joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a3c0
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x4cf880
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov word [0x4cfb6c], 0x7f
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
and esi, 0xff
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
call fcn.0044a380
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 6
mov ebx, eax
setae cl
cmp esi, 6
mov byte [0x4cfb39], cl
jb 0x44a47a
mov edx, dword [0x4cc048]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetThreadPreferredUILanguages
push eax
call edi
test ebx, ebx
mov dword [0x4cf8a0], eax
je 0x44a449
mov eax, dword [0x4cfa2c]
push 0x4cf70c
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [0x4cc048]
push ecx
call esi
push str.SetThreadPreferredUILanguages
push eax
call edi
mov edx, dword [0x4cc048]
mov dword [0x4cf89c], eax
push edx
call esi
push str.GetThreadUILanguage
push eax
call edi
pop edi
pop esi
mov dword [0x4cf898], eax
pop ebx
pop ecx
ret
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x49baf4
Capabilities:
Check for software breakpoints

Disassembly:
inc edi
mov edx, es
aas
xor dword [esi - 0x4d3ae1b9], eax
pop esi
test al, 0x46
aaa
sar dword [eax], cl
loopne 0x49bb42
nop
and ecx, edi
pop esi
mov esp, 0x2d6fb6fd
mov ebx, 0x17d7533b
jg 0x49bb4f
push esi
test dword [ebp - 0x4fa243be], esi
dec ebp
pop ebp
mov al, 0x4d
inc ebp
pop es
or al, 0xda
xor al, 0x66
cmp eax, dword [esi + edi + 0x1d883d94]
mov al, byte [0xb481]
aam 0x88
popfd
adc al, dl
mov ah, 0xe8
jl 0x49bb7d
retf 0xfb08
sti
lodsd eax, dword [esi]
jecxz 0x49baf5
hlt
pop ss
jle 0x49bb63
shr dword [eax - 0x43f67b26], 0x29
sub dword [esi - 0x13], eax
in eax, dx
inc edx
int 0x83
cmp dword [ecx + 0x1b], ecx
lodsb al, byte [esi]
sbb bp, dx
xor eax, 0x96d6c177
sub byte [ecx - 0x28db5c46], bl
and al, 0xd7
mov ch, 0x97
sti
or ch, dl
sub eax, 0x8de82dc2
dec edx
dec esi
inc eax
sal byte [ecx + 0x2c2eb9d3], cl
push ebp
push cs
push 0xb66776bf
cmp eax, 0x2eb67d95
mov bl, 0xfd
mov edi, 0x3db66776
xchg ebp, eax
jge 0x49bb3b
mov bl, 0xfd
bound edi, qword [edi - 0x772863c8]
mov ecx, 0x87688a54
mov al, byte [esi + 0x447b97d4]
jne 0x49bb1c
test dword [ebx - 0x7811bfd2], esi
sbb eax, 0xc9e2b1df
sar dword [eax - 0x25], 0xe9
scasb al, byte es:[edi]
jb 0x49bbe5
aaa
dec edx
mov ecx, 0x3e065427
lds eax, [ecx + edx*8]
rcr dword [esi], 1
dec ebp
or cl, byte [eax - 0x33]
lodsb al, byte [esi]
enter 0xffffffffffffb70d, 0xffffffffffffffe9
inc ecx
mov eax, 0x8fc9618d
mov byte [0xbe31185c], al
pop eax
mov ch, 0xa7
xchg edi, eax
loopne 0x49bc2f
ret 0x73eb
jns 0x49bc3d
fsubr dword [0xc94d343c]
out dx, eax
or ebx, dword [ebp - 0x56]
mov ah, 0x9b
and byte [eax], ch
ror dword [eax - 0x53a8e8e8], cl
sar dl, 1
cmp dword [edi - 0x4307e84d], edx
loope 0x49bc4a
pop ss
clc
mov esp, 0x86c2fbe1
jge 0x49bc99
ret 0x7d86
ja 0x49bbe5
or eax, 0xbd4a2e45
invalid
mov ch, 0x36
das
xor ebp, dword [ecx]
xchg ebx, eax
xor eax, 0x1adaaa84
push esi
invalid
Function at 0x4be66c
Capabilities:
Authenticate hmac

Disassembly:
loop 0x4be67d
rol esi, 1
push esp
cmp ebx, dword [edx + 0x5612116f]
je 0x4be6c9
mov bl, 0x48
xchg ecx, eax
cmp dh, byte [esi + esi]
xor al, 0x36
cwde
xchg ecx, eax
add eax, 0x7d5dd60c
cmc
invalid
fist word [esi + 0x1ab27d7d]
fdivr dword [ecx - 0x27]
test eax, 0xf9a02dae
xchg ebx, eax
into
scasb al, byte es:[edi]
sub eax, 0xce93f9a0
lds ebx, [edi - 0x3fc0e745]
pop ds
adc ebx, dword [ecx]
add al, dl
test byte [edx], ch
or eax, 0x91d742ca
sbb eax, 0xc28a366b
mov al, dl
sbb dword [0x2eca773a], esi
jge 0x4be760
loopne 0x4be774
leave
clc
scasb al, byte es:[edi]
dec esp
xchg edi, eax
add dword [edi + 0x2c], esp
pop ss
pop eax
pop ecx
sub dword [edi + 0x5f], ebx
jecxz 0x4be6d3
sbb dword [ecx - 0x5a], esp
sbb al, 0x5f
push ebx
add dword [ebx - 0x37], ebp
test dword [esi + 0x4fb8ad8], ebp
add al, 0xfd
dec ebp
arpl word [esi - 0x62], di
sub edx, dword [ebx - 0xc]
pushfd
je 0x4be76f
aad 0xda
push es
mov edi, 0x691f8092
push edx
lahf
xor esi, ebx
dec edx
and byte [edi], ch
popfd
test eax, 0x635d4d77
xchg esi, eax
invalid
sahf
jae 0x4be6ee
invalid
lcall 0xa9b5, 0x4f6e36a4
mov ch, 0xa9
xor byte [eax], al
imul edx, dword [ebp + 0x58], 0xffffffe4
arpl ax, dx
adc esi, esi
or cl, byte [esi + 0x5a173a53]
xor dword [ebp + 0x70], edi
xor esi, esp
and eax, 0xb01d435b
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
fnstenv [edx]
sub al, 0x7c
mov dh, 0x5c
mov dword [0xd9005b32], eax
fcos
mov dh, 0x9f
les ebp, [0x42093b73]
inc esi
dec esi
dec esi
pop esi
jmp 0x4be814
push esp
outsb dx, byte [esi]
lcall 0xb196, 0x83c2bc9e
out dx, al
sti
js 0x4be849
sub edx, dword [edi]
mov ebp, 0xce169c76
invalid
lea ebx, [eax - 0x2dfb653f]
in al, dx
or ebp, 0xfffffff9
out 0x71, eax
not eax
sahf
xchg byte [esi + 0x73], dh
adc esp, ebx
invalid
Function at 0x409ca2
Capabilities:
Hide graphical window

Disassembly:
push ebp
lea ebp, [esp - 0xd4]
sub esp, 0x154
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp + 0xd0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push dword [ebp + 0xdc]
call sym.microClientTemplate.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetInstance_struct_HINSTANCE____
pop ecx
push dword [ebp + 0xdc]
call sym.microClientTemplate.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::SetResourceDll_struct_HINSTANCE____
pop ecx
lea ecx, [ebp - 0x70]
call fcn.0040a2e6
push 0x68
lea ecx, [ebp - 0x70]
call fcn.0040a2fe
call fcn.0040a4f5
push eax
lea ecx, [ebp - 0x70]
call fcn.0040a390
call fcn.004084c2
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x409d27
or dword [ebp - 0x7c], 0xffffffff
lea ecx, [ebp - 0x70]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CDialogBuilder::destructor_void_
mov eax, dword [ebp - 0x7c]
jmp 0x409dc8
call fcn.0040a4f5
mov ecx, eax
call fcn.00409c8f
mov ecx, eax
call sym.microClientTemplate.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
push 1
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [ebp - 0x78], eax
call fcn.0040a4f5
mov ecx, eax
call fcn.00409c8f
mov ecx, eax
call sym.microClientTemplate.exe_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 0x78], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x96c80000
push 0x483c9c
push 0
mov ecx, dword [ebp - 0x74]
call sym.microClientTemplate.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__int__int__int__int__struct_HMENU____
mov ecx, dword [ebp - 0x74]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CWindowWnd::CenterWindow_void_
push 1
mov ecx, dword [ebp - 0x74]
call sym.microClientTemplate.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call sym.microClientTemplate.exe_public:_static_void___cdecl_DuiLib::CPaintManagerUI::MessageLoop_void_
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.ole32.dll_CoUninitialize]
and dword [ebp - 0x80], 0
lea ecx, [ebp - 0x70]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CDialogBuilder::destructor_void_
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0xd0]
xor ecx, ebp
call fcn.004607fb
add ebp, 0xd4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a2fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.00409de1
push 0x483f84
push dword [ebp - 0xc]
call sym.microClientTemplate.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40a331
jmp 0x40a38a
push dword [ebp - 4]
call sym.microClientTemplate.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40a354
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x40a38a
push 0
push dword [ebp - 4]
call sym.microClientTemplate.exe_public:_static_struct_HINSTANCE______cdecl_DuiLib::CPaintManagerUI::GetResourceDll_void_
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [ebp - 0x10]
call sym.microClientTemplate.exe_public:_bool___thiscall_DuiLib::CMarkup::LoadFromMem_unsigned_char___unsigned_long_int__int_
movzx eax, al
test eax, eax
jne 0x40a381
jmp 0x40a38a
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret 4
Function at 0x40b6d0
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x14c]
sub esp, 0x14c
push 0xffffffffffffffff
push 0x4722d9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp + 0x148], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push dword [ebp + 0x154]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40b7b2
push dword [ebp + 0x154]
lea ecx, [ebp]
call fcn.0040bc4d
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
and dword [ebp - 4], 0
push 0x4849b4
lea ecx, [ebp + 0x18]
call fcn.0040bc4d
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
lea eax, [ebp + 0x30]
push eax
call fcn.0040c9a3
add esp, 0xc
mov dword [ebp - 0x14], eax
push 0
push 0x4849ac
mov ecx, dword [ebp - 0x14]
call fcn.0040bce1
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp + 0x30]
call fcn.0040bcca
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x18]
call fcn.0040bcca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp]
call fcn.0040bcca
jmp 0x40b819
call fcn.0040b83b
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
push 0
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0x100
push 0
lea eax, [ebp + 0x48]
push eax
call fcn.004622b0
add esp, 0xc
and dword [ebp - 0x2c], 0
push 0
lea eax, [ebp - 0x2c]
push eax
push 0x100
lea eax, [ebp + 0x48]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0x48]
push eax
mov ecx, dword [ebp + 0x158]
call fcn.0040bba9
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp + 0x148]
xor ecx, ebp
call fcn.004607fb
add ebp, 0x14c
mov esp, ebp
pop ebp
ret
Function at 0x416c7d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push edi
mov dword [ebp - 8], ecx
and dword [ebp - 0xc], 0
push 4
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
push 1
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
and dword [ebp - 0x28], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416d41
push 0
push 0
push 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x416d41
cmp dword [ebp - 0x24], 0x10
jne 0x416d12
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 4]
jne 0x416d12
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x28]
push eax
call sym.microClientTemplate.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
pop ecx
movzx eax, al
test eax, eax
jne 0x416d37
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x24], 0x12
jne 0x416d3f
jmp 0x416d41
jmp 0x416cc3
push 1
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24], 0x12
jne 0x416d64
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0xc]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41f7c5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4d4], 0
je 0x41f868
cmp dword [ebp + 8], 0x100
jne 0x41f83e
movzx eax, word [ebp + 0xc]
cmp eax, 0xd
jne 0x41f83e
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4da]
test eax, eax
je 0x41f818
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x41f83e
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4db]
test eax, eax
jne 0x41f83e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x41f83a
push 0
push 0
push 0
push str.return
push dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x40]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
jmp 0x41f86b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4d4]
call sym.microClientTemplate.exe_public_virtual:_int___thiscall_DuiLib::CListUI::GetExpandedItem_void_const
mov dword [ebp - 8], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
call dword [eax + 0xc]
jmp 0x41f86b
xor eax, eax
inc eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x420a04
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x18]
test eax, eax
jne 0x420a29
xor eax, eax
jmp 0x420ab4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x420a36
xor eax, eax
jmp 0x420ab4
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shl eax, 1
call fcn.00464cc0
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x420a63
xor eax, eax
jmp 0x420ab4
push dword [ebp - 0x10]
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
add ecx, 0x1b8
call fcn.00419661
push 0
push 0
push 0
push str.textchanged
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x10]
call dword [eax + 0x1c]
mov ecx, eax
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
xor eax, eax
lea esp, [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004607fb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42cf4b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x208
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004622b0
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_
mov eax, dword [ebp - 0x214]
or eax, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004607fb
mov esp, ebp
pop ebp
ret

Function at 0x42dbe4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x42dc02
mov eax, dword [ebp - 4]
or eax, 8
mov dword [ebp - 4], eax
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x42dc18
mov eax, dword [ebp - 4]
or eax, 1
mov dword [ebp - 4], eax
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x42dc2e
mov eax, dword [ebp - 4]
or eax, 2
mov dword [ebp - 4], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x42dc44
mov eax, dword [ebp - 4]
or eax, 4
mov dword [ebp - 4], eax
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x42dc5a
mov eax, dword [ebp - 4]
or eax, 0x20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43143b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
je 0x43146e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x54]
je 0x43146e
mov eax, dword [ebp - 4]
push dword [eax]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x54]
jne 0x43147e
jmp 0x431594
mov eax, dword [ebp - 4]
cmp dword [eax + 0x54], 0
je 0x4314e3
and dword [ebp - 0x28], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x54]
call dword [eax + 0x108]
push 0
push 0
push 0
push str.killfocus
mov eax, dword [ebp - 4]
push dword [eax + 0x54]
mov ecx, dword [ebp - 4]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
mov eax, dword [ebp - 4]
and dword [eax + 0x54], 0
cmp dword [ebp + 8], 0
jne 0x4314ee
jmp 0x431594
cmp dword [ebp + 8], 0
je 0x431594
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 0x1c]
cmp eax, dword [ebp - 4]
jne 0x431594
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 0xc8]
movzx eax, al
test eax, eax
je 0x431594
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp + 8]
call dword [eax + 0xd4]
movzx eax, al
test eax, eax
je 0x431594
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x54], ecx
and dword [ebp - 0x48], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x48], 0x15
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x54]
mov ecx, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ecx + 0x54]
call dword [eax + 0x108]
push 0
push 0
push 0
push str.setfocus
mov eax, dword [ebp - 4]
push dword [eax + 0x54]
mov ecx, dword [ebp - 4]
call sym.microClientTemplate.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool_
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x44c2da
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x44c304
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax]
test eax, eax
jne 0x44c309
jmp 0x44c41e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
movzx eax, word [eax]
test eax, eax
je 0x44c363
mov eax, dword [ebp - 0x41c]
movzx eax, word [eax]
cmp eax, 0x2f
je 0x44c347
mov eax, dword [ebp - 0x41c]
movzx eax, word [eax]
cmp eax, 0x5c
jne 0x44c353
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x41c]
inc eax
inc eax
mov dword [ebp - 0x41c], eax
jmp 0x44c31e
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp + 0xc]
je 0x44c3ed
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp + 0xc]
sar eax, 1
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call fcn.004623cd
add esp, 0xc
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp + 0xc]
sar eax, 1
shl eax, 1
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x208
jae 0x44c3b9
jmp 0x44c3be
call fcn.004650c3
xor eax, eax
mov ecx, dword [ebp - 0x420]
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.0044c2da
pop ecx
pop ecx
mov eax, dword [ebp - 0x424]
inc eax
inc eax
mov dword [ebp - 0x424], eax
push dword [ebp + 8]
lea eax, [ebp - 0x414]
push eax
call fcn.00464609
pop ecx
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.004645da
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004607fb
mov esp, ebp
pop ebp
ret

Function at 0x44ceb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x44ced2
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x44ced9
mov eax, 0x1000000
jmp 0x44cf57
mov eax, dword [ebp - 4]
add eax, 0x138
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x47e310
mov eax, dword [ebp - 4]
add eax, 0x138
push eax
call fcn.004645da
pop ecx
pop ecx
cmp dword [ebp + 0x10], 1
jne 0x44cf21
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x44cf21
mov eax, 0x2000000
jmp 0x44cf57
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045170f
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x44cf44
mov eax, dword [ebp - 0x10]
jmp 0x44cf57
push dword [ebp - 8]
call fcn.0045228e
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [0x4a6894]
mov esp, ebp
pop ebp
ret 0xc