joyce8/EMBER2024-capa huggingface dataset:
Function at 0x640170a0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x6414239b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x6419e6d0]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov eax, dword [esp + 0x248]
mov edi, ecx
lea ecx, [esp + 0x20]
push ecx
push edi
mov dword [esp + 0x30], eax
mov byte [esp + 0x1b], 0
mov dword [esp + 0x28], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x64017211
push esi
call fcn.6411a0b1
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x6401711f
xor al, al
jmp 0x64017215
mov edx, dword [esp + 0x20]
push ebp
push esi
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x64017208
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
push ecx
push str.VarFileInfoTranslation
push ebp
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x64017208
mov eax, dword [esp + 0x24]
movzx esi, word [eax]
movzx edi, word [eax + 2]
lea ecx, [esp + 0x14]
call fcn.64002b00
push ebx
movzx edx, di
push edx
movzx eax, si
push eax
lea ecx, [esp + 0x20]
push str.StringFileInfo_04x_04x_s
push ecx
mov dword [esp + 0x254], 0
call fcn.64002da0
mov esi, dword [esp + 0x28]
push esi
lea edx, [esp + 0x44]
push 0x104
push edx
call fcn.6411a535
add esp, 0x20
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push ebp
mov dword [esp + 0x2c], 0
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x640171e1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push 0x40
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [esp + 0x13], 1
lea eax, [esi - 0x10]
mov dword [esp + 0x240], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x64017208
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
call fcn.6411a269
add esp, 4
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.64119c23
add esp, 0x234
ret
Function at 0x64017fc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
mov edi, ecx
mov dword [edi + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [edi + 0x14], ecx
mov edx, dword [esi + 8]
mov dword [edi + 0x18], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 0x1c], eax
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x640180f4
cmp dword [edi + 4], 0
jne 0x640180eb
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.USER32.dll_OffsetRect]
test eax, 0x100
jne 0x6401805f
test al, 1
je 0x6401805f
mov edx, eax
and edx, 0x30
cmp dl, 0x30
jne 0x6401803b
mov eax, dword [esi + 8]
sub eax, dword [esi]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
cdq
sub eax, edx
sar eax, 1
jmp 0x6401804c
test al, 0x20
je 0x64018052
mov eax, dword [esi + 8]
sub eax, dword [esi]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
push 0
push eax
push esi
call ebx
mov ecx, dword [esi]
sub ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x18]
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
test eax, 0x200
jne 0x640180b5
test al, 4
je 0x640180b5
mov edx, eax
and edx, 0xc0
cmp dl, 0xc0
jne 0x6401808f
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x14]
cdq
sub eax, edx
sar eax, 1
jmp 0x640180a1
test al, al
jns 0x640180a7
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x14]
push eax
push 0
push esi
call ebx
mov ecx, dword [esi + 4]
sub ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x1c]
mov dword [esi + 0xc], ecx
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
push 0
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [edi + 0x3c]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [edi + 0x3c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x64018ea0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x64142ff8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6419e6d0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CCeiLayout.0
mov dword [esp + 0x18], 0
cmp dword [esi + 0x34], 0
mov dword [esi + 0x30], vtable.CArray_class_CCeiPaneObject__class_CCeiPaneObject_const__.0
je 0x64018f11
xor edi, edi
cmp dword [esi + 0x38], edi
jle 0x64018f05
jmp 0x64018ef0
mov eax, dword [esi + 0x34]
mov edx, dword [eax + edi*8]
lea ecx, [eax + edi*8]
mov eax, dword [edx]
push 0
call eax
inc edi
cmp edi, dword [esi + 0x38]
jl 0x64018ef0
mov eax, dword [esi + 0x34]
push eax
call fcn.6401c80c
add esp, 4
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esi + 0x24]
mov dword [esi], vtable.ICeiPane.0
mov dword [ecx], vtable.CBrush.0
call fcn.64002dd0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x6401ff45
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.640283ba
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x6401ff7e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.6401fb91
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x6401ffdc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x64020000
cmp dword [edi + 0x54], 0
jne 0x64020000
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.640283ba
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.6401ff9d
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x640266ce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x64026715
call fcn.640283ba
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x64026715
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x64026731
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.64026246
mov esi, eax
test edi, edi
je 0x6402672f
test ebx, ebx
je 0x6402672f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x64026f15
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x64135023
call fcn.6411b712
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x64026f3a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x64026f80
lea ecx, [ebp - 0x10]
call fcn.64002b00
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.6401cd6a
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.64002b70
mov eax, esi
call fcn.6411b7ea
ret 8
Function at 0x6402c38a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x6402c3d2
call fcn.640283ba
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x6402c3d2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x6402c415
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x6402c3fe
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x6402c3fe
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x6402c412
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x64035177
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6419e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [ebp + 8]
lea eax, [edi - 0x60]
mov ebx, 0x8000
cmp eax, 9
ja 0x640351b0
push 0x12
call esi
mov ecx, ebx
test cx, ax
je 0x640351d7
cmp dword [0x641a2900], 0
jne 0x640351d7
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x640351ca
push 0x12
call esi
test bx, ax
je 0x640351ce
mov eax, edi
jmp 0x64035246
push edi
call fcn.6411e29b
pop ecx
jmp 0x64035246
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.6411bc30
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x64035200
call fcn.6401d5d9
call fcn.6402cbeb
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64119c23
leave
ret 4
Function at 0x640450d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
movzx ebx, word [ebp + 8]
push esi
push edi
mov edi, ecx
test ebx, ebx
jne 0x640450ee
call fcn.6401d5d9
call fcn.640283ba
mov esi, dword [eax + 0xc]
push 0xf1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x6404510e
xor eax, eax
jmp 0x64045229
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x64045107
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x64045107
movzx eax, word [esi + 6]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.6401c7d2
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x640450e9
cmp dword [ebp + 0x10], 0
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 6]
lea edx, [eax + 6]
push ebx
push edx
je 0x6404516b
mov ecx, edi
call fcn.6403dcd2
jmp 0x64045170
call fcn.6403dbbc
mov eax, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
cmp dword [eax + 4], 0
jne 0x64045182
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
cmp dword [edi + 0xbe0], 0
jne 0x6404519d
push dword [ebp + 0x10]
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x310]
test eax, eax
je 0x64045215
mov eax, dword [edi + 0xad0]
mov dword [ebp + 0xc], eax
xor eax, eax
xor ebx, ebx
cmp ax, word [esi + 6]
jae 0x640451ec
lea eax, [esi + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 8]
mov dword [ecx + ebx*4], eax
jne 0x640451df
test eax, eax
jbe 0x640451df
push eax
mov ecx, 0x6419b1d4
call fcn.64082cd3
mov ecx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov dword [eax], ecx
movzx eax, word [esi + 6]
add dword [ebp - 4], 2
inc ebx
cmp ebx, eax
jl 0x640451b6
mov eax, dword [ebp + 8]
mov dword [edi + 0xbe0], eax
movzx ecx, word [esi + 6]
mov eax, dword [edi]
push 1
push ecx
push dword [ebp - 8]
mov ecx, edi
call dword [eax + 0x318]
mov ebx, eax
test ebx, ebx
jne 0x64045215
and dword [edi + 0xbe0], eax
push dword [ebp - 8]
call fcn.6401c80c
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x6404acaf
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x6404adf0
push esi
push edi
push 0x6414e2a0
call fcn.6402952d
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x6404ad3f
mov esi, dword [ebx + 0x168]
jmp 0x6404ad2b
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x6404ad2b
push edi
call fcn.6402331c
push eax
push 0x6419bf70
call fcn.6402954b
pop ecx
pop ecx
test eax, eax
je 0x6404ad2b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x6404ad2b
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x6404aceb
lea ecx, [ebx + 0x164]
call fcn.6404ff11
jmp 0x6404adee
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x6404adee
jmp 0x6404ad55
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.6402b158
mov esi, dword [eax]
test esi, esi
jne 0x6404ad6e
xor ebx, ebx
jmp 0x6404ad71
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x6404ade4
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x6404ade4
test edi, edi
je 0x6404adb6
push esi
push 0x6419bf70
call fcn.6402954b
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x64158844
call fcn.6402954b
pop ecx
pop ecx
test eax, eax
je 0x6404ade4
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.6404a201
test eax, eax
jne 0x6404ade4
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.6404a1d1
cmp dword [ebp - 8], 0
jne 0x6404ad52
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x6404f3e2
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6419e6d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x208], esi
call fcn.6404ee90
mov ebx, eax
cmp ebx, esi
je 0x6404f44f
lea ecx, [ebp - 0x20c]
call fcn.6402dd11
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.64119c23
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x6404f46d
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x20c]
call fcn.6404f3e2
cmp eax, esi
jne 0x6404f4b4
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x20c]
mov dword [ebp - 0x210], 0x100
call ebx
test eax, eax
je 0x6404f457
lea ecx, [ebp - 0x20c]
call fcn.6402dd11
push dword [ebp - 0x214]
mov ecx, edi
call fcn.6404ee31
lea ecx, [ebp - 0x20c]
mov esi, eax
call fcn.6402dd11
mov eax, esi
jmp 0x6404f43e
Function at 0x640520c2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp dword [0x641a2668], 0
mov dword [ebp - 4], ecx
jne 0x640520d8
xor eax, eax
jmp 0x64052112
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x640520e8
call fcn.640283ba
mov esi, dword [eax + 0xc]
push edi
push dword [0x641a33e8]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x6405210e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x64052116
xor eax, eax
pop edi
pop esi
leave
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x64052134
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x64052110
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.64051fe4
mov esi, eax
jmp 0x64052126
Function at 0x64064f65
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
push str.UxTheme.dll
mov dword [esi], vtable.CMFCBaseVisualManager.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
call fcn.640327c7
pop ecx
mov dword [esi + 0x48], eax
cmp eax, edi
je 0x64065020
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.OpenThemeData
push eax
call edi
push str.CloseThemeData
push dword [esi + 0x48]
mov dword [esi + 0x4c], eax
call edi
push str.DrawThemeBackground
push dword [esi + 0x48]
mov dword [esi + 0x50], eax
call edi
push str.GetThemeColor
push dword [esi + 0x48]
mov dword [esi + 0x54], eax
call edi
push str.GetThemeSysColor
push dword [esi + 0x48]
mov dword [esi + 0x58], eax
call edi
push str.GetCurrentThemeName
push dword [esi + 0x48]
mov dword [esi + 0x5c], eax
call edi
push 0x6414dc00
push dword [esi + 0x48]
mov dword [esi + 0x60], eax
call edi
mov ecx, esi
mov dword [esi + 0x64], eax
call fcn.64064af6
jmp 0x64065035
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
pop edi
mov eax, esi
pop esi
ret
Function at 0x6407ecd5
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x6413abbb
call fcn.6411b745
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 0xc]
call fcn.6403e895
test eax, eax
je 0x6407eea4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
lea ecx, [esi + 4]
xor edi, edi
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
call fcn.6407ea5b
test eax, eax
je 0x6407ed1b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.64002b00
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.64002ca0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.6401f2c9
lea ecx, [ebp - 0x14]
call fcn.64002b00
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.64002ca0
push eax
push edi
push 0x64152468
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.6401f2c9
push edi
push 0x4000100
push 2
push edi
push edi
push 0xc0000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x6407ee8e
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.6405d168
push edi
push 0x1000
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.640291fa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [eax + 0x20], ebx
mov eax, dword [ecx]
push edx
mov byte [ebp - 4], 4
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.64028a72
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x88]
mov dword [eax + 0x20], edi
mov byte [ebp - 4], 3
call fcn.6402916c
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.6405d289
mov ecx, dword [ebp - 0x24]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call fcn.640447e6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [eax], esi
call fcn.64002b70
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.64002b70
mov eax, ebx
jmp 0x6407eea6
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.64002b70
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.64002b70
xor eax, eax
call fcn.6411b7ea
ret 8
Function at 0x6408b134
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.64024d78
call fcn.6401c8ba
cmp eax, esi
pop esi
jne 0x6408b150
mov ecx, 0x641a2500
jmp fcn.6403336f
ret
Function at 0x6408e19d
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push 0x74
mov eax, 0x6413b272
call fcn.6411b77b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x80], eax
call fcn.64002b00
mov esi, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
cmp esi, 0x13
jne 0x6408e1cb
push str.Pause
jmp 0x6408e20e
push 0x66
lea eax, [ebp - 0x78]
push edi
push eax
call fcn.6411bc30
add esp, 0xc
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
shl eax, 0x10
add esi, 0xffffffdf
or eax, 1
cmp esi, 0xe
ja 0x6408e1fd
or eax, 0x1000000
push 0x32
lea ecx, [ebp - 0x78]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x7c]
call fcn.64002970
lea ecx, [ebp - 0x7c]
call fcn.64065b56
mov esi, dword [ebp - 0x7c]
cmp dword [esi - 0xc], edi
jle 0x6408e25f
push edi
lea ecx, [ebp - 0x7c]
call fcn.64031eb4
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_IsCharLowerW]
test eax, eax
jne 0x6408e245
inc edi
cmp edi, dword [esi - 0xc]
jl 0x6408e226
jmp 0x6408e25f
movzx eax, bx
push eax
call fcn.6411e29b
pop ecx
movzx eax, ax
push eax
push edi
lea ecx, [ebp - 0x7c]
call fcn.6405cd44
mov esi, dword [ebp - 0x7c]
push dword [esi - 0xc]
mov ecx, dword [ebp - 0x80]
push esi
call fcn.64005830
cmp dword [ebp + 0x10], 0
jne 0x6408e27b
mov ecx, dword [ebp - 0x80]
push 0x2b
call fcn.6401cfaf
lea ecx, [esi - 0x10]
call fcn.64002b70
call fcn.6411b7fe
ret 0xc