx, ecx
lea eax, [esi - 1]
cmp byte [esp + 0x18], cl
cmove ecx, eax
jmp 0x4c1f49
cmp byte [esp + 0x18], 0
je 0x4c1f36
inc ecx
cmp ecx, esi
jl 0x4c1f49
cmp byte [esp + 0x20], 0
je 0x4c1fe0
xor ecx, ecx
jmp 0x4c1f49
sub ecx, 1
jns 0x4c1f49
cmp byte [esp + 0x20], 0
je 0x4c1fe0
lea ecx, [esi - 1]
push 0
push ecx
push 0x130c
push dword [edi + 0x34]
call ebp
push dword [esp + 0x1c]
mov ecx, ebx
push edi
call fcn.004bcbb0
push dword [edi + 0x34]
xor ebp, ebp
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
lea esi, [eax - 3]
cmp esi, dword [ebx + 0x78]
jae case.0x4c1f99.1
mov ecx, dword [ebx + 0x48]
mov ecx, dword [ecx + esi*4]
cmp dword [ecx + 0x44], ebp
je case.0x4c1f99.1
test byte [ecx + 0x4d], 0x20
jne case.0x4c1f99.1
movzx eax, byte [ecx + 0x4c]
xor edi, edi
dec eax
cmp eax, 0x10
ja case.0x4c1f99.3
movzx eax, byte [eax + 0x4c1ffc]
jmp dword [eax*4 + 0x4c1fec]
mov ebp, 0xfffffdd9
mov edi, 6
push 0
movzx eax, di
add ecx, 0x3c
push eax
call fcn.0049a390
test eax, eax
je case.0x4c1f99.1
push ebp
shl esi, 0x10
movzx eax, di
or esi, eax
push esi
push 0x414
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0x4c3820
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor bl, bl
movzx eax, word [esi]
test ax, ax
je 0x4c385e
mov ecx, eax
movzx eax, cx
cmp eax, 0x21
je 0x4c384d
cmp eax, 0x2b
je 0x4c3849
cmp cx, 0x5e
jne 0x4c385e
mov al, 2
jmp 0x4c384f
mov al, 1
jmp 0x4c384f
mov al, 4
add esi, 2
or bl, al
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4c3832
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 0
push 0
push esi
call fcn.00443470
mov bh, al
add esp, 0x14
mov byte [esp + 0xc], bh
test bh, bh
jne 0x4c3885
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.00443130
movzx edx, ax
add esp, 8
test dx, dx
jne 0x4c38a9
push 0
push dword [esp + 0x10]
call fcn.00443f60
add esp, 8
movzx edx, ax
mov al, bl
or al, 8
and edx, 0x100
movzx ecx, al
movzx eax, bl
cmove ecx, eax
movzx eax, cl
movzx ecx, bh
shl ax, 8
pop esi
or ax, cx
pop ebx
ret

Function at 0x4c48a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f41ed
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x526b24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x52763c
mov byte [esi + 0x28], 0
mov dword [esi + 8], 0
mov dword [esi + 0x20], 3
mov eax, dword [ebp + 8]
mov dword [esi + 0x48], eax
mov eax, dword [0x62271c]
mov dword [esi], vtable.UserMenu.0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
lea ebx, [eax*4]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 2
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0xff000000
mov ecx, dword fs:[0x2c]
mov dword [ebp - 4], 0
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4c496f
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
mov edi, dword [eax + 0x2174]
test edi, edi
je 0x4c4982
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4c498f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xc], edi
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
cmp byte [eax + 0x2198], 0
jne 0x4c49b1
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ebx + ecx]
mov ecx, dword [eax + 0x298]
cmp dword [ecx + 0x69c], 0
jne 0x4c49cb
mov dword [ecx + 0x69c], esi
jmp 0x4c49d4
mov eax, dword [ecx + 0x6a0]
mov dword [eax + 0x3c], esi
inc dword [ecx + 0x6a4]
mov eax, esi
mov dword [ecx + 0x6a0], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4