joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f00c90a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xf4
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xe0], edx
push eax
push 0x2000000
xor eax, eax
mov dword [ebp - 0xd4], 0x14
push eax
push 0x4f0015e8
mov edi, ecx
mov dword [ebp - 0xe8], eax
push 0x80000002
mov dword [ebp - 0xdc], edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x4f00c968
xor eax, eax
jmp 0x4f00cae0
push ebx
push esi
xor ecx, ecx
lea eax, [ebp - 0xd4]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x2c]
mov ebx, ecx
push eax
push ecx
push dword [ebp - 0xd0]
mov esi, ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x4f00cad0
add edi, 0x2c
cmp word [ebp - 0x2c], 0x45
mov dword [ebp - 0xd4], 0x14
je 0x4f00c9b3
cmp word [ebp - 0x2c], 0x65
jne 0x4f00caa9
cmp dword [ebp - 0xdc], 0
je 0x4f00caa2
cmp esi, dword [ebp - 0xe0]
jge 0x4f00cad0
lea eax, [ebp - 0xd8]
push eax
push 0x2000000
xor eax, eax
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xe4], 0x50
push eax
lea eax, [ebp - 0xcc]
push eax
xor eax, eax
push eax
push eax
push 0x4f001574
push dword [ebp - 0xd8]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0xd8]
xor eax, eax
mov word [ebp - 0x2e], ax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea ecx, [ebp - 0x2c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xe8]
jne 0x4f00ca3d
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
mov word [ebp - 0xf4], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xec]
push eax
push 0x10
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
mov eax, dword [ebp - 0xec]
lea ecx, [edi - 0x28]
mov dword [edi - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x14
pop edx
call fcn.4f00c5bc
lea eax, [ebp - 0xcc]
mov ecx, edi
push eax
push 0x50
pop edx
call fcn.4f00c5bc
inc esi
add edi, 0xcc
xor eax, eax
inc ebx
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp - 0xd0]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x4f00c997
push dword [ebp - 0xd0]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.4f0051a0
leave
ret
Function at 0x4f00d820
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
movzx esi, ax
cmp esi, dword [0x4f01ac3c]
jne 0x4f00d848
mov eax, dword [0x4f01ac38]
jmp 0x4f00d87a
push 7
lea eax, [ebp - 0x14]
push eax
push 0x1004
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4f00d87a
push 0xa
lea eax, [ebp - 0x14]
mov dword [0x4f01ac3c], esi
push 0
push eax
call dword [sym.imp.ntdll.dll_wcstol]
add esp, 0xc
mov dword [0x4f01ac38], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4f0051a0
leave
ret 4

Function at 0x4f00f601
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0xd1
push dword [0x4f01a5a4]
mov esi, ecx
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov ebx, eax
push esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 8], eax
xor ebx, ebx
mov edi, 0x4f01a3e0
mov eax, dword [edi + 4]
push 0xcc0020
push 0
push ebx
push esi
push 8
push 8
add eax, 2
push eax
mov eax, dword [edi]
add eax, 2
push eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
add edi, 8
add ebx, 8
cmp edi, 0x4f01a558
jl 0x4f00f642
push dword [ebp - 8]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f00f71e
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, ecx
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4f00f84a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x4f00f84a
test byte [edi + 0xbc], 2
je 0x4f00f785
lea esi, [edi + 0xd4]
mov ecx, ebx
add edi, 0xcc
push esi
mov edx, edi
call fcn.4f00f48a
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push esi
mov edx, edi
mov ecx, ebx
call fcn.4f00f48a
jmp 0x4f00f83c
cmp dword [edi + 0xc8], 0xffffffff
je 0x4f00f83c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [ebp - 0x18]
call fcn.4f00f853
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [edi + 0xc0]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [edi + 0xbc]
mov edx, dword [edi + 0xc8]
mov dword [ebp - 0xc], eax
test cl, 4
je 0x4f00f7ed
cmp dword [ebp - 4], edx
jne 0x4f00f7f2
jmp 0x4f00f823
cmp dword [ebp - 4], edx
jne 0x4f00f823
cmp edx, 0x33
jne 0x4f00f7fc
test cl, 1
jne 0x4f00f81a
mov ecx, dword [ebp - 8]
call fcn.4f00f692
mov edx, dword [edi + 0xc8]
mov ecx, esi
call fcn.4f00f692
mov ecx, dword [edi + 0xbc]
mov eax, dword [ebp - 0xc]
xor ecx, 4
mov dword [edi + 0xbc], ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
jmp 0x4f00f84c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4f010ca4
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x6c
push dword [0x4f01a5a4]
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_LoadBitmapW]
mov edi, eax
push ebx
mov dword [ebp - 0x10], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xffffffffffffffd0
mov dword [ebp - 0xc], eax
lea edi, [esi + 0x30]
pop eax
sub eax, esi
push 0x2f
mov dword [ebp - 8], eax
pop esi
push 0xcc0020
push 0
add eax, edi
push eax
push ebx
push 8
push 8
push dword [edi + 4]
push dword [edi]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 8]
add edi, 8
sub esi, 1
jne 0x4f010ceb
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4f01107b
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x28], edx
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x4f011222
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4f011222
cmp dword [esi + 0x284], 0xffffffff
je 0x4f0110e5
cmp dword [esi + 0x288], 0xffffffff
je 0x4f0110e5
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4f011214
lea ebx, [esi + 0x27c]
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, ebx
mov ecx, esi
call fcn.4f010eb9
mov ebx, eax
cmp ebx, 0x3b
jae 0x4f011111
push 0x7f89
jmp 0x4f011116
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x28]
mov ecx, 0x201
shr eax, 0x10
cmp ax, cx
jne 0x4f011214
push edi
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [esi + 0x278]
cmp ecx, 0x3b
jae 0x4f011182
mov cl, byte [ecx + 0x4f001a20]
movzx eax, cl
push 0
push 2
movzx eax, byte [eax*4 + 0x4f01a5e0]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
push dword [esi + 0x278]
xor edx, edx
mov ecx, edi
push esi
call fcn.4f010d34
mov dword [esi + 0x278], 0x3b
cmp ebx, 0x3b
jae 0x4f0111ce
mov edx, esi
mov ecx, ebx
call fcn.4f010e14
test eax, eax
je 0x4f0111c4
mov dl, byte [ebx + 0x4f001a20]
movzx eax, dl
push 0
push 0
movzx eax, byte [eax*4 + 0x4f01a5e0]
push eax
push edx
call dword [sym.imp.USER32.dll_keybd_event]
push ebx
push esi
xor edx, edx
mov dword [esi + 0x278], ebx
mov ecx, edi
call fcn.4f010d34
jmp 0x4f011214
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x4f011214
lea ecx, [ebp - 0x24]
call fcn.4f011790
lea ebx, [esi + 0x27c]
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x14]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebx]
lea ecx, [esi + 0x284]
sub eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [ecx], eax
mov eax, dword [esi + 0x280]
sub eax, dword [ebp - 0x10]
push ecx
mov ecx, edi
mov dword [esi + 0x288], eax
call fcn.4f010b92
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
jmp 0x4f011224
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f0051a0
leave
ret
Function at 0x4f011900
Capabilities:
Get keyboard layout
Hide graphical window
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4f01a01c]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x14], eax
test edi, edi
je 0x4f011ac4
cmp edi, 3
jae 0x4f011ac4
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmLockImeDpi
test eax, eax
je 0x4f011ac4
mov esi, dword [eax + 0x1c]
push eax
call sym.IMM32.dll_ImmUnlockImeDpi
test esi, 0x10000
je 0x4f011ac4
cmp dword [0x4f01a038], 0
je 0x4f0119fb
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
call fcn.4f0117e3
test eax, eax
je 0x4f011ac4
xor esi, esi
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [esi*4 + 0x4f01a5e0], eax
inc esi
cmp esi, 0xff
jb 0x4f01198d
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
mov dword [0x4f01ac64], eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
push 0x2d
mov dword [0x4f01ac68], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, eax
push 0x2e
mov dword [0x4f01a5d8], esi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 6
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, eax
and dword [0x4f01a038], 0
mov dword [0x4f01a5dc], esi
mov ecx, edi
call fcn.4f011b18
test eax, eax
je 0x4f011ac4
lea eax, [esp + 0x18]
mov ecx, edi
push eax
lea edx, [esp + 0x14]
call fcn.4f011858
mov esi, dword [esp + 0x10]
test ebx, ebx
jns 0x4f011a26
xor ebx, ebx
jmp 0x4f011a37
mov ecx, dword [0x4f01ac64]
lea eax, [ebx + esi]
cmp eax, ecx
jle 0x4f011a37
mov ebx, ecx
sub ebx, esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
test ecx, ecx
jns 0x4f011a47
xor ecx, ecx
jmp 0x4f011a5a
lea eax, [ecx + edx]
cmp eax, dword [0x4f01ac68]
jle 0x4f011a5a
mov ecx, dword [0x4f01ac68]
sub ecx, edx
sub edi, 1
je 0x4f011a87
sub edi, 1
jne 0x4f011ac4
push edi
push dword [0x4f01a5a4]
push edi
push dword [esp + 0x18]
push edx
push esi
push ecx
push ebx
push 0x88800000
push edi
push dword [0x4f001100]
push 0x101
jmp 0x4f011aa8
push 0
push dword [0x4f01a5a4]
push 0
push dword [esp + 0x18]
push edx
push esi
push ecx
push ebx
push 0x88000000
push 0
push dword [0x4f0010fc]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, esi
jmp 0x4f011ac6
xor eax, eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.4f0051a0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4f011d10
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x114], ebx
call sym.IMM32.dll_ImmGetContext
push ebx
mov edi, eax
call sym.IMM32.dll_ImmLockImeDpi
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0x110], esi
test esi, esi
je 0x4f011e21
xor edx, edx
mov ecx, edi
inc edx
call fcn.4f002e80
mov dword [ebp - 0x118], eax
test eax, eax
je 0x4f011e1b
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 0x105], bl
cmp cl, 0xe7
jne 0x4f011d9a
test byte [esi + 0x10], 0x20
jne 0x4f011d9a
test dword [esi + 0x10], 0x80000
je 0x4f011eae
mov byte [ebp - 0x105], 1
push 0x100
lea eax, [ebp - 0x104]
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
test byte [esi + 0x50], 4
jne 0x4f011dc6
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4f011e15
mov eax, dword [ebp + 0x10]
mov ecx, eax
cmp byte [ebp - 0x105], bl
je 0x4f011dd6
movzx ecx, ax
mov esi, dword [esi + 0x78]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x14]
push ecx
push edi
mov ecx, esi
call dword [0x4f01b2cc]
call esi
mov esi, dword [ebp - 0x110]
test eax, eax
je 0x4f011e15
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp + 0x10]
push 2
mov dword [eax + 0x144], 1
mov dword [eax + 0x140], ecx
pop ebx
push edi
call sym.IMM32.dll_ImmUnlockIMC
push esi
call sym.IMM32.dll_ImmUnlockImeDpi
call sym.IMM32.dll_CtfImmIsCiceroStartedInThread
test eax, eax
je 0x4f011ede
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.MSCTF.dll_CtfImeProcessCicHotkey]
test eax, eax
je 0x4f011ebe
cmp dword [ebp + 0x10], 0x19
jne 0x4f011e4b
cmp dword [ebp + 0x18], 0x30
je 0x4f011e4e
or ebx, 1
mov esi, dword [ebp - 0x10c]
test bl, 2
je 0x4f011e9b
push edi
call sym.IMM32.dll_ImmGetAppCompatFlags
test eax, 0x10000
je 0x4f011e9b
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
and eax, 0x3ff
mov ecx, 0xe5
cmp ax, 0x12
jne 0x4f011e86
cmp dword [ebp + 0x10], ecx
je 0x4f011e9b
test bl, 1
jne 0x4f011e9b
push dword [ebp + 0x14]
push ecx
push 0x100
push esi
call sym.IMM32.dll_ImmTranslateMessage
and ebx, 0xfffffffd
or ebx, 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f0051a0
leave
ret 0x14
cmp dword [eax + 4], ebx
je 0x4f011e15
push 0x10
jmp 0x4f011e14
mov ecx, dword [ebp - 0x114]
mov edx, 0xe000
mov eax, ecx
shr eax, 0x10
and eax, 0xf000
cmp ax, dx
jne 0x4f011e4e
jmp 0x4f011ee4
mov ecx, dword [ebp - 0x114]
cmp dword [ebp + 0x18], 0xffffffff
je 0x4f011e4e
push dword [ebp + 0x18]
mov esi, dword [ebp - 0x10c]
mov edx, edi
push ecx
mov ecx, esi
call fcn.4f00ab44
test eax, eax
je 0x4f011e54
cmp dword [ebp + 0x10], 0x19
jne 0x4f011f19
cmp dword [ebp + 0x18], 0x30
je 0x4f011e54
or ebx, 1
jmp 0x4f011e54
Function at 0x4f012580
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x164], eax
mov ebx, esi
call fcn.4f01223d
test eax, eax
jne 0x4f0125bc
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4f01267a
push esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov esi, eax
test esi, esi
jle 0x4f012678
push edi
lea edx, [esi*4 + 4]
xor ecx, ecx
call fcn.4f002470
mov edi, eax
mov dword [ebp - 0x168], edi
test edi, edi
je 0x4f012677
push edi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp eax, esi
jne 0x4f012668
mov eax, dword [ebp - 0x164]
xor ecx, ecx
add eax, 0x78
mov dword [edi + esi*4], ecx
cmp word [eax], cx
jne 0x4f012610
mov esi, edi
jmp 0x4f01263a
push eax
push 3
lea eax, [ebp - 0x160]
push eax
call sym.IMM32.dll_ImmGetImeInfoEx
test eax, eax
je 0x4f012668
mov eax, dword [edi]
mov esi, edi
jmp 0x4f012636
add esi, 4
cmp eax, dword [ebp - 0x160]
je 0x4f01263a
mov eax, dword [esi]
test eax, eax
jne 0x4f012629
test esi, esi
je 0x4f012668
mov eax, dword [esi]
test eax, eax
je 0x4f012668
mov edi, dword [ebp - 0x164]
mov edx, edi
mov ecx, eax
call fcn.4f0122bb
mov ebx, eax
lea esi, [esi + 4]
test ebx, ebx
jne 0x4f012662
mov eax, dword [esi]
test eax, eax
jne 0x4f01264a
mov edi, dword [ebp - 0x168]
push edi
push 0
push dword [0x4f01a9dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.4f0051a0
leave
ret 4
Function at 0x4f012710
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4f01a01c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov esi, ebx
call fcn.4f01223d
test eax, eax
jne 0x4f012743
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x4f0127fb
mov eax, dword [ebp + 0xc]
add eax, 0x78
push edi
cmp word [eax], bx
je 0x4f01276e
push eax
push 3
lea eax, [ebp - 0x160]
push eax
call sym.IMM32.dll_ImmGetImeInfoEx
test eax, eax
je 0x4f0127f8
mov esi, dword [ebp - 0x160]
jmp 0x4f0127ce
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov edi, eax
test edi, edi
jle 0x4f0127f8
lea edx, [edi*4 + 4]
xor ecx, ecx
call fcn.4f002470
mov ebx, eax
test ebx, ebx
je 0x4f0127f8
push ebx
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
cmp eax, edi
jne 0x4f0127be
and dword [ebx + edi*4], esi
mov eax, dword [ebx]
test eax, eax
je 0x4f0127be
mov edi, ebx
push eax
call sym.IMM32.dll_ImmIsIME
test eax, eax
je 0x4f0127bc
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x4f0127a7
jmp 0x4f0127be
mov esi, dword [edi]
push ebx
xor ebx, ebx
push ebx
push dword [0x4f01a9dc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x4f0127f8
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, esi
je 0x4f0127f8
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x4f0127f8
push esi
push 1
push 0x50
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x4f0127fa
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.4f0051a0
leave
ret 8
Function at 0x4f012d96
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor esi, esi
mov dword [ebp - 4], ecx
push esi
mov edi, edx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
mov dword [ebp - 8], eax
call sym.IMM32.dll_ImmIsIME
test eax, eax
je 0x4f012e77
mov eax, dword [edi + 0x14]
push ebx
mov ebx, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
cmp dword [ebp + 8], esi
je 0x4f012e0e
test eax, eax
je 0x4f012de4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4f012de4
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x18], ebx
je 0x4f012dfb
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4f012dfb
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 2
push dword [ebp - 4]
push dword [ebp - 8]
call sym.IMM32.dll_ImmConfigureIMEA
jmp 0x4f012e4a
test eax, eax
je 0x4f012e22
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4f012e22
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x18], ebx
je 0x4f012e39
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x4f012e39
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 2
push dword [ebp - 4]
push dword [ebp - 8]
call sym.IMM32.dll_ImmConfigureIMEW
cmp dword [edi + 0x14], 0
mov dword [ebp - 8], eax
je 0x4f012e60
test esi, esi
je 0x4f012e60
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [edi + 0x18], 0
je 0x4f012e73
test ebx, ebx
je 0x4f012e73
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
pop ebx
pop edi
pop esi
leave
ret 4

Function at 0x4f012f68
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, edx
mov ebx, ecx
push 1
push eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.win32u.dll_NtUserQueryInputContext]
test eax, eax
je 0x4f01302a
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmLockImeDpi
mov esi, eax
test esi, esi
je 0x4f01302a
test dword [esi + 0x10], 0x80000
mov edi, dword [ebp + 8]
je 0x4f012ff0
movsx ebx, byte [edi + 6]
push 1
mov al, byte [ebx + edi]
mov byte [ebp - 4], al
mov al, byte [ebx + edi + 1]
mov byte [ebp - 3], al
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x4f013024
mov ax, word [ebp - 8]
mov byte [ebx + edi], al
movzx eax, ax
shr eax, 8
mov byte [ebx + edi + 1], al
mov ebx, dword [ebp - 0xc]
push esi
call sym.IMM32.dll_ImmUnlockImeDpi
push edi
push 0x31
push dword [ebp - 0x10]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmEscapeW
mov esi, eax
test esi, esi
je 0x4f013020
push 1
push 5
push 0x282
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
jmp 0x4f01302c
push esi
call sym.IMM32.dll_ImmUnlockImeDpi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4f013033
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
cmp dword [esi + 4], 2
jne 0x4f013070
movsx eax, word [esi + 0x14]
mov dword [ebp - 8], eax
movsx eax, word [esi + 0x16]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
movzx ecx, word [ebp - 4]
movzx eax, word [ebp - 8]
shl ecx, 0x10
or ecx, eax
mov dword [esi + 0x14], ecx
push esi
push 8
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
call sym.IMM32.dll_ImmEscapeW
pop edi
pop esi
leave
ret 4

Function at 0x4f013088
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 4]
cmp eax, 0xfb
ja 0x4f013127
cmp eax, 0xfa
jae 0x4f01311c
cmp eax, 0x1c
je 0x4f013116
cmp eax, 0xef
jbe 0x4f01315c
cmp eax, 0xf6
jbe 0x4f01311c
cmp eax, 0xf7
je 0x4f013101
cmp eax, 0xf8
je 0x4f0130e7
cmp eax, 0xf9
jne 0x4f01315c
push 0
push 4
push 0x15
push esi
jmp 0x4f01316d
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push esi
push 1
push edi
push eax
cmp dword [ebp + 0xc], esi
je 0x4f01310f
call sym.IMM32.dll_ImmConfigureIMEA
jmp 0x4f013172
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push esi
push 2
jmp 0x4f0130f3
call sym.IMM32.dll_ImmConfigureIMEW
jmp 0x4f013172
push 0
push 2
jmp 0x4f0130df
mov edx, eax
mov ecx, esi
call fcn.4f0136ba
jmp 0x4f013172
cmp eax, 0xfc
je 0x4f013160
mov edx, 0xfd
cmp eax, edx
je 0x4f01315c
cmp eax, 0xffff
je 0x4f013143
cmp eax, 0xffffffff
jne 0x4f01315c
cmp dword [ecx + 8], 0x1c
je 0x4f013157
cmp dword [ecx + 8], 0xef
jbe 0x4f01315c
cmp dword [ecx + 8], edx
ja 0x4f01315c
xor eax, eax
inc eax
jmp 0x4f013172
xor eax, eax
jmp 0x4f013172
push 0
push 1
push 0x15
push edi
call sym.IMM32.dll_ImmGetContext
push eax
call sym.IMM32.dll_ImmNotifyIME
pop edi
pop esi
pop ebp
ret 8