joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b6b0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fd714
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
push ebx
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
cmp dword [0x543fdc], 1
mov dword [ebp - 0x10], ebx
jne 0x43b72b
push str.buffer__BUFFER_STANDARD
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x10]
call fcn.00405ce0
add esp, 4
test eax, eax
je 0x43b72b
push eax
push 3
push 0x26c
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc4]
call fcn.0040ec90
lea ecx, [ebp - 0xc4]
call fcn.0040f1c0
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x43b792
cmp dword [0x543fdc], 1
jne 0x43b76a
push 3
push 0x26f
push str.f:my_lab_tabexplorerextab_masterlibraryui_baseclipboardclipboard.cpp
lea ecx, [ebp - 0xc4]
call fcn.0040eda0
mov dword [ebp - 4], esi
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_false.
mov dword [ebp - 0x10], ebx
call fcn.00405a30
test bl, 1
je 0x43b82b
lea ecx, [ebp - 0xc4]
call fcn.0040f1c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [esi + 0x10], ebx
jb 0x43b79f
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov byte [ebp + 0xf], cl
mov dword [ebp - 4], 1
mov eax, dword [edi]
test eax, eax
jne 0x43b7d6
cmp byte [edi + 4], al
je 0x43b7d6
push eax
push eax
push eax
push 0xfffffffffffffffd
push eax
push eax
push eax
push eax
push eax
push str.ClipboardOwnerWindow
push str.ClipboardOwnerWindowClass
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi], eax
push eax
lea ecx, [ebp + 0xf]
call fcn.0043ae00
test al, al
je 0x43b81f
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x43b81f
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x43b800
sub edx, ebx
mov ecx, esi
sar edx, 1
push edx
push eax
call fcn.00405110
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp byte [ebp + 0xf], 0
je 0x43b82b
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43ce30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, ecx
push edi
push 0x12
call esi
movzx edi, ax
and edi, 0x80
push 0x10
shr edi, 4
call esi
and eax, 0x80
shr eax, 6
push 0x11
or edi, eax
call esi
movups xmm0, xmmword [ebp + 8]
mov esi, dword [ebp + 0x20]
and eax, 0x80
shr eax, 5
sub esp, 0x1c
or edi, eax
mov eax, esp
movups xmmword [eax], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], esi
call fcn.0043cb70
add esp, 0x1c
mov dword [ebx + 0x1c], eax
lea ecx, [ebx + 0x20]
call fcn.00423cd0
movups xmm1, xmmword [ebp + 8]
mov dword [ebx + 0x28], edi
movq xmm0, qword [ebp + 0x18]
movups xmmword [ebx], xmm1
pop edi
psrldq xmm1, 8
movd eax, xmm1
movq qword [ebx + 0x10], xmm0
mov dword [ebx + 0x18], esi
movzx eax, ax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x43ced0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
movups xmm1, xmmword [ebp + 8]
push esi
movq xmm0, qword [ebp + 0x18]
movq qword [esp + 0x2c], xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
push edi
movd edi, xmm0
mov dword [esp + 0x14], ecx
movups xmmword [esp + 0x20], xmm1
cmp edi, 0x203
ja 0x43cf39
cmp edi, 0x201
jae case.0x43cf21.161
lea eax, [edi - 0xa1]
cmp eax, 0xc
ja case.0x43cf4b.522
movzx eax, byte [eax + 0x43d12c]
jmp dword [eax*4 + 0x43d118]
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
or eax, 1
jmp 0x43cf83
lea eax, [edi - 0x204]
cmp eax, 9
ja case.0x43cf4b.522
movzx eax, byte [eax + 0x43d14c]
jmp dword [eax*4 + 0x43d13c]
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
or eax, 0x10
jmp 0x43cf83
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
or eax, 2
jmp 0x43cf83
movaps xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
or eax, 0x20
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x24]
cmp edi, 0x2a2
je 0x43cfaf
cmp ecx, 0x2a0
je 0x43cfaf
cmp ecx, 0xa0
jb 0x43cfab
cmp ecx, 0xad
jbe 0x43cfaf
xor edx, edx
jmp 0x43cfb4
mov edx, 0x20000
cmp ecx, 0x203
ja 0x43cfdf
je case.0x43cfd8.163
lea eax, [ecx - 0xa3]
mov dword [esp + 0x10], edx
cmp eax, 0xa
ja case.0x43cfd8.164
movzx eax, byte [eax + 0x43d160]
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x43d158]
mov eax, ecx
mov dword [esp + 0x10], edx
sub eax, 0x206
je case.0x43cfd8.163
sub eax, 3
je case.0x43cfd8.163
sub eax, 4
jne case.0x43cfd8.164
mov esi, edx
or esi, 0x10000
mov dword [esp + 0x10], esi
add ecx, 0xffffff5f
cmp ecx, 7
ja case.0x43d00d.163
jmp dword [ecx*4 + 0x43d16c]
mov esi, 0x10
jmp 0x43d06c
mov esi, 0x20
jmp 0x43d06c
mov esi, 0x40
jmp 0x43d06c
movzx esi, word [esp + 0x28]
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movups xmm1, xmmword [ebp + 8]
xor edx, edx
mov ecx, 8
test ax, ax
mov eax, esi
cmovs edx, ecx
mov ecx, esi
and ecx, 2
and eax, 1
add ecx, ecx
or ecx, eax
mov eax, esi
shl ecx, 3
and eax, 0x10
or ecx, eax
shr esi, 1
add ecx, ecx
and esi, 6
or edx, ecx
or edx, esi
mov esi, edx
movq xmm0, qword [ebp + 0x18]
sub esp, 0x1c
mov ecx, dword [ebp + 0x20]
mov eax, esp
movups xmmword [eax], xmm1
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], ecx
call fcn.0043cb70
mov ecx, dword [esp + 0x30]
add esp, 0x1c
mov dword [ecx + 0x1c], eax
add ecx, 0x20
call fcn.00423cd0
mov eax, dword [esp + 0x14]
or esi, dword [esp + 0x10]
mov ecx, dword [ebp + 0x20]
movups xmm0, xmmword [ebp + 8]
mov dword [eax + 0x28], esi
mov esi, eax
mov eax, dword [ebp + 0x1c]
movups xmmword [esi], xmm0
movq xmm0, qword [ebp + 0x18]
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], ecx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
cmp edi, 0x2a2
je 0x43d0e8
cmp edi, 0x2a0
je 0x43d0e8
cmp edi, 0xa0
jb 0x43d10e
cmp edi, 0xad
ja 0x43d10e
mov dword [esp + 0x18], eax
mov eax, ecx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
int3
Function at 0x440020
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdc90
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x53f084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0
push 0
push 0xe
push dword [ebx - 0x20]
mov dword [ebp - 0x44], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
lea edi, [eax + 1]
xor eax, eax
mov word [ebp - 0x28], ax
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.0040a2b0
mov eax, dword [ebp - 0x18]
lea ecx, [edi - 1]
cmp ecx, eax
ja 0x4400a5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x4400b2
sub ecx, eax
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00416300
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebx - 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x40]
call fcn.00404020
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
mov edx, dword [ebp - 0x30]
test edx, edx
jne 0x4400ef
push eax
mov ecx, esi
call fcn.00404020
jmp 0x440180
mov ebx, dword [ebp - 0x2c]
xor edi, edi
cmp ebx, 8
mov ecx, 0x202a
cmovae eax, dword [ebp - 0x40]
movzx eax, word [eax]
cmp ax, cx
je 0x440126
mov ecx, 0x202b
cmp ax, cx
je 0x440126
mov ecx, 0x202d
cmp ax, cx
je 0x440126
mov ecx, 0x202e
cmp ax, cx
jne 0x44012b
mov edi, 1
cmp ebx, 8
lea eax, [ebp - 0x40]
mov ebx, 0x202c
lea ecx, [edx - 1]
cmovae eax, dword [ebp - 0x40]
cmp word [eax + ecx*2], bx
mov ebx, dword [ebp - 0x2c]
jne 0x440149
lea ecx, [edx - 2]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
cmp edx, edi
jb 0x4401b0
sub ecx, edi
lea eax, [ebp - 0x40]
inc ecx
sub edx, edi
cmp edx, ecx
cmovb ecx, edx
cmp ebx, 8
push ecx
cmovae eax, dword [ebp - 0x40]
lea ecx, [eax + edi*2]
push ecx
mov ecx, esi
call fcn.00405110
lea ecx, [ebp - 0x40]
call fcn.00405080
lea ecx, [ebp - 0x28]
call fcn.00405080
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 4
call fcn.00405480
int3
Function at 0x441420
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0x58], 8
lea eax, [esi + 0x44]
push edi
mov dword [eax + 0x10], 0
jb 0x44143f
mov eax, dword [eax]
push dword [ebp + 0x10]
xor ecx, ecx
push dword [ebp + 0xc]
mov word [eax], cx
push dword [ebp + 8]
push dword [esi + 4]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp byte [esi + 0x7c], 0
mov dword [esp + 0xc], eax
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
je 0x4414de
push dword [esi + 4]
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov edi, eax
test edi, edi
je 0x4414de
lea eax, [esp + 0x10]
push eax
push 0
push 0x434
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x80
push edi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
js 0x4414bb
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov dword [esi + 0x80], ecx
push 0
push 0
push 8
push edi
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
test eax, eax
js 0x4414d4
shr eax, 1
mov dword [esi + 0x84], eax
push edi
push dword [esi + 4]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
push 0
mov ecx, esi
call fcn.00442150
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x441500
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdef0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov di, word [ebp + 8]
movzx eax, di
add eax, 0xfffffff3
cmp eax, 0xd8
ja case.0x44154f.18
movzx eax, byte [eax + 0x4416f0]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0x10]
jmp dword [eax*4 + 0x4416d8]
test ecx, 0x2000
jne case.0x44154f.18
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
xor eax, eax
cmp di, 0x58
sete al
add eax, 0x10
push eax
call ebx
test ax, ax
jns case.0x44154f.18
xor eax, eax
cmp di, 0x58
setne al
add eax, 0x10
push eax
call ebx
test ax, ax
js case.0x44154f.13
mov ecx, esi
call fcn.004424f0
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0043f9f0
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.004420e0
push 0
push 0
push 0x300
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, esi
call fcn.00442150
lea ecx, [ebp - 0x14]
call fcn.0043fa20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ecx, 0x2000
jne case.0x44154f.18
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
test ax, ax
jns case.0x44154f.18
push 0x10
call edi
test ax, ax
js case.0x44154f.13
push 0
push 0
push 0x301
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
test ecx, 0x2000
jne case.0x44154f.18
push 0x10
call ebx
test ax, ax
js 0x44165a
push 0x11
call ebx
test ax, ax
jns case.0x44154f.13
mov ecx, dword [ebp + 0x10]
test ecx, 0x2000
jne case.0x44154f.18
xor eax, eax
cmp di, 0x56
sete al
add eax, 0x10
push eax
call ebx
test ax, ax
jns case.0x44154f.18
xor eax, eax
cmp di, 0x56
setne al
add eax, 0x10
push eax
call ebx
test ax, ax
js case.0x44154f.13
mov ecx, esi
call fcn.004424f0
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0043f9f0
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.004420e0
push 0
push 0
push 0x302
jmp 0x4415c0
mov ecx, esi
call fcn.00441f70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x441f70
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdfc8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x10], eax
call fcn.004424f0
mov esi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
test esi, esi
je 0x441fbd
mov ecx, dword [esi]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [ecx + 0x48]
mov dword [ebp - 4], 0
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x442013
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x5c]
sub esp, 0x1c
mov edx, esp
movups xmm0, xmmword [eax]
movups xmmword [edx], xmm0
movq xmm0, qword [eax + 0x10]
mov eax, dword [eax + 0x18]
movq qword [edx + 0x10], xmm0
mov dword [edx + 0x18], eax
call fcn.0043ce30
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x5c]
push edx
push dword [edi + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
test al, al
jne 0x4420a0
mov ecx, edi
call fcn.004420e0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
cmp ecx, 0x24
je 0x44203f
cmp ecx, 0x23
je 0x44203f
push dword [eax + 0xc]
push ecx
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
jmp 0x44206d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
mov eax, dword [ebp - 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [edi + 4]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_CallWindowProcW]
push 8
push esi
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov esi, dword [ebp - 0x18]
push 0
push 0
push 0x479
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test al, 1
je 0x442097
and eax, 0xfffffffe
push eax
push 0
push 0x478
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
mov ecx, edi
call fcn.00442150
mov dword [ebp - 4], 1
test esi, esi
je 0x4420c4
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [eax + 0x4c]
cmp dword [ebp - 0x18], 0
jne 0x4420c4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x445140
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push edi
mov edi, ecx
mov edx, edi
mov eax, edi
and edx, 1
shl edx, 4
mov esi, edx
or esi, 0x400
and al, 2
mov eax, edi
cmove esi, edx
mov ecx, esi
or ecx, 0x100
and al, 4
mov eax, edi
cmove ecx, esi
mov edx, ecx
or edx, 0x200
and al, 8
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x40000000
and al, 0x10
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x80
and al, 0x20
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x8000
and al, 0x40
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x400000
and al, 0x80
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x10000
and eax, 0x100
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 8
and eax, 0x200
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 0x20000000
and eax, 0x400
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x40
and eax, 0x800
mov eax, edi
cmove edx, ecx
mov ecx, edx
or ecx, 2
and eax, 0x1000
mov eax, edi
cmove ecx, edx
mov edx, ecx
or edx, 4
and eax, 0x2000
cmove edx, ecx
mov eax, edx
or eax, 1
and edi, 0x4000
pop edi
cmove eax, edx
pop esi
ret
Function at 0x44b450
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb20c
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp dword [0x543fdc], 1
jne 0x44b4cd
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x44b4cd
push 3
push 0x89
push str.f:my_lab_tabexplorerextab_masterlibrary_viewwidget_native_widget_win.h
lea ecx, [ebp - 0xc4]
call fcn.0040eda0
mov dword [ebp - 4], ebx
lea ecx, [eax + 8]
mov ebx, 1
mov edx, str.Check_failed:_::IsWindow_GetNativeView___.
mov dword [ebp - 0x14], ebx
call fcn.00405a30
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x44b4e4
lea ecx, [ebp - 0xc4]
call fcn.0040f1c0
mov eax, dword [esi + 0x1c]
lea ecx, [esi + 0x1c]
push dword [ebp + 8]
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e780
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x53f084]
xor eax, esp
mov dword [esp + 0x24], eax
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x40], 0
je 0x44e7fd
push edx
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x48]
call fcn.0042cfe0
movups xmm0, xmmword [eax]
movups xmmword [edi + 0x48], xmm0
mov eax, dword [edi + 0x58]
test eax, eax
je 0x44e7c4
mov eax, dword [eax]
cmp eax, 1
jne 0x44e82c
call fcn.00414650
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0x4518b0
lea ecx, [edi + 0x58]
mov esi, eax
call fcn.00452740
push eax
mov ecx, esi
call fcn.00412b10
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edx]
mov eax, dword [edx + 8]
add eax, ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 0xc]
add eax, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push 0
push eax
push dword [edi - 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.004d170a
mov esp, ebp
pop ebp
ret 4
Function at 0x450e40
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fef28
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea edi, [eax + 0x1c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
cmp dword [eax + 0x38], 0
je 0x45100b
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xf0]
call eax
mov ebx, dword [ebp + 8]
mov esi, ebx
and esi, 0xfff0
test al, al
je 0x450ec0
cmp esi, 0xf000
je 0x45100b
cmp esi, 0xf010
je 0x45100b
cmp esi, 0xf030
je 0x45100b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov ecx, dword [eax + 0x64]
test ecx, ecx
je 0x450ed6
cmp ecx, 2
sete al
jmp 0x450ee0
mov ecx, dword [eax + 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test al, al
jne 0x450f50
cmp esi, 0xf020
je 0x450f38
cmp esi, 0xf030
je 0x450f38
cmp esi, 0xf120
je 0x450f38
cmp esi, 0xf010
je 0x450f0c
cmp esi, 0xf000
jne 0x450f50
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xc4]
call eax
test al, al
jne 0x450f50
mov ecx, dword [ebp - 0x10]
push 0xfffffffffffffff0
call fcn.0044b510
mov ecx, dword [ebp - 0x10]
or eax, 0x10000000
push eax
push 0xfffffffffffffff0
call fcn.0044b5d0
jmp 0x450f50
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov eax, dword [eax + 0x38]
mov ecx, dword [eax + 0x88]
mov eax, dword [ecx]
call dword [eax + 0x1a4]
cmp esi, 0xf100
jne 0x450fd7
cmp dword [ebp + 0xc], 0
jne 0x450fd7
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
movzx ebx, ax
push 0x10
shr ebx, 0xf
call esi
shr eax, 0xf
mov ecx, 2
and al, 1
mov dword [ebp - 0x1c], vtable.view::Accelerator.0
mov eax, 0
mov dword [ebp - 0x18], 0x12
cmovne eax, ecx
mov dword [ebp - 0x14], eax
and bl, 1
je 0x450fa0
or eax, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov ecx, edi
mov eax, dword [edi]
call dword [eax + 8]
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x98]
mov ecx, eax
call fcn.0043e570
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x10]
push ebx
mov ecx, dword [eax + 0x4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
jne 0x45100b
movzx ecx, word [ebp + 0x10]
movzx eax, word [ebp + 0xc]
shl ecx, 0x10
or ecx, eax
mov eax, dword [edi]
push ecx
push ebx
push 0x112
mov ecx, edi
call dword [eax + 0x28]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x458c50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff86f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x14
call fcn.004d1720
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x18]
call fcn.00423de0
mov ecx, dword [esi + 0x1c]
mov edx, 1
mov dword [ebp - 0x14], ecx
mov esi, dword [eax]
test esi, esi
je 0x458cb3
mov eax, edx
lock xadd dword [esi], eax
mov ecx, dword [ebp - 0x10]
or edi, 0xffffffff
test ecx, ecx
je 0x458cda
mov eax, edi
lock xadd dword [ecx], eax
sub eax, 1
jne 0x458cda
test ecx, ecx
je 0x458cda
push 8
push ecx
call fcn.004d1750
add esp, 8
lea edx, [edi + 2]
mov dword [ebx], vtable.._AV__RunnableMethod_P8SimpleMenuModel_ui__AEXXZUTuple0_____ScopedRunnableMethodFactory_VSimpleMenuModel_ui____.0
mov dword [ebx + 4], esi
test esi, esi
je 0x458ceb
lock xadd dword [esi], edx
mov eax, dword [ebp - 0x14]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 0x458d50
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x458d17
lock xadd dword [esi], edi
sub edi, 1
jne 0x458d17
push 8
push esi
call fcn.004d1750
add esp, 8
call fcn.00414650
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
call fcn.00412b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45a560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffa32
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53f084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
push 0x60
mov dword [edi], vtable.view::Menu2.0
mov dword [edi + 4], eax
call fcn.004d1720
mov esi, eax
add esp, 4
mov dword [ebp + 8], esi
mov dword [ebp - 4], 0
mov ecx, dword [edi + 4]
mov byte [ebp - 4], 1
xor edx, edx
mov dword [esi + 4], ecx
xor ecx, ecx
mov dword [esi], vtable.view::NativeMenuWin.0
mov dword [esi + 8], 0
call fcn.00458170
test al, al
setne al
mov byte [esi + 0xc], al
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], esi
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [edi + 8], esi
mov ecx, esi
mov dword [ebp - 4], 2
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4