joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f71b
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f722
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f729
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6
Function at 0x44f730
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f737
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f73e
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6
Function at 0x44f745
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f74f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6

Function at 0x44f759
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 0x91
ja 0x44f6b0
lea edx, [eax - 0x4f]
cmp edx, 0x36
ja case.0x44f6a6.80
jmp dword [edx*4 + 0x4f4fcc]
xor eax, eax
mov dword [esp + 4], 3
mov dword [esp], eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
movzx eax, word [eax + eax + 0x4f51e0]
jmp 0x44f6b2
mov eax, 0x13
jmp 0x44f6c6
mov eax, 0x6f
jmp 0x44f6c6
mov eax, 0x6d
jmp 0x44f6c6
mov eax, 0x6e
jmp 0x44f6c6
mov eax, 0x62
jmp 0x44f6c6
mov eax, 0x63
jmp 0x44f6c6
mov eax, 0x64
jmp 0x44f6c6
mov eax, 0x65
jmp 0x44f6c6
mov eax, 0x66
jmp 0x44f6c6
mov eax, 0x67
jmp 0x44f6c6
mov eax, 0x68
jmp 0x44f6c6
mov eax, 0x69
jmp 0x44f6c6
mov eax, 0xa3
jmp 0x44f6c6
mov eax, 0xa5
jmp 0x44f6c6
mov eax, 0x61
jmp 0x44f6c6
mov eax, 0x60
jmp 0x44f6c6
Function at 0x44f7f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x820
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [edx - 0x4d]
cmp eax, 0x44
ja case.0x44f809.78
jmp dword [eax*4 + 0x4f50b0]
xor eax, eax
cmp edx, 0x91
ja 0x44f828
movzx eax, word [edx + edx + 0x4f51e0]
shl eax, 0x10
lea esi, [esi]
lea esi, [ebp - 0x808]
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
sub esp, 0xc
test eax, eax
jle 0x44fad0
mov dword [esp], esi
mov ecx, ebx
call method.sf::String.String_wchar_t_const_
mov eax, ebx
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, 0xe16d0000
jmp 0x44f828
mov eax, 0xe16c0000
jmp 0x44f828
mov eax, 0xe1210000
jmp 0x44f828
mov eax, 0xe16b0000
jmp 0x44f828
mov eax, 0xe1300000
jmp 0x44f828
mov eax, 0xe1660000
jmp 0x44f828
mov eax, 0xe1650000
jmp 0x44f828
mov eax, 0xe1680000
jmp 0x44f828
mov eax, 0xe1670000
jmp 0x44f828
mov eax, 0xe1690000
jmp 0x44f828
mov eax, 0xe16a0000
jmp 0x44f828
mov eax, 0xe15c0000
jmp 0x44f828
mov eax, 0xe1380000
jmp 0x44f828
mov eax, 0xe11d0000
jmp 0x44f828
mov eax, 0xe15b0000
jmp 0x44f828
mov eax, 0xe1100000
jmp 0x44f828
mov eax, 0xe1190000
jmp 0x44f828
mov eax, 0xe1240000
jmp 0x44f828
mov eax, 0xe1220000
jmp 0x44f828
mov eax, 0xe12c0000
jmp 0x44f828
mov eax, 0xe12e0000
jmp 0x44f828
mov eax, 0xe1200000
jmp 0x44f828
mov eax, 0xe11e0000
jmp 0x44f828
mov eax, 0xe15d0000
jmp 0x44f828
mov eax, 0xe1610000
jmp 0x44f828
mov eax, 0xe11c0000
jmp 0x44f828
mov eax, 0xe1350000
jmp 0x44f828
mov eax, 0xe1450000
jmp 0x44f828
mov eax, 0xe1480000
jmp 0x44f828
mov eax, 0xe1500000
jmp 0x44f828
mov eax, 0xe14b0000
jmp 0x44f828
mov eax, 0xe14d0000
jmp 0x44f828
mov eax, 0xe1510000
jmp 0x44f828
mov eax, 0xe14f0000
jmp 0x44f828
mov eax, 0xe1530000
jmp 0x44f828
mov eax, 0xe1490000
jmp 0x44f828
mov eax, 0xe1470000
jmp 0x44f828
mov eax, 0xe1520000
jmp 0x44f828
mov eax, 0xe1370000
jmp 0x44f828
lea esi, [ebp - 0x80c]
mov ecx, esi
call fcn.004cc160
mov dword [esp + 4], esi
mov ecx, ebx
mov dword [esp], str.Unknown
call method.sf::String.String_char_const__std::locale_const_
sub esp, 8
mov ecx, esi
call sym.std::locale::locale__
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret

Function at 0x44fb38
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 4
ja case.default.0x44fb2c
jmp dword [eax*4 + 0x4f51c4]
mov eax, 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
mov eax, 4
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fba4
mov eax, 1
jmp 0x44fb3d
mov eax, 6
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fb74
mov eax, 2
jmp 0x44fb3d
xor eax, eax
jmp 0x44fb3d
Function at 0x44fb58
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 4
ja case.default.0x44fb2c
jmp dword [eax*4 + 0x4f51c4]
mov eax, 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
mov eax, 4
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fba4
mov eax, 1
jmp 0x44fb3d
mov eax, 6
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fb74
mov eax, 2
jmp 0x44fb3d
xor eax, eax
jmp 0x44fb3d

Function at 0x44fb60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 4
ja case.default.0x44fb2c
jmp dword [eax*4 + 0x4f51c4]
mov eax, 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
mov eax, 4
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fba4
mov eax, 1
jmp 0x44fb3d
mov eax, 6
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fb74
mov eax, 2
jmp 0x44fb3d
xor eax, eax
jmp 0x44fb3d

Function at 0x44fb80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 4
ja case.default.0x44fb2c
jmp dword [eax*4 + 0x4f51c4]
mov eax, 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
mov eax, 4
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fba4
mov eax, 1
jmp 0x44fb3d
mov eax, 6
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fb74
mov eax, 2
jmp 0x44fb3d
xor eax, eax
jmp 0x44fb3d

Function at 0x44fb90
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
cmp eax, 4
ja case.default.0x44fb2c
jmp dword [eax*4 + 0x4f51c4]
mov eax, 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sub esp, 4
shr ax, 0xf
add esp, 0x1c
ret
mov eax, 4
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fba4
mov eax, 1
jmp 0x44fb3d
mov eax, 6
jmp 0x44fb3d
mov dword [esp], 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esp, 4
test eax, eax
je 0x44fb74
mov eax, 2
jmp 0x44fb3d
xor eax, eax
jmp 0x44fb3d
Function at 0x454c30
Capabilities:
Hide graphical window

Disassembly:
push edi
mov eax, 0xdc
push esi
push ebx
mov ebx, ecx
sub esp, 0x100
mov esi, dword [esp + 0x110]
mov word [esp + 0x68], ax
mov dword [esp + 0x6c], 0x1c0000
mov eax, dword [esi + 4]
mov edx, dword [esi]
mov ecx, dword [esi + 8]
mov dword [esp + 4], 4
mov dword [esp + 0xd4], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
sub esp, 8
test eax, eax
jne 0x454d40
mov dword [esp + 8], 0x86000000
mov edi, dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [esp + 4], 0xfffffff0
mov eax, dword [ebx + 0x398]
mov dword [esp], eax
call edi
sub esp, 0xc
mov dword [esp + 8], 0x40000
mov dword [esp + 4], 0xffffffec
mov eax, dword [ebx + 0x398]
mov dword [esp], eax
call edi
sub esp, 0xc
mov dword [esp + 0x18], 0x20
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebx + 0x398]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
sub esp, 0x1c
mov dword [esp + 4], 5
mov eax, dword [ebx + 0x398]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x534994], ebx
sub esp, 8
add esp, 0x100
pop ebx
pop esi
pop edi
ret 4
call method.sf.err__
mov dword [esp + 8], 0x2c
mov dword [esp + 4], str.Failed_to_change_display_mode_for_fullscreen
mov ebx, eax
mov dword [esp], eax
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__int_
mov eax, dword [ebx]
mov eax, dword [eax - 0xc]
mov esi, dword [ebx + eax + 0x7c]
test esi, esi
je 0x454dcc
cmp byte [esi + 0x1c], 0
je 0x454da0
movsx eax, byte [esi + 0x27]
mov dword [esp], eax
mov ecx, ebx
call sym.std::ostream::put_char_
sub esp, 4
mov ecx, eax
call sym.std::ostream::flush__
add esp, 0x100
pop ebx
pop esi
pop edi
ret 4
mov ecx, esi
call sym.std::ctype_char_::_M_widen_init___const
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov eax, 0xa
cmp edx, method.std::ctype_char_.do_widen_char__const
je 0x454d76
mov dword [esp], 0xa
mov ecx, esi
call edx
sub esp, 4
movsx eax, al
jmp 0x454d76
call sym.std::__throw_bad_cast__
nop
lea esi, [esi]
lea esi, [esi]
Function at 0x45b250
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov edi, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
cmp edi, esi
je 0x45b292
mov ebx, ecx
mov dword [esp], 2
sub esi, edi
call dword [0x4e91e8]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x14], eax
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret

Function at 0x45b390
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x10
mov edi, dword [ecx + 0x10]
mov esi, dword [ecx + 0x14]
mov dword [ecx], fcn.0045b320
cmp edi, esi
je 0x45b3d8
sub esi, edi
mov dword [esp], 2
call dword [0x4e91e8]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sym._fwrite
mov esi, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
test esi, esi
je 0x45b3e4
mov dword [esp], esi
call sym.operator_delete___void_
mov dword [ebx], sym.imp.libstdc_6.dll_vtable_for_std::basic_ios_char__std::char_traits_char___
lea ecx, [ebx + 0x1c]
call sym.std::locale::locale__
mov dword [esp], ebx
mov dword [esp + 4], 0x20
call sym.operator_delete_void__unsigned_int_
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x45b410
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x1c
mov ebx, dword [ecx + 0x14]
cmp dword [esp + 0x30], 0xffffffff
je 0x45b490
mov eax, dword [ecx + 0x18]
mov edi, dword [sym.___acrt_iob_func]
lea esi, [esi]
cmp ebx, eax
jne 0x45b46e
mov ebp, dword [esi + 0x10]
cmp ebx, ebp
je 0x45b430
sub ebx, ebp
mov dword [esp], 2
call edi
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym._fwrite
mov ebx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
mov dword [esi + 0x14], ebx
cmp ebx, eax
je 0x45b434
movzx edx, byte [esp + 0x30]
jae 0x45b4d5
movzx eax, byte [esp + 0x30]
mov byte [ebx], al
mov eax, edx
add dword [esi + 0x14], 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret 4
mov edi, dword [ecx + 0x10]
cmp ebx, edi
je 0x45b4c7
mov dword [esp], 2
sub ebx, edi
call dword [0x4e91e8]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov eax, dword [esi + 0x10]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [esi + 0x10]
mov dword [esi + 0x14], eax
add esp, 0x1c
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret 4
mov dword [esp + 0x30], edx
jmp 0x45b430

Function at 0x45dca0
Capabilities:
Set thread local storage value

Disassembly:
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x10
mov dword [esp], 4
mov edi, dword [esp + 0x20]
call sym.operator_new_unsigned_int_
mov ecx, eax
mov ebx, eax
call fcn.0045e4d0
mov dword [esi], ebx
mov ecx, ebx
mov dword [esp + 0x20], edi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp method.sf::priv::ThreadLocalImpl.setValue_void_
Function at 0x45e4d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
mov ebx, ecx
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebx], eax
add esp, 8
pop ebx
ret
Function at 0x46ebe0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
test ebx, ebx
jne 0x46ebff
cmp dword [eax + 4], edx
jb 0x46ec40
cmp dword [eax + 8], edx
mov esi, dword [eax + 0xc]
je 0x46ec1b
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], esi
call sym._fseek
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 1
add esp, 0x10
pop ebx
pop esi
pop edi
jmp sym._fread
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret

Function at 0x470410
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [eax]
mov eax, 6
cmp dword [esi + 0x10], edx
mov ecx, dword [esi + 0x8c]
movzx ebp, word [ecx + 0x44086]
ja 0x470444
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test edx, edx
lea eax, [edx - 1]
jne 0x470451
mov eax, dword [esi + 0xa4]
lea edx, [eax + eax*8]
mov eax, dword [ecx + 0x38]
lea eax, [eax + edx*4]
movzx edi, word [eax + 0xa]
movzx ecx, word [eax + 0x14]
mov edx, dword [eax + 0x1c]
mov word [esp + 0x1a], di
movzx edi, word [eax + 0xc]
mov word [esp + 0x1e], cx
mov ecx, dword [eax + 0x18]
mov word [esp + 0x1c], di
movsx edi, word [eax + 0x10]
movzx eax, word [eax + 0xe]
mov dword [ebx + 0x54], edx
movzx edx, word [esp + 0x1c]
mov dword [ebx + 0x4c], eax
mov dword [ebx + 0x50], edx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sym._ft_glyphslot_set_bitmap
cmp bp, 2
je 0x470540
jbe 0x470530
cmp bp, 4
je 0x470550
cmp bp, 8
jne 0x4704ca
mov eax, 0x100
mov byte [ebx + 0x5e], 2
mov word [ebx + 0x5c], ax
movzx eax, word [esp + 0x1a]
movsx edx, word [esp + 0x1e]
add ebx, 0x18
mov dword [ebx + 0x4c], edi
shl edi, 6
mov dword [ebx + 0x30], 0x62697473
mov dword [ebx + 8], edi
shl eax, 6
mov dword [ebx + 0x50], edx
shl edx, 6
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x38]
mov dword [ebx + 0xc], edx
shl eax, 6
mov dword [ebx], eax
mov eax, dword [ebx + 0x34]
shl eax, 6
mov dword [ebx + 4], eax
mov eax, dword [esi + 0x8c]
movzx eax, word [eax + 6]
mov dword [esp], ebx
shl eax, 6
mov dword [esp + 4], eax
call sym._ft_synthesize_vertical_metrics
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bp, 1
jne 0x4704ca
mov byte [ebx + 0x5e], 1
jmp 0x4704ca
mov byte [ebx + 0x5e], 3
jmp 0x4704ca
mov byte [ebx + 0x5e], 4
jmp 0x4704ca
Function at 0x470660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 8
test eax, eax
je 0x470750
movsx edx, byte [eax]
xor eax, eax
test dl, dl
je 0x4706f1
cmp dl, 0x2d
mov dword [esp + 4], 0
mov dword [esp], 0
je 0x470720
cmp dl, 0x30
mov edi, 0x4f7240
mov ebp, 0xa
je 0x470700
mov eax, edx
shr al, 3
movzx eax, al
movzx ecx, byte [edi + eax]
mov eax, edx
and eax, 7
bt ecx, eax
mov ecx, 0
jae 0x4706e8
lea esi, [esi]
add ebx, 1
movzx eax, byte [edx + 0x4f7280]
movsx edx, byte [ebx]
imul ecx, ebp
add ecx, eax
mov eax, edx
shr al, 3
movzx eax, al
movzx esi, byte [edi + eax]
mov eax, edx
and eax, 7
bt esi, eax
jb 0x4706c0
xor ecx, dword [esp]
mov eax, dword [esp + 4]
add eax, ecx
add esp, 8
pop ebx
pop esi
pop edi
pop ebp
ret
movzx eax, byte [ebx + 1]
and eax, 0xffffffdf
cmp al, 0x58
jne 0x4706a1
movsx edx, byte [ebx + 2]
mov edi, 0x4f7220
add ebx, 2
mov bp, 0x10
jmp 0x4706a1
movsx edx, byte [ebx + 1]
add ebx, 1
mov dword [esp + 4], 1
mov dword [esp], 0xffffffff
mov edi, 0x4f7240
mov ebp, 0xa
cmp dl, 0x30
jne 0x4706a1
jmp 0x470700
add esp, 8
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4846d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
test ebx, ebx
je 0x484703
test edx, edx
je 0x484710
test esi, 1
je 0x484715
xor edx, edx
mov dword [esp + 0x10], esi
mov eax, ebx
pop ebx
pop esi
pop edi
jmp sym._cff_slot_load
mov eax, 0x25
pop ebx
pop esi
pop edi
ret
or esi, 3
jmp 0x4846f3
mov edi, dword [ebx + 4]
cmp dword [edx], edi
mov eax, 0x23
jne 0x484708
jmp 0x4846f5