joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40288e
pop dword [ebp - 0x20]
mov eax, 0x40561cbd
add eax, 0xbfea0bd1
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x90c9e84d
add dword [ebp - 0x30], 0xbd885cfe
mov dword [ebp - 0x2c], 0x7db58c2e
add dword [ebp - 0x2c], 0xb47dc017
mov dword [ebp - 0x28], 0x2c00dd29
add dword [ebp - 0x28], 0x204b6705
mov dword [ebp - 0x24], 0x3ba38004
add dword [ebp - 0x24], 0xc45c7ffc
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x24eb35a6
add dword [ebp - 0x30], 0x4f8733b0
mov dword [ebp - 0x2c], 0xbf635903
add dword [ebp - 0x2c], 0x82090872
mov dword [ebp - 0x28], 0xa7d7103b
add dword [ebp - 0x28], 0xbb985c31
mov dword [ebp - 0x24], 0x62acad74
sub dword [ebp - 0x24], 0x62acad74
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xa3ec528c
sub eax, 0xa3abd1b8
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x37ab2
push 0
call eax
mov ecx, 0x4c4a
mov edi, eax
mov ebx, 0x411000
add ebx, dword [ebp - 0x20]
mov esi, 0xc83b1467
add esi, 0x6244a232
xor dword [ebp - 0x14], ebx
mov edx, dword [ebx]
add dword [ebp - 4], eax
xor edx, esi
add dword [ebp - 0x18], 0x476ecb80
mov dword [edi], edx
xor dword [ebp - 4], eax
add edi, 4
add ebx, 4
loop 0x40299f
add eax, 0x4c783462
add eax, 0xb388ef99
xor ebx, ebx
add ebx, eax
add eax, 0x53762178
sub eax, 0x53762173
mov ecx, 0x1e0dbbbe
sub ecx, 0x1dcdbbbe
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x483346
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004832ef
test eax, eax
je 0x48349f
lea ecx, [esp + 0x18]
jmp loc.004b0000
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x483376
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48363c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x48366e
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x48364f
jmp 0x483672
mov eax, dword [esp + 0x10]
test edi, edi
je 0x48367c
xor byte [esi], al
inc esi
dec edi
jne 0x483676
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad74708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x3ad74717
pop dword [ebp - 0x14]
mov eax, 0x1f495d0d
sub eax, 0xe47215f6
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x37a18
push 0
mov eax, 0x8e60c641
add eax, 0xac764a73
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5ead9cff
add ecx, 0xa152ab0f
xor edi, edi
add edi, eax
mov edx, 0x3ad84e00
add edx, dword [ebp - 0x14]
mov esi, 0xe05a8d6e
sub esi, 0x2d3dfea3
sub dword [ebp - 8], 0x389ac699
mov ebx, dword [edx]
xor dword [ebp - 8], esi
sub ebx, esi
mov dword [edi], ebx
sub dword [ebp - 0x10], 0xd6e75d01
add edi, 0xdfbbeb0b
add edi, 0x204414f9
add edx, 0xe5041de3
add edx, 0x1afbe221
loop 0x3ad74772
add eax, 0xd046cfd2
add eax, 0x2fba4339
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa9180f6d
sub ecx, 0x6e410f6d
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x4043a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x576a2c
mov esi, 0x578ad0
mov edi, dword [ebx + 4]
jmp 0x4043c9
mov ebp, dword [edi + 4]
push 0x8000
push 0
push edi
call sub.user32.dll_ShowWindow
mov edi, ebp
cmp edi, ebx
jne 0x4043b7
mov edx, 0x37
mov eax, 0x570084
mov ecx, eax
mov dword [eax + 0x14], ecx
mov ecx, eax
mov dword [eax + 4], ecx
mov dword [eax + 8], 1
xor ecx, ecx
mov dword [eax + 0xc], ecx
add eax, 0x20
dec edx
jne 0x4043d7
mov dword [ebx], ebx
mov dword [ebx + 4], ebx
mov edx, 0x400
mov ecx, 0x576acc
mov eax, ecx
mov dword [eax], eax
mov dword [eax + 4], eax
add ecx, 8
dec edx
jne 0x404402
mov ebx, dword [esi + 4]
jmp 0x404426
mov edi, dword [ebx + 4]
push 0x8000
push 0
push ebx
call sub.user32.dll_ShowWindow
mov ebx, edi
cmp ebx, esi
jne 0x404414
mov dword [esi], esi
mov dword [esi + 4], esi
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x404434
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
cmp dword [0x578ae8], 0
je 0x40444f
mov eax, dword [0x578ae8]
push eax
call sub.user32.dll_MapVirtualKeyW
xor eax, eax
mov dword [0x578ae8], eax
cmp byte [0x5768dc], 0
je 0x40445d
call fcn.00403e54
cmp dword [0x578ae0], 0
je 0x40447f
push 0x8000
push 0
mov eax, dword [0x578ae0]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
mov dword [0x578ae0], eax
call fcn.004043a4
ret

Function at 0x4048a8
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x570008], 0x8088405
inc edx
mov dword [ebx + 0x570008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40ccc4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 8], eax
push 0x40cd64
push 0x40cd88
call fcn.0040c818
mov ebx, eax
push 0x40cd98
call sub.user32.dll_GetKeyboardLayoutNameW
mov edx, dword [ebp - 8]
mov dword [edx], eax
push 0x40cdb8
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [esi], eax
push 0x40cde4
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [edi], eax
cmp dword [esi], 0
je 0x40cd29
test ebx, ebx
je 0x40cd29
push 0
push 0
mov eax, dword [esi]
push eax
push ebx
call sub.user32.dll_GetMenuState
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
jmp 0x40cd30
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], edx
cmp dword [edi], 0
je 0x40cd4d
test ebx, ebx
je 0x40cd4d
push 0
push 0
mov eax, dword [edi]
push eax
push ebx
call sub.user32.dll_GetMenuState
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x40cd56
mov eax, dword [ebp + 8]
mov dword [eax], 3
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x411dc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x411e71
test eax, edx
je 0x411e74
push 0
push 0
cmp word [eax - 0xa], 2
je 0x411df1
push edx
mov edx, eax
mov eax, esp
call fcn.004076d0
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x411e07
push eax
lea eax, [esp + 8]
call fcn.004076d0
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x411e16
movzx eax, word [eax]
sub eax, ecx
jmp 0x411e3d
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x411e57
add ecx, 4
js 0x411e2e
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x411e54
push eax
mov eax, ecx
mov edx, 2
call fcn.004068d4
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x411e3b
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x411e3d
xor eax, eax
ret
test eax, eax
je 0x411e84
test edx, edx
jne 0x411dd8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41a2e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x41a3be
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00407510
lea eax, [ebp - 4]
call fcn.00407eb8
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407548
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x41a3a8
mov eax, ebx
call fcn.004044a0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x41a3a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00407548
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x41a38b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x41a3d0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x41a38b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3a8
mov eax, dword [ebp - 0x10]
call fcn.004044bc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a3c5
lea eax, [ebp - 4]
call fcn.004074ac
ret
Function at 0x41b613
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406c24
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040c2d0
mov edi, eax
cmp edi, 0x104
jbe 0x41b636
mov eax, edi
add eax, eax
call fcn.004044a0
mov esi, eax
jmp 0x41b638
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040c2d0
push edi
push esi
call fcn.0040c6f8
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41b671
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41b65b
mov eax, esp
cmp esi, eax
je 0x41b67e
mov eax, esi
call fcn.004044bc
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41b6b8
cmp bl, 0
je 0x41b6b4
cmp bl, 0x41
jl 0x41b6af
cmp bl, 0x5a
jg 0x41b6af
or bl, 0x20
xor al, bl
inc esi
jmp 0x41b693
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41b5f8

Function at 0x445624
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov eax, dword [0x578c40]
mov dword [0x571278], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x57128c]
push eax
mov eax, dword [0x578c40]
push eax
call fcn.0040c840
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x44565e
mov edx, fcn.0040c750
cmp edx, dword [ebp - 0x24]
je 0x44567d
test al, al
je 0x445673
mov eax, dword [0x578c40]
push eax
mov eax, dword [0x57128c]
push eax
call sub.user32.dll_IsWindow
push 0x571268
call sub.user32.dll_GetKeyboardLayout
push 0x80000000
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x578c40]
push eax
push 0
mov ecx, 0x4456d4
mov edx, dword [0x57128c]
mov eax, 0x80
call fcn.0040cc6c
mov ebx, eax
cmp word [ebp + 0xa], 0
je 0x4456c8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0044548c
push eax
push 0xfffffffffffffffc
push ebx
call sub.user32.dll_GetWindowPlacement
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x455244
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x45524a
ret
Function at 0x4829ac
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push esi
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
mov eax, dword [esi]
call fcn.004876c0
push eax
call sub.user32.dll_FindWindowW
test eax, eax
je 0x482a68
mov eax, dword [esi]
call fcn.004876c0
push eax
call sub.user32.dll_CreateAcceleratorTableW
test eax, eax
jne 0x482a68
lea eax, [ebp - 0x18]
push eax
mov eax, dword [esi]
call fcn.004876c0
push eax
call sub.user32.dll_DrawEdge
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
mov dword [ebp - 4], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
mov dword [ebp - 8], eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [esi]
call fcn.0048078c
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x482a3e
mov edx, dword [esi]
mov edx, dword [edx + 0x4c]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
cmp edx, ecx
jne 0x482a3e
cmp eax, dword [ebp - 4]
jne 0x482a3e
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
cmp eax, dword [ebp - 8]
je 0x482a5f
push 0x16
mov eax, dword [esi]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 0x48]
push eax
push 0
push 0
push 0
mov eax, dword [esi]
call fcn.004876c0
push eax
call sub.user32.dll_GetWindowTextW
mov eax, dword [esi]
mov edx, dword [eax]
call dword [edx + 0x68]
jmp 0x482a73
mov eax, dword [esi]
mov si, 0xffef
call fcn.004057b4
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x483498
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x100], edx
mov edi, eax
xor eax, eax
push ebp
push 0x483692
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xac]
cmp dword [ebp - 0xb0], 0
jne 0x48354b
test byte [ebp - 0xc5], 0x40
je 0x48354b
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x48350b
test byte [ebx + 0x1c], 2
je 0x48350b
mov eax, ebx
mov edx, dword [0x476aa0]
call fcn.00405744
test al, al
je 0x48350b
mov eax, ebx
call fcn.004876c0
mov dword [ebp - 0xb0], eax
jmp 0x48354b
mov eax, dword [edi + 8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0x11
lea eax, [ebp - 0xfc]
push eax
push 0
lea edx, [ebp - 0x100]
mov eax, dword [0x575018]
call fcn.0040a9b0
mov ecx, dword [ebp - 0x100]
mov dl, 1
mov eax, dword [0x42ca60]
call fcn.0041918c
call fcn.004060ac
mov eax, dword [ebp - 0xa4]
mov dword [edi + 0x254], eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.0040c840
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x483585
mov edx, 0x47ab30
cmp edx, dword [ebp - 0xf0]
je 0x4835c2
test al, al
je 0x483599
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.user32.dll_IsWindow
mov dword [ebp - 0xa4], 0x47ab30
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xa8]
push eax
call sub.user32.dll_GetKeyboardLayout
test ax, ax
jne 0x4835c2
call fcn.0041b7e4
mov dword [0x571d58], edi
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xb0]
cmp dword [edi + 0x258], 0
jne 0x4835e6
call fcn.0041b7e4
push 0xfffffffffffffff0
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, 0x40000000
je 0x48361c
push 0xfffffffffffffff4
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, eax
jne 0x48361c
mov eax, dword [edi + 0x258]
push eax
push 0xfffffffffffffff4
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [edi + 0x174]
call fcn.00413f5c
xor eax, eax
mov dword [edi + 0x174], eax
mov eax, edi
call fcn.00487a78
push 1
mov eax, dword [edi + 0x64]
call fcn.00456514
mov ecx, eax
mov edx, 0x30
mov eax, edi
call fcn.0047fc64
cmp byte [edi + 0x5e], 0
je 0x48365f
mov eax, edi
mov si, 0xffef
call fcn.004057b4
mov eax, dword [edi + 0xac]
mov eax, dword [eax + 8]
test eax, eax
je 0x483679
test byte [edi + 0x52], 0x20
je 0x483679
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x483699
lea eax, [ebp - 0x100]
call fcn.004074ac
ret
Function at 0x487210
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
mov ebx, dword [edi + 0x258]
test ebx, ebx
je 0x487234
push ebx
call sub.user32.dll_FillRect
test eax, eax
jne 0x487238
xor eax, eax
jmp 0x48723a
mov al, 1
mov byte [esp + 8], al
cmp byte [esp + 8], 0
je 0x48725f
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_GetMenuItemInfoW
mov eax, edi
call fcn.004831f8
mov esi, eax
dec esi
test esi, esi
jl 0x4872d9
inc esi
xor ebp, ebp
mov edx, ebp
mov eax, edi
call fcn.004831bc
mov ebx, eax
mov eax, ebx
mov edx, dword [0x476aa0]
call fcn.00405744
test al, al
je 0x487295
cmp dword [ebx + 0x258], 0
jne 0x4872a4
mov eax, dword [esp]
add dword [ebx + 0x40], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x44], eax
jmp 0x4872d5
cmp byte [esp + 8], 0
jne 0x4872d5
push 0x14
mov eax, ebx
mov edx, dword [eax + 0x4c]
push edx
mov edx, dword [eax + 0x48]
push edx
mov edx, dword [eax + 0x44]
add edx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 0x40]
add edx, dword [esp + 0x10]
push edx
push 0
mov eax, dword [eax + 0x258]
push eax
call sub.user32.dll_GetWindowTextW
inc ebp
dec esi
jne 0x487270
xor edx, edx
mov eax, edi
call fcn.00482c54
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48da50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48dbdb
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call fcn.0040c12c
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x48dbf4
call fcn.00414098
mov edx, dword [ebp - 4]
mov eax, 0x57b1f8
call fcn.004074bc
mov eax, dword [0x57b1f8]
call fcn.00407548
push eax
call fcn.0040c268
mov word [0x57b1f4], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x578c40]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call fcn.0040c13c
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x48dc18
call fcn.00414098
mov edx, dword [ebp - 0x10]
mov eax, 0x57b1fc
call fcn.004074bc
mov eax, dword [0x57b1fc]
call fcn.00407548
push eax
call fcn.0040c268
mov word [0x57b1f6], ax
mov eax, dword [0x57b1fc]
call fcn.00407548
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [0x57b200], eax
mov dl, 1
mov eax, dword [0x42d550]
call fcn.004387d8
mov dword [0x57b238], eax
call fcn.0048d568
mov dl, 1
mov eax, dword [0x479950]
call fcn.0048d2e0
mov dword [0x57b1e0], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49eef0]
call fcn.004aac98
mov edx, dword [0x5752a4]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x49ff34]
call fcn.004ac318
mov edx, dword [0x574f6c]
mov dword [edx], eax
mov eax, dword [0x574f6c]
mov eax, dword [eax]
mov dl, 1
call fcn.004aeb58
xor ecx, ecx
mov dl, 1
mov eax, dword [0x474724]
call fcn.0047d3d4
mov dword [0x57b23c], eax
push 0x48dc40
call fcn.0040c19c
mov ebx, eax
mov ecx, 0x47afe4
mov edx, 0x47aff4
mov eax, dword [0x470030]
call fcn.004375a0
test ebx, ebx
je 0x48dbbd
push 0x48dc50
push ebx
call fcn.0040c1b4
mov dword [0x571d50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48dbe2
lea eax, [ebp - 0x10]
call fcn.004074ac
lea eax, [ebp - 4]
call fcn.004074ac
ret

Function at 0x4a1b94
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test esi, esi
je 0x4a1bdb
push 0xffffffffffffffec
push esi
call sub.user32.dll_DispatchMessageW
test bl, bl
je 0x4a1bb6
test ah, 2
jne 0x4a1bdb
or eax, 0x200
jmp 0x4a1bc0
test ah, 2
je 0x4a1bdb
and eax, 0xfffffdff
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowPlacement
push 0x37
push 0
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_GetWindowTextW
pop esi
pop ebx
ret
Function at 0x4a5734
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov edi, eax
cmp dl, byte [edi + 0x299]
je 0x4a58cb
mov byte [edi + 0x299], dl
cmp byte [edi + 0x274], 0
je 0x4a5765
movzx eax, byte [edi + 0x299]
sub al, 2
je 0x4a5769
sub al, 3
je 0x4a5769
xor edx, edx
jmp 0x4a576b
mov dl, 1
mov eax, edi
call fcn.004a316c
mov eax, edi
call fcn.00487a6c
test al, al
je 0x4a58cb
test byte [edi + 0x1c], 0x10
je 0x4a579b
test byte [edi + 0x1c], 0x10
je 0x4a58cb
cmp dword [edi + 0x34], 0
je 0x4a58cb
push 0xfffffffffffffff0
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_DispatchMessageW
mov dword [esp], eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_DispatchMessageW
mov dword [esp + 4], eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004876c0
push eax
call fcn.0040c848
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, edi
mov si, 0xffa9
call fcn.004057b4
lea ecx, [esp + 4]
mov edx, esp
mov eax, edi
mov si, 0xffaa
call fcn.004057b4
mov eax, dword [esp]
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [esp + 8]
push eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetWindow
mov eax, edi
call fcn.00487a6c
test al, al
je 0x4a58a8
mov eax, dword [0x574d40]
cmp byte [eax], 0
je 0x4a5889
cmp byte [edi + 0x299], 3
je 0x4a5873
mov eax, edi
call fcn.004a78a0
push eax
push 1
push 0x80
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetMenuState
jmp 0x4a5889
push 0
push 1
push 0x80
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetMenuState
push 0xffffffffffffffff
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_DestroyCursor
push 0
xor ecx, ecx
mov edx, 0x81
mov eax, edi
call fcn.0047fc64
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004876c0
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x90]
add esp, 0xc
pop edi
pop esi
ret