joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100683f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cf2dd
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [edi], ebx
test ebx, ebx
je 0x10068575
mov ecx, dword [0x10133c64]
mov word [edi + 0x10], 0
mov eax, dword [ebx + 0x1c]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 0xc], eax
mov eax, dword fs:[0x2c]
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1010e660]
cmp eax, dword [esi + 0x408]
jg 0x10068589
mov eax, dword [0x1010e668]
cmp eax, dword [esi + 0x408]
jg 0x100685cd
cmp byte [0x1010e664], 0
mov word [edi + 0x10], 0
je 0x10068499
push dword [ebx + 0x30]
push str.Streaming_disabling_vsync__D3DPRESENT_INTERVAL_IMMEDIATE____old_value__x__n
call fcn.10084630
mov eax, dword [ebx + 0x30]
add esp, 8
shr eax, 0x1f
not al
and al, 1
mov byte [edi + 0x11], al
mov dword [ebx + 0x30], SysReAllocString
cmp byte [0x1010e65c], 0
je 0x10068560
push str.SteamStreamingForceWindowedD3D9
call fcn.100aae23
add esp, 4
test eax, eax
je 0x10068560
cmp byte [eax], 0x31
jne 0x10068560
cmp dword [ebx + 0x1c], 0
jne 0x10068560
push str.Switching_game_to_windowed_mode_for_accelerated_capture_n
call fcn.10084630
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebx + 0x1c], 1
mov dword [ebx + 0x2c], 0
test eax, eax
jne 0x100684fa
mov eax, dword [ebx + 0x18]
mov dword [ebp + 8], eax
test eax, eax
je 0x1006855c
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push SysReAllocString
push 0xfffffffffffffff0
push eax
call esi
push 0
push 0xffffffffffffffec
push dword [ebp + 8]
call esi
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push SysReAllocString
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 0x40
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov byte [edi + 0x10], 1
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0x1010e660
call fcn.100a58af
add esp, 4
cmp dword [0x1010e660], 0xffffffff
jne 0x10068455
mov dword [ebp - 4], 0
call fcn.10077420
push 0x1010e660
mov byte [0x1010e65c], al
mov dword [ebp - 4], 0xffffffff
call fcn.100a5865
add esp, 4
jmp 0x10068455
push 0x1010e668
call fcn.100a58af
add esp, 4
cmp dword [0x1010e668], 0xffffffff
jne 0x10068466
mov dword [ebp - 4], 1
call fcn.10077440
push 0x1010e668
mov byte [0x1010e664], al
mov dword [ebp - 4], 0xffffffff
call fcn.100a5865
add esp, 4
jmp 0x10068466
Function at 0x1006c030
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cf40d
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [edi], ebx
test ebx, ebx
je 0x1006c1b5
mov ecx, dword [0x10133c64]
mov word [edi + 0x10], 0
mov eax, dword [ebx + 0x20]
mov dword [edi + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0x34]
mov dword [edi + 0xc], eax
mov eax, dword fs:[0x2c]
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1010e6d0]
cmp eax, dword [esi + 0x408]
jg 0x1006c1c9
mov eax, dword [0x1010e6d8]
cmp eax, dword [esi + 0x408]
jg 0x1006c20d
cmp byte [0x1010e6d4], 0
mov word [edi + 0x10], 0
je 0x1006c0d9
push dword [ebx + 0x34]
push str.Streaming_disabling_vsync__D3DPRESENT_INTERVAL_IMMEDIATE____old_value__x__n
call fcn.10084630
mov eax, dword [ebx + 0x34]
add esp, 8
shr eax, 0x1f
not al
and al, 1
mov byte [edi + 0x11], al
mov dword [ebx + 0x34], SysReAllocString
cmp byte [0x1010e6cc], 0
je 0x1006c1a0
push str.SteamStreamingForceWindowedD3D9
call fcn.100aae23
add esp, 4
test eax, eax
je 0x1006c1a0
cmp byte [eax], 0x31
jne 0x1006c1a0
cmp dword [ebx + 0x20], 0
jne 0x1006c1a0
push str.Switching_game_to_windowed_mode_for_accelerated_capture_n
call fcn.10084630
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebx + 0x20], 1
mov dword [ebx + 0x30], 0
test eax, eax
jne 0x1006c13a
mov eax, dword [ebx + 0x1c]
mov dword [ebp + 8], eax
test eax, eax
je 0x1006c19c
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push SysReAllocString
push 0xfffffffffffffff0
push eax
call esi
push 0
push 0xffffffffffffffec
push dword [ebp + 8]
call esi
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 4]
push 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
push SysReAllocString
push eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push 0x40
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov byte [edi + 0x10], 1
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
push 0x1010e6d0
call fcn.100a58af
add esp, 4
cmp dword [0x1010e6d0], 0xffffffff
jne 0x1006c095
mov dword [ebp - 4], 0
call fcn.10077420
push 0x1010e6d0
mov byte [0x1010e6cc], al
mov dword [ebp - 4], 0xffffffff
call fcn.100a5865
add esp, 4
jmp 0x1006c095
push 0x1010e6d8
call fcn.100a58af
add esp, 4
cmp dword [0x1010e6d8], 0xffffffff
jne 0x1006c0a6
mov dword [ebp - 4], 1
call fcn.10077440
push 0x1010e6d8
mov byte [0x1010e6d4], al
mov dword [ebp - 4], 0xffffffff
call fcn.100a5865
add esp, 4
jmp 0x1006c0a6
Function at 0x10070af0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1010eb50]
sub esp, 0x24
test eax, eax
jne 0x10070b24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x20]
push eax
push str.System_page_size:__u_n
mov dword [0x1010eb50], eax
call fcn.10084630
mov eax, dword [0x1010eb50]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x10071ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x3e8
push dword [0x1010eb2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10071ad8
push str.Couldnt_get_trampoline_region_lock__will_continue_possibly_unsafely._n
call fcn.10084630
add esp, 4
push esi
push edi
mov edi, dword [0x1010eb50]
test edi, edi
jne 0x10071b0a
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
push eax
push str.System_page_size:__u_n
mov dword [0x1010eb50], eax
call fcn.10084630
mov edi, dword [0x1010eb50]
add esp, 8
mov esi, dword [0x1010eb3c]
cmp esi, dword [0x1010eb40]
je 0x10071b37
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push dword [esi]
call ebx
add esi, 4
cmp esi, dword [0x1010eb40]
jne 0x10071b20
pop ebx
push dword [0x1010eb2c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10071b50
Capabilities:
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 0xc], 1
pop ebp
jmp fcn.10071b60
Function at 0x10076070
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push esi
push edi
push 0x100
push eax
push str.SteamOverlayDisableDX12
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x100760a3
cmp byte [ebp - 0x104], 0x31
je 0x10076171
push str.Trying_to_detour_d3d12_device_n
call fcn.10084630
mov edi, dword [ebp + 8]
lea edx, [ebp - 4]
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [edi]
push edx
push 0x100df410
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x10076171
mov esi, dword [ebp - 4]
test esi, esi
je 0x10076171
mov esi, dword [esi]
push str.d3d12.dll
push esi
call fcn.10076180
add esp, 8
test al, al
jne 0x100760fb
cmp dword [0x1010e624], 0
jne 0x1007613f
push str.Hooking_vtable_for_device_n
call fcn.10084630
push 0x1005d8c0
push dword [esi + 8]
call fcn.10071f00
add esp, 0xc
test al, al
jne 0x10076132
push 1
push 0x1010e624
push 0x1005d8c0
push dword [esi + 8]
call fcn.100714b0
add esp, 0x10
jmp 0x1007613f
push str.VTable_for_device_in_unexpected_module_n
call fcn.10084630
add esp, 4
push 0
push dword [ebp - 4]
mov ecx, 0x1010e630
call fcn.10062050
push dword [ebp + 0xc]
mov ecx, 0x1010e630
push dword [ebp - 4]
push dword [edi]
call fcn.10062210
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100771c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100771d4
mov edi, dword [ebp + 0xc]
sub ecx, edx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
sar ecx, 1
push 4
push 0x1000
lea eax, [ecx*2 + 2]
push eax
push 0
push edi
mov dword [ebp - 8], eax
call ebx
mov dword [ebp - 0x38], eax
test eax, eax
je 0x10077295
push 0
push dword [ebp - 8]
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10077295
push 0x40
push 0x3000
push 0x29
push 0
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x10077295
push 0x100df7f4
push 0x100d6400
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x10077295
push esi
mov byte [ebp - 1], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
jne 0x10077279
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov byte [ebp - 1], 1
test esi, esi
je 0x10077295
push 0x100df804
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x1007729e
cmp byte [ebp - 1], al
je 0x10077295
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
sub eax, esi
cmp byte [ebp - 1], 0
mov dword [ebp - 0x40], eax
je 0x100772b0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0x10001
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x10077295
mov eax, dword [ebp - 0x25c]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x33], eax
mov eax, dword [ebp - 0x3c]
sub eax, ebx
mov byte [ebp - 0x34], 0x68
sub eax, 0x11
mov word [ebp - 0x2f], 0x609c
mov dword [ebp - 0x27], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
push eax
push 0x29
lea eax, [ebp - 0x34]
mov byte [ebp - 0x2d], 0x68
push eax
push ebx
push edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x28], 0xe8
mov dword [ebp - 0x23], 0x117ec085
mov byte [ebp - 0x1f], 0x68
mov dword [ebp - 0x1e], ebx
mov byte [ebp - 0x1a], 0x68
mov dword [ebp - 0x19], esi
mov byte [ebp - 0x15], 5
mov dword [ebp - 0x10], 0x9d61c350
mov byte [ebp - 0xc], 0xc3
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x10077295
lea eax, [ebp - 0x44]
push eax
push 2
push dword [ebp - 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
call esi
lea eax, [ebp - 0x44]
push eax
push 0x20
push 0x29
push ebx
push edi
call esi
push dword [ebp - 0x48]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0x314]
mov dword [ebp - 0x25c], ebx
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0x314], 0x10001
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007d600
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov ax, word [ebp + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
push esi
mov esi, dword [ebp + 0xc]
movzx ebx, ax
push edi
mov dword [ebp + 8], ecx
mov word [esi], ax
mov eax, ebx
and eax, 0x3ff
mov byte [esi + 0x21a], 0
add eax, 0xfffffffc
cmp eax, 0xe
ja case.0x1007d639.5
movzx eax, byte [eax + 0x1007d6fc]
jmp dword [eax*4 + 0x1007d6e8]
mov dword [esi + 4], 0
jmp 0x1007d6a3
mov dword [esi + 4], 2
jmp 0x1007d6a3
mov dword [esi + 4], 3
jmp 0x1007d6a3
mov eax, ebx
mov byte [esi + 0x21a], 1
shr eax, 0xa
dec eax
cmp eax, 4
ja case.0x1007d66d.2
jmp dword [eax*4 + 0x1007d70c]
push 9
lea eax, [esi + 8]
mov dword [esi + 4], 1
push 0x100e1728
push eax
jmp 0x1007d6c5
push 9
lea eax, [esi + 8]
mov dword [esi + 4], 4
push 0x100e1720
push eax
jmp 0x1007d6c5
mov dword [esi + 4], 5
push 9
lea edi, [esi + 8]
push edi
push 0x59
push ebx
call ecx
test eax, eax
je 0x1007d6bd
push edi
call fcn.100bb924
add esp, 4
jmp 0x1007d6cd
push 9
push 0x100e16d8
push edi
call fcn.100b5882
add esp, 0xc
push 0x100
lea eax, [esi + 0x1a]
push eax
push 2
push ebx
call dword [ebp + 8]
pop edi
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret 8

Function at 0x1007d870
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x3c
call fcn.100a573e
mov esi, eax
add esp, 4
mov dword [ebp - 8], esi
test esi, esi
je 0x1007d944
mov eax, dword [ebp + 8]
mov dword [esi], vtable.CIMEWin32.0
mov dword [esi + 4], eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x20], 0
push 0
mov dword [esi + 0x24], 0
mov byte [esi + 0x28], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
call sub.IMM32.dll_ImmCreateContext
mov dword [esi + 0x10], eax
mov byte [esi + 0x20], 0
test eax, eax
je 0x1007d93d
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], 0
push ecx
push eax
call sub.IMM32.dll_ImmGetConversionStatus
test eax, eax
je 0x1007d93d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
call sub.IMM32.dll_ImmGetOpenStatus
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], 1
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1007d990
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push 0
mov dword [ebp - 0x10], ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x1007da7c
push esi
xor ecx, ecx
push edi
mov edi, 4
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100a5a6b
mov esi, eax
xor ecx, ecx
mov eax, ebx
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100a5a6b
add esp, 8
mov dword [ebp - 4], eax
xor edi, edi
push esi
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ebx, ebx
xor ecx, ecx
lea ecx, [ecx]
xor eax, eax
test ecx, ecx
jle 0x1007da1b
movzx edx, word [esi + ecx*4]
lea ebx, [ebx]
cmp word [esi + eax*4], dx
je 0x1007da2b
inc eax
cmp eax, ecx
jl 0x1007da10
mov eax, dword [esi + ecx*4]
mov edx, dword [ebp - 4]
cmp eax, dword [ebp - 8]
cmove ebx, edi
mov dword [edx + edi*4], eax
inc edi
inc ecx
cmp ecx, dword [ebp - 0xc]
jb 0x1007da00
movzx eax, byte [ebp + 8]
lea ebx, [ebx + eax*2]
sub ebx, 1
jns 0x1007da49
lea ebx, [edi - 1]
xor eax, eax
test ebx, ebx
cmovs ebx, eax
jmp 0x1007da50
xor eax, eax
cmp ebx, edi
cmovge ebx, eax
mov edi, dword [ebp - 4]
push 0
push dword [edi + ebx*4]
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
movzx eax, word [edi + ebx*4]
mov ecx, dword [ebp - 0x10]
push eax
call fcn.1007e7c0
push esi
call fcn.100a5a74
push edi
call fcn.100a5a74
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007df50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xee0
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1007df7f
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
call sub.IMM32.dll_ImmGetConversionStatus
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov ecx, esi
call fcn.1007d600
test al, al
je case.default.0x1007dfae
mov eax, dword [ebp - 0x220]
dec eax
cmp eax, 3
ja case.default.0x1007dfae
jmp dword [eax*4 + 0x1007e108]
push 0x1010a27c
push str.IME_Chinese
push dword [ebp - 4]
lea eax, [ebp - 0xee0]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a28c
jmp 0x1007e0c5
push 0x1010a2dc
push str.IME_Hiragana
push dword [ebp - 4]
lea eax, [ebp - 0xee0]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a2fc
push str.IME_FullWidthKatakana
push dword [ebp - 4]
lea eax, [ebp - 0xcc1]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a31c
push str.IME_FullWidthAlphanumeric
push dword [ebp - 4]
lea eax, [ebp - 0xaa2]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a30c
push str.IME_HalfWidthKatakana
push dword [ebp - 4]
lea eax, [ebp - 0x883]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a32c
push str.IME_HalfWidthAlphanumeric
push dword [ebp - 4]
lea eax, [ebp - 0x664]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a2ec
push str.IME_English
push dword [ebp - 4]
lea eax, [ebp - 0x445]
mov ecx, esi
push eax
call fcn.1007d5b0
mov edx, 6
jmp 0x1007e0e0
push 0x1010a2bc
push str.IME_Korean
push dword [ebp - 4]
lea eax, [ebp - 0xee0]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a2cc
jmp 0x1007e0c5
push 0x1010a29c
push str.IME_Chinese
push dword [ebp - 4]
lea eax, [ebp - 0xee0]
mov ecx, esi
push eax
call fcn.1007d5b0
push 0x1010a2ac
push str.IME_English
push dword [ebp - 4]
lea eax, [ebp - 0xcc1]
mov ecx, esi
push eax
call fcn.1007d5b0
mov edx, 2
mov ecx, dword [esi + 4]
fldz
push ecx
fstp dword [esp]
mov eax, dword [ecx]
push 0
push edx
lea edx, [ebp - 0xee0]
push edx
push str.IMEConversionModes
push dword [ebp + 8]
call dword [eax]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1007e3e0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa0
push esi
mov esi, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x1007e40f
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
call sub.IMM32.dll_ImmGetConversionStatus
lea eax, [ebp - 0xaa0]
push eax
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov ecx, esi
call fcn.1007d600
test al, al
je 0x1007e5c8
mov eax, dword [ebp - 0xa9c]
sub eax, 2
jne 0x1007e5c8
mov edx, dword [ebp - 4]
test dword [0x1010a354], edx
je 0x1007e44c
xor al, al
jmp 0x1007e45c
mov eax, dword [0x1010a358]
and eax, edx
cmp eax, dword [0x1010a358]
sete al
mov byte [ebp - 0x878], al
xor eax, eax
push 0x100
mov word [ebp - 0x877], ax
lea eax, [ebp - 0x865]
push str.IME_General
push eax
mov dword [ebp - 0x884], 0x1010a34c
mov dword [ebp - 0x880], 0
call fcn.100b5882
mov edx, dword [ebp - 4]
add esp, 0xc
test dword [0x1010a364], edx
je 0x1007e4a7
xor al, al
jmp 0x1007e4b7
mov eax, dword [0x1010a368]
and eax, edx
cmp eax, dword [0x1010a368]
sete al
mov byte [ebp - 0x659], al
xor eax, eax
push 0x100
mov word [ebp - 0x658], ax
lea eax, [ebp - 0x646]
push str.IME_BiasNames
push eax
mov dword [ebp - 0x665], 0x1010a35c
mov dword [ebp - 0x661], 0
call fcn.100b5882
mov edx, dword [ebp - 4]
add esp, 0xc
test dword [0x1010a374], edx
je 0x1007e502
xor al, al
jmp 0x1007e512
mov eax, dword [0x1010a378]
and eax, edx
cmp eax, dword [0x1010a378]
sete al
mov byte [ebp - 0x43a], al
xor eax, eax
push 0x100
mov word [ebp - 0x439], ax
lea eax, [ebp - 0x427]
push str.IME_BiasSpeech
push eax
mov dword [ebp - 0x446], 0x1010a36c
mov dword [ebp - 0x442], 0
call fcn.100b5882
mov edx, dword [ebp - 4]
add esp, 0xc
test dword [0x1010a344], edx
je 0x1007e55d
xor al, al
jmp 0x1007e56d
mov eax, dword [0x1010a348]
and eax, edx
cmp eax, dword [0x1010a348]
sete al
mov byte [ebp - 0x21b], al
xor eax, eax
push 0x100
mov word [ebp - 0x21a], ax
lea eax, [ebp - 0x208]
push str.IME_NoConversion
push eax
mov dword [ebp - 0x227], 0x1010a33c
mov dword [ebp - 0x223], 0
call fcn.100b5882
fldz
lea edx, [ebp - 0x884]
mov ecx, dword [esi + 4]
add esp, 8
mov eax, dword [ecx]
fstp dword [esp]
push 0
push 4
push edx
push str.IMESentenceModes
push dword [ebp + 8]
call dword [eax]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1007e7c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call fcn.1007d600
test al, al
je 0x1007e81d
lea eax, [ebp - 0x214]
push eax
push str.IME_language_changed_to:___s
lea eax, [ebp - 0x61c]
push 0x200
push eax
call fcn.10059f90
xor eax, eax
add esp, 0x10
mov word [ebp - 0x21e], ax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x100e171c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ee50
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x40]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, dword [ebp + 8]
cmp byte [eax + ecx], 0
jge 0x1007eed7
mov eax, dword [edi + 0x44]
test al, 2
je 0x1007ee90
cmp byte [ecx + 0x1d], 0
jl 0x1007ee90
cmp byte [ecx + 0x9d], 0
jge 0x1007eed7
test al, 4
je 0x1007eea3
cmp byte [ecx + 0x38], 0
jl 0x1007eea3
cmp byte [ecx + 0xb8], 0
jge 0x1007eed7
test al, 1
je 0x1007eeb3
cmp byte [ecx + 0x2a], 0
jl 0x1007eeb3
cmp byte [ecx + 0x36], 0
jge 0x1007eed7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [edi + 0x24]
mov ecx, eax
sub ecx, edx
cmp ecx, 0xfa
ja 0x1007eecc
cmp eax, edx
jae 0x1007eed7
mov dword [edi + 0x24], eax
mov al, 1
pop edi
pop esi
pop ebp
ret 4
pop edi
xor al, al
pop esi
pop ebp
ret 4

Function at 0x1007eee0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x50]
test edi, edi
je 0x1007ef7e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
mov ecx, dword [ebp + 8]
cmp byte [eax + ecx], 0
jge 0x1007ef7e
mov eax, dword [esi + 0x54]
test al, 2
je 0x1007ef28
cmp byte [ecx + 0x1d], 0
jl 0x1007ef28
cmp byte [ecx + 0x9d], 0
jge 0x1007ef7e
test al, 4
je 0x1007ef3b
cmp byte [ecx + 0x38], 0
jl 0x1007ef3b
cmp byte [ecx + 0xb8], 0
jge 0x1007ef7e
test al, 1
je 0x1007ef4b
cmp byte [ecx + 0x2a], 0
jl 0x1007ef4b
cmp byte [ecx + 0x36], 0
jge 0x1007ef7e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [esi + 0x2c]
mov ecx, edi
sub ecx, eax
cmp ecx, 0xfa
ja 0x1007ef66
cmp edi, eax
jae 0x1007ef7e
push str.Detected_Movie_hot_key_via_dinput_n
call fcn.10084630
add esp, 4
mov dword [esi + 0x2c], edi
mov al, 1
pop edi
pop esi
pop ebp
ret 4
pop edi
xor al, al
pop esi
pop ebp
ret 4