joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a002d20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
lea eax, [ebp - 0x20c]
xor ebx, ebx
test ecx, ecx
push 0x104
setne bl
push eax
push str._HncBinProofToolsDics_
lea ebx, [ebx*2 + 0x8000]
call esi
push str.hnchjsys.dic
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x180
push 0x10
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1a024064
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wsopen_s]
add esp, 0x20
test eax, eax
je 0x1a002de3
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str._AllUserDataUserSharedDics_
call esi
push str.hjuser6.dic
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x180
push 0x10
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x1a024064
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wsopen_s]
add esp, 0x20
test eax, eax
jne 0x1a002e94
push 0x400
push 0x1a02b6f0
push dword [0x1a024064]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 0x400
jne 0x1a002e7b
mov ecx, 0x1a02b6f0
mov edx, str.HWP_Hanja_Dic
mov esi, 0x1c
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1a002e7b
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1a002e12
cmp byte [0x1a02b710], 4
jne 0x1a002e7b
mov edx, 1
mov dword [0x1a02bafc], 1
mov dword [0x1a02baf8], 0xd
mov ecx, edx
mov dword [0x1a02bf00], 0
movzx eax, byte [ecx + 0x1a02b717]
inc ecx
add edx, eax
cmp ecx, 0xd
jle 0x1a002e51
pop esi
mov dword [0x1a02baf4], edx
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
push dword [0x1a024064]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov dword [0x1a024064], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret

Function at 0x1a002eb0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [0x1a024064]
cmp ecx, 0xffffffff
je 0x1a002f13
mov eax, dword [0x1a02bf00]
cmp edi, eax
je 0x1a002f15
push esi
mov esi, edi
push 0
shl esi, 0xa
push esi
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
add esp, 0xc
cmp eax, esi
pop esi
jne 0x1a002f09
push 0x400
push 0x1a02bb00
push dword [0x1a024064]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 0x400
jne 0x1a002f09
mov dword [0x1a02bf00], edi
mov eax, edi
pop edi
ret
mov dword [0x1a02bf00], 0
xor eax, eax
pop edi
ret
Function at 0x1a0036f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x338], ecx
mov eax, 0x190
mov dword [ebp - 0x330], esi
cdq
lea ebx, [ebp - 0x328]
idiv esi
lea eax, [ebp - 8]
add edx, edx
sub eax, edx
mov edx, esi
push edi
mov dword [ebp - 0x33c], eax
call fcn.1a002bb0
mov edi, eax
test edi, edi
je 0x1a0038d3
mov ecx, dword [0x1a02bf00]
cmp dword [0x1a024064], 0xffffffff
jne 0x1a003753
xor eax, eax
jmp 0x1a0037aa
cmp edi, ecx
je 0x1a0037a8
mov esi, edi
push 0
shl esi, 0xa
push esi
push dword [0x1a024064]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
add esp, 0xc
cmp eax, esi
jne 0x1a00379c
push 0x400
push 0x1a02bb00
push dword [0x1a024064]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
add esp, 0xc
cmp eax, 0x400
jne 0x1a00379c
mov ecx, edi
mov dword [0x1a02bf00], ecx
jmp 0x1a0037b2
xor ecx, ecx
xor eax, eax
mov dword [0x1a02bf00], ecx
jmp 0x1a0037aa
mov eax, ecx
cmp eax, edi
jne 0x1a0038d3
movzx eax, word [0x1a02bb00]
mov esi, 0x1a02bb04
mov edx, dword [ebp - 0x330]
imul eax, edx
lea eax, [eax*2 + 0x1a02bb04]
mov dword [ebp - 0x32c], eax
cmp eax, esi
jbe 0x1a003870
nop dword [eax]
push edx
lea edi, [edx + edx]
push esi
push dword [ebp - 0x338]
lea eax, [edi + esi]
mov dword [ebp - 0x334], eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
mov esi, dword [ebp - 0x334]
add esp, 0xc
test eax, eax
je 0x1a003817
cmp esi, dword [ebp - 0x32c]
jae 0x1a00386a
mov edx, dword [ebp - 0x330]
jmp 0x1a0037e0
mov ecx, 0xac00
nop dword [eax]
movzx eax, word [esi]
cmp cx, ax
ja 0x1a003832
mov edx, 0xd7a3
cmp dx, ax
jae 0x1a003858
cmp esi, dword [ebp - 0x32c]
jae 0x1a00386a
cmp ebx, dword [ebp - 0x33c]
jae 0x1a003854
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov ecx, 0xac00
add ebx, edi
add esi, edi
jmp 0x1a003820
mov edx, dword [ebp - 0x330]
cmp esi, dword [ebp - 0x32c]
jb 0x1a0037e0
mov ecx, dword [0x1a02bf00]
movzx edi, word [0x1a02bb02]
test edi, edi
jne 0x1a003746
lea eax, [ebp - 0x328]
cmp ebx, eax
je 0x1a0038d3
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x328]
sub ebx, eax
add ebx, 2
sar ebx, 1
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1a0038d3
lea eax, [ebp - 0x328]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
Function at 0x1a0046a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, cx
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
mov byte [ebp + 0xf], al
push ebx
mov bl, dl
cmp al, 2
jne 0x1a0046c6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets byte [ebp + 0xf]
lea edx, [ebp + 0xf]
lea ecx, [ebp - 4]
call fcn.1a0045e0
mov ecx, dword [ebp - 4]
cmp cx, 0x7f
ja 0x1a004746
mov edx, dword [ebp + 8]
push esi
test edx, edx
je 0x1a0046f6
lea eax, [ebx - 0x60]
cmp al, 9
ja 0x1a0046f6
movzx ecx, bl
lea eax, [ecx - 0x30]
movzx esi, ax
mov eax, ecx
jmp 0x1a00470b
movzx eax, byte [ebp + 0xf]
movzx ecx, cx
lea eax, [eax + ecx*2]
movzx esi, word [eax*2 + 0x1a01da98]
movzx eax, bl
movzx eax, ax
mov dword [ebp + 0xc], eax
test si, si
jne 0x1a00473d
test edx, edx
jne 0x1a00473d
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1a00473d
sub bl, 0x30
cmp bl, 9
ja 0x1a00473d
mov eax, dword [ebp + 0xc]
pop esi
movzx eax, ax
pop ebx
mov esp, ebp
pop ebp
ret
mov ax, si
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1a00c680
Capabilities:
Get common file path
Hide graphical window
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x664
mov eax, dword [0x1a02400c]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1a00c8a4
cmp byte [0x1a02bf44], al
jne 0x1a00c6d6
mov byte [0x1a02bf44], 1
call dword [sym.imp.HncFoundation.dll_class_Hnc::Framework____cdecl_Hnc::GetFramework_void_]
mov ecx, eax
call dword [sym.imp.HncFoundation.dll_public:_bool___thiscall_Hnc::Framework::IsKoKR_void_const]
mov byte [0x1a02bf45], al
cmp dword [0x1a02b618], 0
jne 0x1a00c76d
mov edi, dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
push 0x104
lea eax, [esp + 0x54]
movq qword [esp + 0x1c], xmm0
push eax
push str._Common_
mov dword [esp + 0x1c], 0
call edi
lea eax, [esp + 0x460]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [esp + 0x50]
push eax
call esi
push 0x104
lea eax, [esp + 0x25c]
push eax
push str.HimCfgDlg._DsoExt
call edi
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.HncFoundation.dll_HncLoadLibrary]
mov dword [0x1a02b618], eax
lea eax, [esp + 0x460]
push eax
call esi
lea ecx, [esp + 0x10]
call fcn.1a0020a0
call fcn.1a00c420
push 0
push dword [0x1a024040]
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
push 0
push 0
push 0x80400000
push 0x1a01f070
push str.HncInputManager130
push 0x180
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x1a02b604], eax
test eax, eax
je 0x1a00c8a9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_UpdateWindow]
push dword [0x1a02b604]
call sym.HncIMM.dll__HimSysIMEDestroy_4
mov eax, dword [0x1a02b604]
test eax, eax
je 0x1a00c8a9
push 0x223c
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x1a00c8a4
mov ecx, ebx
call fcn.1a0169c0
push 0x223c
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 4], 0xffffffff
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a00c829
mov dword [eax], esi
lea ecx, [esp + 0x20]
call fcn.1a006320
mov edx, dword [esp + 0x20]
mov eax, 0x804
mov ecx, edx
sar ecx, 0x10
movzx esi, cl
and cl, 0xf
cmp dx, ax
je 0x1a00c858
movzx eax, dx
mov edi, 0x81e
cmp ax, di
jne 0x1a00c86a
movzx eax, dx
cmp cl, 2
jne 0x1a00c86a
mov esi, 2
mov eax, 0x81e
movzx eax, ax
push eax
push 0x40008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
test eax, eax
jne 0x1a00c88f
push 0x800
push 0x40008
jmp 0x1a00c898
movzx eax, si
push eax
push 0x70008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
mov eax, dword [0x1a02b604]
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
Function at 0x1a00d4e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x634], 0
push 0x208
mov dword [ebp - 0x630], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x41c]
movq qword [ebp - 0x62c], xmm0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x624]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
lea eax, [ebp - 0x41c]
push 0x104
push eax
push str._HncBin_
call dword [sym.imp.HncFoundation.dll_HncPathToAbsolute]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x41c]
push str.KeyLayout.exe
push 0x104
push eax
call esi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x624]
push 0x104
push eax
call edi
add esp, 0x18
push 0
push str.HNCUKL_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x1a00d672
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
call edi
push 0x1a01f878
lea eax, [ebp - 0x214]
push 0x104
push eax
call esi
push str.HwpApp_:_6.0
lea eax, [ebp - 0x214]
push 0x104
push eax
call esi
push 0x1a01f880
lea eax, [ebp - 0x214]
push 0x104
push eax
call esi
add esp, 0x30
mov dword [ebp - 0x67c], 0x44
xor eax, eax
mov dword [ebp - 0x678], 0
mov word [ebp - 0x64a], ax
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x648], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1a00d6ab
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x1a00d69f
push 9
push esi
call edi
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x634]
xor esi, esi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test ecx, ecx
jle 0x1a00d6e9
nop dword [eax]
mov eax, dword [ebp - 0x630]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x1a00d6e4
sub eax, 8
cmp dword [eax], 0xdddd
jne 0x1a00d6e4
push eax
call edi
mov ecx, dword [ebp - 0x634]
add esp, 4
inc esi
cmp esi, ecx
jl 0x1a00d6c0
cmp ecx, 2
jle 0x1a00d6f9
push dword [ebp - 0x630]
call edi
add esp, 4
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
Function at 0x1a0137a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1a024024]
sub esp, 8
xor ecx, ecx
push ebx
push esi
cmp eax, 0x3c
ja 0x1a0137bc
movzx ecx, word [eax*2 + 0x1a01da18]
movzx eax, cx
add eax, 0xffffff5e
cmp eax, 3
ja case.default.0x1a0137c9
jmp dword [eax*4 + 0x1a013924]
mov esi, 0x11
push 0x11
jmp 0x1a0138b3
mov ecx, 0x12
movzx esi, cx
mov edx, 3
mov dword [ebp - 4], edx
test cx, cx
je 0x1a01391b
cmp cx, 0x10
je 0x1a0138ad
mov eax, 0xa0
cmp cx, ax
je 0x1a0138ad
mov eax, 0xa1
cmp cx, ax
je 0x1a0138ad
cmp cx, 0x11
je 0x1a0137d5
mov eax, 0xa2
cmp cx, ax
je 0x1a0137d5
mov eax, 0xa3
cmp cx, ax
je 0x1a0137d5
cmp cx, 0x12
je 0x1a0138a9
mov eax, 0xa4
cmp cx, ax
je 0x1a0138a9
mov eax, 0xa5
cmp cx, ax
je 0x1a0138a9
cmp cx, 0x1b
jne 0x1a0138c5
mov ecx, str.SoftKeyboard
mov dword [ebp - 4], 0
call fcn.1a010a80
mov esi, eax
test esi, esi
je 0x1a01388d
push 0
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.View
push esi
call dword [sym.imp.HncFoundation.dll_HncRegSetValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
cmp dword [ebp - 4], 0
je 0x1a01389e
call fcn.1a013fe0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1a014060
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x12
jmp 0x1a0138b3
mov esi, 0x10
push esi
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
test ax, ax
setns dl
inc edx
mov dword [ebp - 4], edx
xor ecx, ecx
xor eax, eax
nop dword [eax]
cmp si, word [eax*4 + 0x1a01d930]
je 0x1a0138e2
inc eax
cmp eax, 0x39
jl 0x1a0138d0
jmp 0x1a0138ea
movzx ecx, word [eax*4 + 0x1a01d932]
test dl, 2
je 0x1a013905
push 0
push 0
mov bl, cl
push ebx
push esi
call dword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [ebp - 4]
mov byte [ebp - 8], bl
jmp 0x1a013908
mov byte [ebp - 8], cl
test dl, 1
je 0x1a01391b
push 0
push 2
push dword [ebp - 8]
push esi
call dword [sym.imp.USER32.dll_keybd_event]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1a014060
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push dword [0x1a02d804]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1a014123
xor ecx, ecx
call fcn.1a0144a0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyExW]
test ax, ax
jns 0x1a0140bb
push 0
push 0
push 0
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0
push 2
push 0
push 0
push 0x10
call edi
push eax
push 0x10
call esi
push 0x11
call ebx
test ax, ax
jns 0x1a0140e6
push 0
push 0
push 0
push 0
push 0x11
call edi
push eax
push 0x11
call esi
push 0
push 2
push 0
push 0
push 0x11
call edi
push eax
push 0x11
call esi
push 0x12
call ebx
test ax, ax
jns 0x1a014111
push 0
push 0
push 0
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 2
push 0
push 0
push 0x12
call edi
push eax
push 0x12
call esi
push 0
push 0
push 0x10
push dword [0x1a02d804]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
ret
Function at 0x1a014930
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov ecx, str.SoftKeyboard
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], 4
call fcn.1a010b30
mov edi, eax
test edi, edi
je 0x1a014984
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.View
push edi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push edi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
cmp dword [ebp - 4], 0
je 0x1a0149d8
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a0149a7
mov eax, dword [eax]
test eax, eax
je 0x1a0149a7
mov eax, dword [eax + 4]
jmp 0x1a0149ac
mov eax, 0x200800
mov ecx, 0x800
cmp cx, ax
je 0x1a0149d8
push 0
push 0x1d0040
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
test eax, eax
je 0x1a0149d8
test esi, esi
je 0x1a0149da
mov esi, 4
jmp 0x1a0149da
xor esi, esi
push dword [0x1a02d804]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1a014ada
test esi, esi
jne 0x1a014abc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push 0x10
call edi
mov ebx, dword [sym.imp.USER32.dll_keybd_event]
test ax, ax
jns 0x1a014a38
xor ecx, ecx
mov edx, 0x10
xor eax, eax
cmp dx, word [eax*4 + 0x1a01d930]
je 0x1a014a27
inc eax
cmp eax, 0x39
jl 0x1a014a15
jmp 0x1a014a2f
movzx ecx, word [eax*4 + 0x1a01d932]
push 0
push 2
push ecx
push 0x10
call ebx
push 0x11
call edi
test ax, ax
jns 0x1a014a73
xor ecx, ecx
mov edx, 0x11
xor eax, eax
nop word [eax + eax]
cmp dx, word [eax*4 + 0x1a01d930]
je 0x1a014a62
inc eax
cmp eax, 0x39
jl 0x1a014a50
jmp 0x1a014a6a
movzx ecx, word [eax*4 + 0x1a01d932]
push 0
push 2
push ecx
push 0x11
call ebx
push 0x12
call edi
test ax, ax
jns 0x1a014aa8
xor ecx, ecx
mov edx, 0x12
xor eax, eax
cmp dx, word [eax*4 + 0x1a01d930]
je 0x1a014a97
inc eax
cmp eax, 0x39
jl 0x1a014a85
jmp 0x1a014a9f
movzx ecx, word [eax*4 + 0x1a01d932]
push 0
push 2
push ecx
push 0x12
call ebx
pop ebx
push esi
push dword [0x1a02d804]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp esi, 4
jne 0x1a014aa9
push dword [0x1a02d804]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1a014aa9
pop edi
lea eax, [esi - 3]
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1a0158c0
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1a0158d9
push dword [ebp + 0x14]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
pop esi
pop ebp
ret 0x10
Function at 0x1a0169c0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x1a035340], 0
push edi
mov edi, ecx
jne 0x1a016bc4
push esi
mov esi, dword [sym.imp.HncFoundation.dll_HncGetWinVersion]
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], 0
call esi
cmp eax, 5
jne 0x1a016a0a
push 0
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionMSIME95K
jmp 0x1a016a27
call esi
push 0
cmp eax, 7
lea eax, [ebp - 4]
push eax
push 1
push 0
jne 0x1a016a22
push str.SoftwareMicrosoftWindowsIMEKR6.1
jmp 0x1a016a27
push str.SoftwareMicrosoftWindowsCurrentVersionIMEKoreaIMEKR98U
push 0x80000001
call dword [sym.imp.HncFoundation.dll_HncRegOpenKeyEx]
test eax, eax
jne 0x1a016a5e
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.InputMethod
push dword [ebp - 4]
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push dword [ebp - 4]
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov eax, dword [ebp - 8]
cmp eax, 0x64
jl 0x1a016a69
sub eax, 0x64
mov esi, dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x1a02b620], eax
call esi
mov dword [0x1a02b628], eax
call esi
mov dword [0x1a02b62c], eax
call esi
add eax, 0xfffffc5c
cmp eax, 0x12
ja case.0x1a016a95.933
movzx eax, byte [eax + 0x1a016be0]
jmp dword [eax*4 + 0x1a016bcc]
mov eax, 0x51
jmp 0x1a016aba
mov eax, 0x52
jmp 0x1a016aba
mov eax, 0x56
jmp 0x1a016aba
mov eax, 0x376
jmp 0x1a016aba
xor eax, eax
push 0
mov dword [0x1a02b630], eax
mov dword [0x1a02b634], 0
mov dword [0x1a02b63c], 0
mov dword [0x1a02b640], 1
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x1a02b644], eax
mov dword [0x1a02b648], 0x11
mov dword [0x1a02b64c], 4
mov dword [0x1a02b650], 0
mov dword [0x1a02b654], 0
call esi
add eax, 0xfffffc5c
pop esi
cmp eax, 0x12
ja case.0x1a016b26.933
movzx eax, byte [eax + 0x1a016c08]
jmp dword [eax*4 + 0x1a016bf4]
mov eax, 0x1a015320
jmp 0x1a016b47
mov eax, 0x1a0154a0
jmp 0x1a016b47
mov eax, 0x1a015620
jmp 0x1a016b47
mov eax, 0x1a015100
push edi
mov dword [0x1a02b660], eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov dword [0x1a02b640], eax
test eax, eax
je 0x1a016bc4
push 4
push dword [0x1a02b644]
call dword [sym.imp.IMM32.dll_ImmGetProperty]
push 0x1a02b64c
push 0x1a02b648
push dword [0x1a02b640]
mov dword [0x1a02b65c], eax
call dword [sym.imp.IMM32.dll_ImmGetConversionStatus]
push dword [0x1a02b64c]
mov dword [0x1a02b648], 0x11
push 0x11
push dword [0x1a02b640]
call dword [sym.imp.IMM32.dll_ImmSetConversionStatus]
push dword [0x1a02b640]
push edi
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
mov dword [0x1a034ae0], 0
mov dword [0x1a035340], 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1a01a5b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x1a01a5fa
sub eax, 1
je 0x1a01a5d3
sub eax, 2
jne 0x1a01a615
call fcn.1a0194d0
mov eax, 1
pop ebp
ret 0xc
push str.DllMain___:_DLL_PROCESS_ATTACH____HncImm_Start__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [ebp + 8]
push 0x1a024038
mov dword [0x1a024040], eax
call dword [sym.imp.HncFoundation.dll_HncInitModule]
mov eax, 1
pop ebp
ret 0xc
push str.DllMain___:_DLL_PROCESS_DETACH____HncImm_End__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x1a024038
call dword [sym.imp.HncFoundation.dll_HncExitModule]
call sym.HncIMM.dll_HimEndInt
mov eax, 1
pop ebp
ret 0xc
Function at 0x409010
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4574c0], eax
xor eax, eax
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x4574bc]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x4574c0], edx
cmp eax, 0x26f
jl 0x409020
mov dword [0x448a10], 0x270
mov esp, ebp
pop ebp
ret

Function at 0x409060
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0xffffffff
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x4574c4]
mov ebx, dword [eax*4 + 0x4574c0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x457af4]
mov dword [eax*4 + 0x4574c0], edx
cmp eax, 0xe2
jl 0x409070
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x4574c4]
mov ebx, dword [eax*4 + 0x4574c0]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x457134]
mov dword [eax*4 + 0x4574c0], edx
cmp eax, 0x26e
jl 0x4090c0
mov edx, dword [0x4574c0]
mov ecx, dword [0x457e7c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x457af0]
mov dword [0x457e7c], eax
mov dword [0x448a10], 0
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409150
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [0x448a10]
add dword [0x448a10], 1
mov eax, dword [0x456070]
cmp eax, dword [0x448530]
jne 0x409176
cmp ebx, 0x271
jb 0x409198
mov eax, dword [0x456070]
call fcn.00409010
not dword [0x456070]
mov eax, dword [0x456070]
mov dword [0x448530], eax
mov ebx, 0x270
lea esi, [esi]
cmp ebx, 0x270
jne 0x4091b4
call fcn.00409060
xor ebx, ebx
mov dword [0x448a10], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x4574c0]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret