joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407aa0
Capabilities:
Create thread
Terminate process

Disassembly:
mov eax, dword [0x41a31c]
test eax, eax
je 0x407ab7
mov eax, dword [esp + 4]
push eax
call fcn.00405670
add esp, 4
ret
push esi
push 1
call fcn.00405670
mov esi, eax
add esp, 4
test esi, esi
jg 0x407ad2
push 0x14
call fcn.00405640
add esp, 4
cmp esi, dword [0x41a320]
je 0x407b33
push 0x41a1e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41a20c]
test eax, eax
je 0x407b0e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x41a20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x41a20c], 0
push 0x41a1e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push esi
push 0x402710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x41a320], esi
mov eax, dword [0x41a730]
pop esi
test eax, eax
je 0x407b49
add eax, 0x14
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
inc dword [0x41a314]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov dword [0x41a318], edx
mov eax, 1
ret

Function at 0x407b70
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x428
mov eax, dword [esp + 0x430]
push esi
mov dword [esp + 4], str.gjigojfd3HJ
mov dword [esp + 8], str.FJIfjoi3r4
mov dword [esp + 0xc], str.HFudfjifejifb
mov dword [esp + 0x10], str.jIOFjejioAD
mov dword [esp + 0x14], str.JfsiJSS
mov dword [esp + 0x18], str.HfhfioSjs
mov dword [esp + 0x1c], str.FHifsoSDks
mov dword [esp + 0x20], str.FJiofjs
mov dword [esp + 0x24], str.j5hfURWHIrwh
mov dword [esp + 0x28], 0
mov esi, dword [esp + eax*4 + 4]
lea ecx, [esp + 0x2c]
push esi
push str.Global_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, dword [esp + 0x430]
test eax, eax
mov dword [esi], eax
jne 0x407c09
or eax, 0xffffffff
pop esi
add esp, 0x428
ret
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x407c29
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x428
ret
mov eax, 1
pop esi
add esp, 0x428
ret

Function at 0x408080
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
jne 0x408094
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov edi, dword [esi]
mov ebp, dword [esi + 4]
test edi, edi
jne 0x4080a5
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0xc
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x4080c4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov ecx, dword [esp + 0x18]
push 0
push 0
push eax
push 0x407c40
push 0
push 0
mov dword [eax], edi
mov dword [eax + 8], ebp
mov dword [eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4081f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x400
lea eax, [esp]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x404]
push ecx
push 0x114e
call fcn.00405620
add esp, 8
lea edx, [esp]
push 5
push 0
push 0
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x400
ret

Function at 0x408380
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x44c
lea eax, [esp]
push esi
push edi
push 0
push 0x21
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40845d
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push str.adtxt
call esi
lea ecx, [esp + 8]
mov edi, eax
push ecx
call esi
add edi, eax
cmp edi, 0x104
jge 0x40845d
lea edx, [esp + 8]
lea eax, [esp + 0x10c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10c]
push str.adtxt
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x210]
lea eax, [esp + 0x10c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40845d
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x244]
lea edx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x360]
push str._s_s
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x358]
push ecx
call ebx
lea edx, [esp + 0x218]
push edx
push esi
call ebp
test eax, eax
jne 0x40841c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x44c
ret

Function at 0x408470
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x44c
lea eax, [esp + 0x348]
push ebp
push esi
mov esi, dword [esp + 0x458]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str._s
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0xc]
lea edx, [esp + 0x354]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x408538
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x408531
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x408520
cmp byte [esp + 0x3c], 0x2e
je 0x408520
lea ecx, [esp + 0x3c]
cmp eax, 0x10
push ecx
push esi
push str._s_s
jne 0x408509
lea edx, [esp + 0x15c]
push edx
call edi
lea eax, [esp + 0x160]
push eax
call fcn.00408470
add esp, 0x14
jmp 0x408520
lea edx, [esp + 0x260]
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x254]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4084ce
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
add esp, 0x44c
ret
Function at 0x408550
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
push edi
mov edi, dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
xor esi, esi
push eax
push esi
push esi
mov dword [esp + 0x18], esi
call edi
mov ebx, eax
test ebx, ebx
jne 0x4085c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4085c1
test esi, esi
je 0x40858e
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0xc]
inc ecx
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408627
lea edx, [esp + 0xc]
mov dword [esi], 0x50
push edx
push esi
push 0
call edi
mov ebx, eax
test ebx, ebx
je 0x40856f
jmp 0x4085c5
test ebx, ebx
je 0x408632
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [esp + 0x10]
push ecx
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
jne 0x4085cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x408622
mov edx, dword [esp + 0x10]
inc edx
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x408626
lea eax, [esp + 0x10]
mov dword [esi], 0x50
push eax
push esi
push ebx
call ebp
mov edi, eax
test edi, edi
je 0x4085e5
jmp 0x4085cc
test edi, edi
jne 0x4085cc
pop ebp
test ebx, ebx
je 0x408632
push ebx
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
test esi, esi
je 0x408646
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x408650
Capabilities:
Get common file path
Get session user name

Disassembly:
sub esp, 0x418
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [esp + 0x214]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x110]
mov edx, 0x104
push eax
push ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], edx
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
test eax, eax
pop edi
je 0x4086e9
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4086e9
lea ecx, [esp + 8]
lea edx, [esp + 0x10c]
push ecx
push edx
lea eax, [esp + 0x218]
push str._s_sApplication_DataMacromediaFlash_Player_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x220]
push ecx
call fcn.00408470
add esp, 0x14
add esp, 0x418
ret
Function at 0x4086f0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push 0
push str.32770
push 0
push 0
mov dword [esp + 0x20], eax
call esi
mov edi, eax
test edi, edi
je 0x4087e6
mov ebp, dword [sym.imp.USER32.dll_SetActiveWindow]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push edi
call dword [sym.imp.USER32.dll_GetParent]
lea eax, [esp + 0x14]
push 0x400
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x14]
push str.Internet_Explorer
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
jne 0x408769
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 1
jge 0x4087cc
push 0x416760
push str.Button
push 0
push edi
call esi
mov esi, eax
test esi, esi
je 0x4087c6
push edi
call ebp
push 0
push 0
push 0xd
push esi
call ebx
push 0
push 0
push 0x201
push esi
call ebx
push 0
push 0
push 0x202
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
je 0x4087c6
push 0x416760
push str.Button
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExA]
mov esi, eax
test esi, esi
jne 0x40877e
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
test edi, edi
je 0x4087e6
push 0
push str.32770
push edi
push 0
call esi
mov edi, eax
test edi, edi
jne 0x40872d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x404
ret

Function at 0x408800
Capabilities:
Get graphical window text

Disassembly:
push ebx
push edi
call fcn.004086f0
push str.Adobe_Flash_Player_9
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov ebx, eax
test ebx, ebx
je 0x4088e8
push str.Yes
push str.Button
push 0
push ebx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov edi, eax
test edi, edi
je 0x4088e8
push ebp
mov ebp, dword [sym.imp.USER32.dll_SetActiveWindow]
push esi
push ebx
call ebp
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xd
push ebx
call esi
push 0
push 0
push 0xd
push edi
call esi
push 0
push 0
push 0x201
push edi
call esi
push 0
push 0
push 0x202
push edi
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call ebp
push 0
push 0
push 0xd
push ebx
call esi
push 0
push 0
push 0xd
push edi
call esi
push 0
push 0
push 0x201
push edi
call esi
push 0
push 0
push 0x202
push edi
call esi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call ebp
push 0
push 0
push 0xd
push ebx
call esi
push 0
push 0
push 0xd
push edi
call esi
push 0
push 0
push 0x201
push edi
call esi
push 0
push 0
push 0x202
push edi
call esi
pop esi
pop ebp
pop edi
pop ebx
ret
Function at 0x408960
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push edi
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push 0x80000001
mov dword [esp + 0x24], 3
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4089b7
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.2500
push edx
call edi
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0xc]
push ecx
push 2
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call esi
test eax, eax
jne 0x4089f5
lea edx, [esp + 0x10]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x1c]
push str.NoProtectedModeBanner
push eax
mov dword [esp + 0x28], 1
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x408ea0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 2
push 0
push str.SoftwareMicrosoftInternet_ExplorerNew_Windows
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408ee3
mov edx, dword [esp]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push eax
push str.PopupMgr
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
pop ecx
ret

Function at 0x408ef0
Capabilities:
Set registry value

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408f66
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push 0x416980
call esi
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 0x416980
push 1
push 0
push str.DisableScriptDebuggerIE
push ecx
call edi
push 0x416964
call esi
mov edx, dword [esp + 8]
push eax
push 0x416964
push 1
push 0
push str.Error_Dlg_Displayed_On_Every_Error
push edx
call edi
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x40a730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, 4
mov dword [esp], 0
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40a791
mov dword [esp], 0xffffffff
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40a7a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp]
add esp, 0xc
ret

Function at 0x40a7b0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0xc]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x41a27c
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x10]
mov eax, dword [esp]
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
test eax, eax
je 0x40a80d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret

Function at 0x40a820
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push ecx
push edx
mov dword [esp + 0x18], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a882
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x20]
push edi
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a872
mov esi, dword [edi]
mov eax, dword [esp + 0x14]
pop edi
test eax, eax
je 0x40a882
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret

Function at 0x40a890
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push esi
lea ecx, [esp + 4]
xor esi, esi
push eax
mov eax, dword [esp + 0x10]
push ecx
push esi
push 0x20006
push esi
push 0x41a27c
push esi
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a8fc
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 8]
push edx
push 3
push eax
mov eax, dword [esp + 0x24]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40a8ed
mov esi, 1
mov eax, dword [esp + 4]
test eax, eax
je 0x40a8fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ecx
ret
Function at 0x40ab70
Capabilities:
Reference the vmware io port

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413430
push 0x40b75c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push ebx
mov eax, 0x564d5868
mov ebx, 0x8685d465
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov dword [ebp - 0x1c], ebx
pop ebx
mov dword [ebp - 4], 0xffffffff
xor eax, eax
cmp dword [ebp - 0x1c], 0x564d5868
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c30
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1003e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x1003e6a8]
lea eax, [ebp - 0x10]
push esi
push edi
push eax
mov dword [ebp - 0x24], ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10001ddc
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10001ddc
push 0x38
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [0x1003e6a8]
add esp, 4
mov edi, eax
test esi, esi
je 0x10001cd3
movsx edx, word [esi + 0x5ea4]
lea eax, [esi + 0x5ea8]
mov ecx, dword [esi + 0x3f10]
lea eax, [eax + edx*8]
cmp dword [eax], ecx
je 0x10001cc9
lea eax, [edx + 1]
mov dword [ebp - 0x1c], 6
cdq
idiv dword [ebp - 0x1c]
movzx eax, dx
mov word [esi + 0x5ea4], ax
cwde
add eax, 0xbd5
lea eax, [esi + eax*8]
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
inc word [eax + 4]
inc dword [esi + 0x5e9c]
test edi, edi
je 0x10001ce6
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10001ce8
xor edi, edi
or dword [ebx + 0xc], 6
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x6c], str.imgui_impl_win32
mov ebx, dword [ebp - 0x24]
mov dword [edi], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
test esi, esi
je 0x10001d23
mov esi, dword [esi + 0x74]
jmp 0x10001d25
xor esi, esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 4
add esi, 0x24
shr eax, 0x10
push esi
push 0x20001004
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x10001d48
mov dword [esi], eax
mov eax, dword [0x1003e6a8]
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov eax, dword [eax + 0x4a28]
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
mov eax, dword [eax]
mov dword [eax + 0x24], ebx
mov byte [edi + 0x29], 1
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x10001daa
inc esi
cmp esi, 5
jl 0x10001d81
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033dd8
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x2c], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x30], eax
call esi
mov dword [edi + 0x34], eax
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033dd8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10033dd8
mov esp, ebp
pop ebp
ret
Function at 0x10003e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034ce0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1003e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
lea edi, [esi + 0x38]
mov dword [esi + 8], 0
lea eax, [edi + 0x10]
mov dword [esi + 0xc], 0
xorps xmm0, xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
movups xmmword [esi], xmm0
mov dword [ebp - 0x10], edi
movups xmmword [esi + 0x10], xmm0
movq qword [esi + 0x20], xmm0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x10003efa
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.1001bf60
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
movups xmmword [esi + 0x70], xmm0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret