joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453b30
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
push 0
mov ebp, ecx
xor bl, bl
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0x10]
push eax
push 0x4ae840
push 1
push 0
push 0x4ae864
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, 1
test eax, eax
js 0x453cc7
mov eax, dword [esp + 0x10]
push dword [esp + 0x224]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [esp + 0x22c]
cmp word [edx], 0
je 0x453b95
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov edx, dword [esp + 0x230]
cmp word [edx], 0
je 0x453bad
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [esp + 0x234]
cmp word [edx], 0
je 0x453bc5
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov ecx, dword [esp + 0x240]
cmp word [ecx], 0
je 0x453bdb
call fcn.0047b060
mov esi, eax
jmp 0x453bdd
xor esi, esi
mov edi, dword [esp + 0x238]
cmp word [edi], 0
je 0x453bff
mov ecx, dword [esp + 0x10]
xor eax, eax
test esi, esi
setg al
mov edx, dword [ecx]
sub esi, eax
push esi
push edi
push ecx
call dword [edx + 0x44]
mov esi, dword [esp + 0x23c]
cmp word [esi], 0
je 0x453c41
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00413120
add esp, 0xc
test al, al
je 0x453c41
mov ecx, dword [esp + 0x10]
mov esi, 0x600
movzx eax, al
or ax, si
movzx eax, ax
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x34]
mov ecx, dword [esp + 0x244]
cmp word [ecx], 0
je 0x453c5e
call fcn.0047b060
mov ecx, dword [esp + 0x10]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x3c]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x4ae894
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x453cb8
push 0
lea eax, [esp + 0x1c]
push eax
push 0x104
push dword [esp + 0x234]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
test eax, eax
movzx ebx, bl
mov eax, dword [esp + 0x14]
mov esi, 1
push eax
cmovns ebx, esi
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x453cbd
mov esi, 1
mov ecx, dword [esp + 0x10]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
test bl, bl
je 0x453ce0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0x24
push 0
push ebp
push 0x4b431c
push 0
push str.Failed
mov ecx, 0x4dcd68
call fcn.004287a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0x24
Function at 0x454180
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
sub esp, 0x230
test dl, dl
jne 0x4541a2
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x45426e
mov al, 1
add esp, 0x230
ret
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x28]
push eax
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4541c0
sub ecx, edx
sar ecx, 1
je 0x4541e0
cmp word [esp + ecx*2 + 0x22], 0x5c
jne 0x4541e0
xor eax, eax
mov word [esp + ecx*2 + 0x22], ax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45426e
test al, 0x10
je 0x45426e
lea ecx, [esp + 0x24]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x454200
sub ecx, edx
mov dword [esp + 0xc], 0
sar ecx, 1
xor eax, eax
mov dword [esp + 0x16], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x12], 0
mov word [esp + ecx*2 + 0x26], ax
lea eax, [esp + 0x24]
mov dword [esp + 8], eax
mov eax, 0x614
mov word [esp + 0x10], ax
lea eax, [esp]
push eax
mov dword [esp + 4], 0
mov dword [esp + 8], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
add esp, 0x230
ret
xor al, al
add esp, 0x230
ret
Function at 0x4547f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x258
push esi
mov esi, ecx
push 0x2a
push esi
call fcn.0049515e
add esp, 8
test eax, eax
jne 0x45482d
push 0x3f
push esi
call fcn.0049515e
add esp, 8
test eax, eax
jne 0x45482d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45483e
mov al, 1
pop esi
add esp, 0x258
ret
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x454848
xor al, al
pop esi
add esp, 0x258
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop esi
add esp, 0x258
ret

Function at 0x454860
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0xa74
push ebx
push ebp
push esi
push edi
push 0
mov ebx, ecx
mov dword [esp + 0x18], 0x22c
push 2
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
push ecx
push 0
push 1
xor edx, edx
mov ecx, ebx
call fcn.0047a5e0
add esp, 0xc
test eax, eax
je 0x4548b0
mov ecx, ebx
call fcn.0047b060
mov ebx, eax
jmp 0x4548b2
xor ebx, ebx
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x454976
test ebx, ebx
je 0x4548d4
cmp ebx, dword [esp + 0x1c]
je 0x45498a
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0x66c]
push eax
lea eax, [esp + 0x880]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0049faad
lea eax, [esp + 0x468]
add esp, 0x14
mov esi, eax
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x454910
lea edi, [esp + 0x244]
sub eax, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x454930
push dword [esp + 0x10]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x248]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004979b3
add esp, 8
test eax, eax
je 0x45499e
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4548c6
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa74
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa74
ret
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa74
ret
Function at 0x45f820
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0
push 0
push 0x147
push dword [ebx + 0x18]
mov dword [esp + 0x20], eax
call eax
push dword [ebx + 0x18]
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [esp + 0x14], eax
lea ecx, [eax*2 + 2]
push ecx
call fcn.00497ab4
mov esi, eax
add esp, 4
test esi, esi
jne 0x45f881
mov ecx, dword [ebp + 8]
push str.Out_of_memory.
call fcn.00429450
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x14]
inc eax
push eax
push esi
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [esp + 0x14], eax
cmp edi, 0xffffffff
je 0x45f8c4
mov ecx, dword [ebx + 0x18]
test eax, eax
jne 0x45f8b1
push eax
push edi
push 0x149
push ecx
call dword [esp + 0x20]
test eax, eax
jmp 0x45f8c2
push esi
lea eax, [edi - 1]
push eax
push 0x158
push ecx
call dword [esp + 0x20]
cmp edi, eax
je 0x45f902
push esi
push 0xffffffffffffffff
push 0x158
push dword [ebx + 0x18]
call dword [esp + 0x20]
mov edi, eax
cmp edi, 0xffffffff
jne 0x45f902
cmp dword [ebp + 0x10], 0
je 0x45f902
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], 0
mov dword [eax + 0x14], esi
mov dword [eax], esi
mov dword [eax + 4], ecx
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
call fcn.00497f48
mov eax, dword [ebp + 0x10]
add esp, 4
test eax, eax
je 0x45f9c3
cmp eax, 2
jne 0x45f924
test byte [ebx + 0x31], al
jne 0x45f9c3
push 0
push edi
push 0x149
push dword [ebx + 0x18]
call dword [esp + 0x20]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x45f9d6
cmp ebx, 0xff
ja 0x45f990
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov dword [esi], eax
xor ecx, ecx
mov word [eax + ebx*2], cx
mov dword [esi + 4], ebx
push dword [esi]
mov eax, dword [ebp + 0xc]
push edi
push 0x148
push dword [eax + 0x18]
call dword [esp + 0x20]
cmp eax, 0xffffffff
mov eax, 1
jne 0x45f9db
mov dword [esi + 8], 0
mov dword [esi], 0x4b431c
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebx*2 + 2]
push eax
call fcn.00497ab4
mov esi, dword [ebp + 8]
add esp, 4
mov dword [esi + 0x14], eax
test eax, eax
jne 0x45f94c
push str.Out_of_memory.
mov ecx, esi
call fcn.00429450
test eax, eax
jne 0x45f957
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 8]
lea eax, [edi + 1]
cdq
mov dword [ecx + 8], 1
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45fce0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
mov esi, ebx
cmp ebx, 0xffffffff
jne 0x45fd0f
xor esi, esi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45fd00
sub esi, ecx
sar esi, 1
cmp esi, 0xff
ja 0x45fd5a
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x10]
mov dword [edi], eax
xor ecx, ecx
mov word [eax + esi*2], cx
mov dword [edi + 4], esi
lea eax, [ebx + 1]
push eax
push dword [edi]
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [edi + 4], eax
test eax, eax
je 0x45fd4d
mov ecx, dword [edi]
cmp word [ecx + eax*2 - 2], 0
jne 0x45fd4d
dec eax
mov dword [edi + 4], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea eax, [esi*2 + 2]
push eax
call fcn.00497ab4
mov edi, dword [esp + 0x1c]
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
jne 0x45fd1e
push str.Out_of_memory.
mov ecx, edi
call fcn.00429450
cmp eax, 1
je 0x45fd29
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 8

Function at 0x45fe60
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x45ff63
mov eax, dword [esi + 0x24]
push edi
test eax, eax
je 0x45feb4
push ebx
push 0
push 0
push 0x406
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x45feb3
push ebp
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
push 0
push edi
push 0x414
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x45fead
push eax
call ebp
inc edi
cmp edi, ebx
jl 0x45fe95
pop ebp
pop ebx
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45fef0
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetMenu]
cmp byte [esi + 0xc4], 0
jne 0x45fef0
push dword [esi + 0x1c]
mov byte [esi + 0xc4], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x45ff03
cmp esi, dword [0x4dbc78]
jne 0x45ff20
test eax, eax
je 0x45ff08
lea edx, [eax + 0x14]
jmp 0x45ff0d
mov edx, 0x4dbc78
mov ecx, dword [esi + 0x14]
lea edi, [ecx + 0x18]
test ecx, ecx
jne 0x45ff1c
mov edi, 0x4dbe34
mov dword [edx], ecx
mov dword [edi], eax
mov ecx, esi
mov dword [esi + 0x1c], 0
call fcn.0045ff70
cmp byte [esi + 0xc8], 0
pop edi
je 0x45ff3e
mov eax, dword [esi]
push esi
call dword [eax + 8]
cmp dword [0x4dbc60], 0
jne 0x45ff63
mov ecx, 0x4dcd68
call fcn.00415d40
test al, al
jne 0x45ff63
push 0
push 2
mov ecx, 0x4dcd68
call fcn.00415de0
pop esi
ret
Function at 0x468430
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
xor edx, edx
mov ecx, dword [esi + 0x54]
test ecx, ecx
jle 0x468455
mov eax, dword [esi + 0x4c]
add eax, 0xa
cmp dword [eax - 6], 2
jne 0x46844d
cmp byte [eax], 0
je 0x46848d
inc edx
add eax, 0xc
cmp edx, ecx
jl 0x468442
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4684a7
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
setne cl
cmp cl, byte [esi + 0xc8]
je 0x4684a7
mov eax, dword [esi]
mov byte [esi + 0xc8], cl
push esi
test cl, cl
je 0x4684a4
call dword [eax + 4]
jmp 0x4684a7
push 0
push 0x2af80002
push 0x414
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
call dword [eax + 8]
cmp dword [0x4dbc60], 0
jne 0x4684cc
mov ecx, 0x4dcd68
call fcn.00415d40
test al, al
jne 0x4684cc
push 0
push 5
mov ecx, 0x4dcd68
call fcn.00415de0
pop esi
ret
Function at 0x46af30
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x24
cmp dword [0x4d78c0], 0
push ebx
push ebp
push esi
mov ebp, ecx
je 0x46af76
cmp dword [0x4dbc4c], 0
jne 0x46af76
mov ebx, dword [esp + 0x34]
xor ecx, ecx
mov edx, dword [ebx + 0x28]
test edx, edx
jle 0x46af76
mov esi, dword [esp + 0x38]
mov eax, dword [ebx + 0x20]
add eax, 0xa
mov esi, dword [esi + 8]
cmp dword [eax - 6], esi
jne 0x46af6e
cmp byte [eax], 1
je 0x46af81
inc ecx
add eax, 0xc
cmp ecx, edx
jl 0x46af64
xor al, al
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
mov eax, dword [0x4dbc60]
cmp eax, dword [0x4d78c4]
jge 0x46af76
mov esi, dword [0x4d78c8]
cmp dword [esi + 0x3c], 0
jg 0x46af76
mov edx, dword [0x4dbc48]
inc eax
add esi, 0xa0
mov dword [0x4dbc60], eax
mov dword [0x4d78c8], esi
test edx, edx
je 0x46afbb
add edx, 0x58
jmp 0x46afbd
xor edx, edx
movups xmm0, xmmword [edx]
mov ecx, esi
lea eax, [esi + 0x58]
neg ecx
push 0x58
sbb ecx, ecx
and ecx, eax
push 0
push esi
movups xmmword [ecx], xmm0
movups xmm0, xmmword [edx + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [edx + 0x30]
movups xmmword [ecx + 0x30], xmm0
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
call fcn.004956d0
add esp, 0xc
mov byte [esi + 0x53], 1
mov ecx, 0x4dcd68
mov dword [esi + 0x3c], 0
push 0
call fcn.00415750
mov al, byte [esi + 0x96]
test al, al
jne 0x46b020
mov byte [esi + 0x96], al
cmp dword [0x4dd440], 0
je 0x46b032
cmp dword [0x4dd43c], 0
jne 0x46b036
test al, al
je 0x46b061
mov byte [esi + 0x53], 0
test al, al
jne 0x46b061
cmp dword [0x4dd440], 0
jge 0x46b050
mov dword [esi + 0x44], 0xffffffff
jmp 0x46b061
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x48], eax
mov eax, dword [0x4dd440]
mov dword [esi + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4dd444], eax
mov eax, dword [ebp]
push ebp
call dword [eax + 4]
push dword [esp + 0x3c]
mov eax, ebx
mov dword [esp + 0x1c], 5
mov dword [esp + 0x14], eax
lea ecx, [ebx + 0x20]
mov eax, dword [esp + 0x3c]
push ebp
push 1
mov dword [esp + 0x2c], eax
push dword [eax + 8]
lea eax, [esp + 0x20]
mov dword [esp + 0x38], 1
push 2
push eax
mov dword [esp + 0x3c], 0
call fcn.00474ce0
mov ecx, dword [ebp]
mov esi, eax
push ebp
call dword [ecx + 8]
call fcn.00404340
cmp esi, 7
pop esi
pop ebp
sete al
pop ebx
add esp, 0x24
ret 0xc
Function at 0x46b0d0
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, ecx
xor bl, bl
movzx eax, word [esi]
test ax, ax
je 0x46b10c
mov edx, eax
movzx eax, dx
cmp eax, 0x21
je 0x46b0fb
cmp eax, 0x2b
je 0x46b0f7
cmp dx, 0x5e
jne 0x46b10c
mov al, 2
jmp 0x46b0fd
mov al, 1
jmp 0x46b0fd
mov al, 4
add esi, 2
or bl, al
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x46b0e0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00413120
mov bh, al
add esp, 0xc
test bh, bh
jne 0x46b12f
pop esi
xor eax, eax
pop ebx
ret
xor edx, edx
mov ecx, esi
call fcn.00413030
movzx edx, ax
test dx, dx
jne 0x46b14c
xor dl, dl
mov cl, bh
call fcn.00413780
movzx edx, ax
mov al, bl
or al, 8
and edx, 0x100
movzx ecx, al
movzx eax, bl
cmove ecx, eax
movzx eax, cl
movzx ecx, bh
shl ax, 8
pop esi
or ax, cx
pop ebx
ret
Function at 0x46c5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x806c
call fcn.004ac150
push ebx
push ebp
push esi
mov ebx, edx
mov esi, ecx
push edi
cmp ebx, 0xc7
ja 0x46c807
mov eax, dword [esi + 0x3c]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov dword [esp + 0x14], eax
lea eax, [eax + ebx*4]
push 0
add eax, 6
push 0x1004
push dword [esi + 0x18]
add eax, ebx
mov dword [esp + 0x24], eax
call edi
mov edx, dword [esp + 0x14]
mov ebp, eax
cmp byte [edx + 1], 0
je 0x46c63f
cmp byte [esp + 0x8080], 0
jne 0x46c807
cmp ebp, 2
jl 0x46c807
mov ax, word [esp + 0x8084]
test ax, ax
je 0x46c65b
cmp ax, 0x41
jmp 0x46c673
mov eax, dword [esp + 0x10]
cmp ebx, dword [eax]
jne 0x46c66f
cmp byte [edx + 3], 0
jne 0x46c66f
cmp byte [eax + 4], 0
jmp 0x46c673
cmp byte [edx + 4], 0
lea eax, [esp + 0x76]
sete byte [esp + 0x8076]
mov dword [esp + 0x44], eax
mov eax, 0x1fff
mov dword [esp + 0x48], eax
mov cl, byte [edx]
cmp cl, 1
jne 0x46c728
mov dword [esp + 0x50], 0
mov dword [esp + 0x34], 0
nop word [eax + eax]
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 1
push eax
push 0
push 0x104b
push dword [esi + 0x18]
mov dword [esp + 0x48], ebx
call edi
test eax, eax
je 0x46c6e0
mov ecx, dword [esp + 0x44]
call fcn.0047b060
mov dword [esp + 0x50], eax
jmp 0x46c6e8
mov dword [esp + 0x50], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 4
push eax
push 0
push 0x104c
push dword [esi + 0x18]
mov dword [esp + 0x48], 0
call edi
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
cmp eax, ebp
jl 0x46c6b0
movzx eax, byte [esp + 0x8076]
push 0x46c5c0
jmp 0x46c7ec
test cl, cl
jne 0x46c73c
cmp byte [edx + 2], 3
mov ecx, 0xffe
cmove eax, ecx
mov dword [esp + 0x48], eax
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x38], ebx
mov eax, dword [edx]
mov dword [esp + 0x70], eax
mov al, byte [edx + 4]
push 0x46c430
mov byte [esp + 0x78], al
lea eax, [esp + 0x1c]
push eax
push 0x1051
push ecx
mov byte [esp + 0x8087], 1
mov dword [esp + 0x54], 0
mov dword [esp + 0x40], 1
call edi
cmp dword [esp + 0x44], 0
jne 0x46c7f7
mov dword [esp + 0x38], 0
mov dword [esp + 0x30], 4
mov dword [esp + 0x50], 0
mov dword [esp + 0x34], 0
lea eax, [esp + 0x30]
push eax
push 0
push 0x104c
push dword [esi + 0x18]
call edi
mov eax, dword [esp + 0x34]
inc dword [esp + 0x50]
inc eax
mov dword [esp + 0x34], eax
cmp eax, ebp
jl 0x46c7a5
mov byte [esp + 0x8077], 0
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 1
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], ebx
push 0x46c430
push eax
push 0x1030
push dword [esi + 0x18]
call edi
mov ecx, dword [esp + 0x10]
mov dword [ecx], ebx
mov al, byte [esp + 0x8076]
mov byte [ecx + 4], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x806c
ret
Function at 0x46c8a0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x14], edi
nop
movzx eax, word [esi]
cmp eax, 0x20
je 0x46c8bd
cmp eax, 9
jne 0x46c8c2
add esi, 2
jmp 0x46c8b0
test ax, ax
je 0x46ca2c
cmp word [esi + 2], 0
lea ecx, [esi + 2]
jne 0x46c8e6
mov word [edi + 2], ax
mov al, 1
mov byte [edi], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push 0x2b
xor bl, bl
mov byte [edi], 1
push ecx
mov byte [esp + 0x1b], bl
call fcn.0049515e
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x46c9b7
lea edi, [ebp - 2]
cmp edi, esi
jbe 0x46c924
nop dword [eax + eax]
movzx eax, word [edi]
cmp eax, 0x20
je 0x46c91d
cmp eax, 9
jne 0x46c924
sub edi, 2
cmp edi, esi
ja 0x46c910
sub edi, esi
sar edi, 1
inc edi
push edi
push str.Ctrl
push esi
call fcn.00497b0e
add esp, 0xc
test eax, eax
jne 0x46c941
or bl, 1
jmp 0x46c973
push edi
push 0x4b4e44
push esi
call fcn.00497b0e
add esp, 0xc
test eax, eax
jne 0x46c959
or bl, 4
jmp 0x46c973
push edi
push str.Shift
push esi
call fcn.00497b0e
add esp, 0xc
test eax, eax
jne 0x46ca2c
or bl, 0x10
mov byte [esp + 0x13], bl
lea esi, [ebp + 2]
nop word [eax + eax]
movzx eax, word [esi]
cmp eax, 0x20
je 0x46c98d
cmp eax, 9
jne 0x46c992
add esi, 2
jmp 0x46c980
test ax, ax
je 0x46ca2c
lea eax, [esi + 2]
push 0x2b
push eax
call fcn.0049515e
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x46c904
mov edi, dword [esp + 0x14]
cmp word [esi + 2], 0
jne 0x46c9e7
push 1
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
movzx eax, word [esi]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea edx, [esp + 0x1b]
mov ecx, eax
call fcn.00413270
mov bl, byte [esp + 0x1b]
add esp, 8
jmp 0x46c9ff
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push ecx
push 0
xor edx, edx
mov ecx, esi
call fcn.00413120
add esp, 0xc
movzx eax, al
mov word [edi + 2], ax
test bl, 1
je 0x46ca0e
or byte [edi], 8
test bl, 4
je 0x46ca16
or byte [edi], 0x10
test bl, 0x10
je 0x46ca1e
or byte [edi], 4
pop edi
pop esi
test ax, ax
pop ebp
setne al
pop ebx
add esp, 8
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x46d7a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ad78d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
push edi
mov dword [esi + 4], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x4de0f8
mov dword [esi + 8], 0
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], 0
mov edi, dword [0x4dd630]
mov dword [esi], vtable.UserMenu.0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 2
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0xff000000
test edi, edi
je 0x46d843
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x46d84d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi + 0xc], edi
cmp dword [0x4dd400], 0
jne 0x46d861
mov dword [0x4dd400], esi
jmp 0x46d869
mov eax, dword [0x4dd404]
mov dword [eax + 0x20], esi
inc dword [0x4dd408]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword [0x4dd404], esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4