joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402a7050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [rsp + 0xb0]
cmp dword [rax + 0x148], 0
je 0x1402a70b5
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xb8]
jmp 0x1402a7284
mov rcx, qword [rsp + 0xb0]
add rcx, 0x18
call qword [sym.imp.mfc90u.dll_CStatusBar::GetThisMessageMap]
movzx eax, al
test eax, eax
je 0x1402a70fb
lea rcx, [rsp + 0x28]
call fcn.140213630
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0x18
mov edx, 0x4279
call qword [sym.imp.mfc90u.dll_CPreviewDC::GrayStringW]
nop
lea rcx, [rsp + 0x28]
call fcn.140213690
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x140], 0
je 0x1402a7165
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x140]
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x140]
mov rax, qword [rax]
call qword [rax + reloc.mfc90u.dll_CHtmlEditCtrl::CHtmlEditCtrl]
test eax, eax
jne 0x1402a7165
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xb8]
jmp 0x1402a7284
call fcn.1400012b8
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
call qword [rax + COleDataSource::FlushClipboard]
mov dword [rsp + 0x20], eax
cmp dword [0x1404f7e3c], 0
je 0x1402a71ae
cmp dword [0x1404fa8c0], 0
jne 0x1402a71ae
mov dword [rsp + 0x98], 2
jmp 0x1402a71b9
mov dword [rsp + 0x98], 1
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0xd0], 0
je 0x1402a7225
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax + 4]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x50]
call fcn.1402070f0
mov ecx, dword [rax]
imul ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
lea eax, [rcx + rax*2]
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x7c]
mov dword [rsp + 0x4c], eax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xb8]
jmp 0x1402a7284
lea rcx, [rsp + 0x60]
call fcn.1402070f0
mov ecx, dword [rax + 4]
imul ecx, dword [rsp + 0x24]
mov eax, dword [rsp + 0x20]
lea eax, [rcx + rax*2]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0xc8]
mov eax, dword [rax]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x84]
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0xb8]
mov qword [rax], rcx
mov rax, qword [rsp + 0xb8]
add rsp, 0xa8
ret
Function at 0x1402adfd0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x58
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
call qword [sym.imp.mfc90u.dll_CStatusBar::GetThisMessageMap]
movzx eax, al
test eax, eax
je 0x1402adff8
xor eax, eax
jmp 0x1402ae085
call fcn.140001294
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x1402ae015
mov qword [rsp + 0x40], 0
jmp 0x1402ae023
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x18
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rdi, rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x10
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rbx, rax
mov rcx, qword [rsp + 0x70]
add rcx, 0x28
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8, rax
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jae 0x1402ae080
xor eax, eax
jmp 0x1402ae085
mov eax, 1
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x1402aead0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
cmp dword [0x1404ef5e0], 0
jne 0x1402aeaef
jmp 0x1402aec00
cmp dword [0x1404f1ddc], 0xfffffffe
jne 0x1402aebe2
cmp dword [rsp + 0x40], 0xffffffff
jne 0x1402aeb08
jmp 0x1402aec00
mov eax, dword [0x1404fa930]
and eax, 1
test eax, eax
jne 0x1402aeb6b
mov eax, dword [0x1404fa930]
or eax, 1
mov dword [0x1404fa930], eax
xor edx, edx
lea rcx, [0x1404fa8f8]
call sub.mfc90u.dll_CSingleDocTemplate::CSingleDocTemplate
nop
lea rax, vtable.CCriticalSection.0
mov qword [0x1404fa8f8], rax
lea rcx, [0x1404fa8f8]
call fcn.140128120
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402aeb5e
call sub.mfc90u.dll_AfxParseURL
nop
lea rcx, [0x140405500]
call fcn.1403c22c0
nop
lea rcx, [0x1404fa8f8]
call fcn.140125a40
xor r8d, r8d
xor edx, edx
lea rcx, [0x1402aea30]
call qword [sym.imp.MSVCR90.dll__beginthread]
mov qword [0x1404fa8f0], rax
cmp qword [0x1404fa8f0], 0
jbe 0x1402aebc4
cmp qword [0x1404fa8f0], 0xffffffffffffffff
je 0x1402aebc4
mov edx, 0xffffffff
mov rcx, qword [0x1404fa8f0]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov r11d, dword [rsp + 0x40]
mov dword [0x1404f1ddc], r11d
jmp 0x1402aebcf
mov qword [0x1404fa8f0], 0
lea rcx, [0x1404fa8f8]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1402aec00
mov eax, dword [rsp + 0x40]
mov dword [0x1404f1ddc], eax
cmp dword [0x1404f1ddc], 0xffffffff
jne 0x1402aec00
mov qword [0x1404fa8f0], 0
add rsp, 0x38
ret
Function at 0x140304680
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rcx, qword [rsp + 0xa0]
call qword [0x140409500]
nop
xor edx, edx
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__wsetlocale]
mov rdx, rax
lea rcx, [rsp + 0x38]
call qword [0x1404094a8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.mfc90u.dll_CToolBarCtrl::CToolBarCtrl]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc90u.dll_CView::CView]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1001
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
add eax, 1
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call sub.mfc90u.dll_new__
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
movsxd rdx, dword [rsp + 0x28]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax + rdx*2], cx
mov r9d, dword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov edx, 0x1001
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x28], eax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x48]
call qword [0x1404094a8]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
lea r8, [0x140415270]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x20]
call fcn.140015bcc
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_delete__
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1002
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
add eax, 1
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, rax
mov rax, 0xffffffffffffffff
cmovo rcx, rax
call sub.mfc90u.dll_new__
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
movsxd rdx, dword [rsp + 0x28]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov word [rax + rdx*2], cx
mov r9d, dword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov edx, 0x1002
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov dword [rsp + 0x28], eax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_COleCurrency::operator_]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call sub.mfc90u.dll_delete__
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__wsetlocale]
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
mov rax, qword [rsp + 0xa0]
add rsp, 0x98
ret
Function at 0x14030cc60
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x1418], 0
jne 0x14030cc9f
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x1420], 0
jne 0x14030cc9f
mov rax, qword [rsp + 0x60]
cmp qword [rax + reloc.mfc90u.dll_CToolBar::OnNcPaint], 0
je 0x14030cce6
cmp dword [rsp + 0x68], 0x1b
jne 0x14030cce6
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0x30], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14030cde2
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x10d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14030cde0
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14030cd24
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
add rax, 0x10
mov qword [rsp + 0x48], rax
call fcn.140307840
mov rdx, qword [rsp + 0x48]
mov rdx, qword [rdx]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14030cddb
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x70]
cmp dword [rcx + 0xa8], eax
jne 0x14030cddb
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x68]
cmp dword [rcx + 0x98], eax
je 0x14030cd94
mov rcx, qword [rsp + 0x28]
mov eax, dword [rsp + 0x68]
cmp dword [rcx + 0x9c], eax
jne 0x14030cddb
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xac], 0
je 0x14030cdbc
mov ecx, send
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x14030cdbc
jmp 0x14030cd01
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call qword [rax + CDHtmlDialog::DDX_DHtml_CheckBox]
mov eax, 1
jmp 0x14030cde2
jmp 0x14030cd01
xor eax, eax
add rsp, 0x58
ret
Function at 0x140312e40
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x60], 0xfffffffffffffffe
cmp dword [rsp + 0x88], 0x79
jne 0x140312e75
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
jne 0x140312e7f
cmp dword [rsp + 0x88], 0x5d
jne 0x140312eb3
mov dword [rsp + 0x40], 0xffffffff
mov dword [rsp + 0x44], 0xffffffff
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
call fcn.140313010
mov eax, 1
jmp 0x140313004
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x1400], 0
je 0x140312eee
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x1400]
call fcn.1402925b0
test eax, eax
je 0x140312eee
mov eax, 1
jmp 0x140313004
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x13e0], 0
je 0x140312f64
lea rcx, [rsp + 0x20]
call fcn.140292950
nop
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x13e0]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x13e0]
mov rax, qword [rax]
mov edx, dword [rsp + 0x88]
call qword [rax + 0x80]
mov dword [rsp + 0x48], eax
lea rax, vtable.CBCGPDisableMenuAnimation.0
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x54]
mov dword [0x1404f8e2c], eax
mov eax, dword [rsp + 0x48]
jmp 0x140313004
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x13e8], 0
je 0x140313002
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x13e8]
call fcn.14023f910
test rax, rax
je 0x140312fa1
cmp dword [rsp + 0x88], 9
jne 0x140312fa1
xor eax, eax
jmp 0x140313004
lea rcx, [rsp + 0x30]
call fcn.140292950
nop
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x13e8]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x13e8]
mov rax, qword [rax]
mov edx, dword [rsp + 0x88]
call qword [rax + 0xa0]
mov dword [rsp + 0x4c], eax
lea rax, vtable.CBCGPDisableMenuAnimation.0
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov dword [0x1404f8e2c], eax
mov eax, dword [rsp + 0x4c]
jmp 0x140313004
xor eax, eax
add rsp, 0x78
ret
Function at 0x140317750
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0x100
jne 0x140317967
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 9
je 0x140317797
cmp qword [rsp + 0x28], 0x1b
je 0x140317823
jmp 0x14031784e
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
test rax, rax
je 0x140317821
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jne 0x1403177e2
mov qword [rsp + 0x30], 0
jmp 0x1403177f0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov rcx, rax
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
mov eax, 1
jmp 0x140317976
jmp 0x14031784e
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_CDialog::GetThisClass
test rax, rax
je 0x14031784e
mov rcx, qword [rsp + 0x50]
call sub.mfc90u.dll_CDialog::GetThisClass
mov rcx, rax
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
mov eax, 1
jmp 0x140317976
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
cmp rax, qword [rsp + 0x50]
jne 0x140317967
mov ecx, send
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140317967
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x2e
je 0x140317946
cmp qword [rsp + 0x38], 0x43
je 0x1403178e3
cmp qword [rsp + 0x38], 0x56
je 0x1403178bf
cmp qword [rsp + 0x38], 0x58
je 0x140317904
cmp qword [rsp + 0x38], 0x5a
je 0x140317925
jmp 0x140317967
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.mfc90u.dll_CSharedFile::CSharedFile
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x140317976
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.mfc90u.dll_CSemaphore::CSemaphore
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x140317976
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.mfc90u.dll_CScrollView::CScrollView
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x140317976
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc7
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x140317976
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.mfc90u.dll_CSingleDocTemplate::CSingleDocTemplate
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x140317976
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.1402ccc00
add rsp, 0x48
ret
Function at 0x14033baf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
sub eax, 9
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x64
ja case.0x14033bb4d.10
mov eax, dword [rsp + 0x24]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x33bc98]
mov eax, dword [rcx + rax*4 + 0x33bc7c]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x778]
mov eax, 1
jmp 0x14033bc76
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x770]
mov eax, 1
jmp 0x14033bc76
cmp dword [rsp + 0x20], 0
je 0x14033bbad
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x778]
mov dword [rsp + 0x28], 0
jmp 0x14033bbc8
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x770]
mov dword [rsp + 0x28], 0
mov eax, 1
jmp 0x14033bc76
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
call qword [rax + 0x780]
jmp 0x14033bc76
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x580], 0
je 0x14033bc2e
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x580]
cmp dword [rax + 0x78], 0
jne 0x14033bc2e
mov r8d, 1
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x580]
mov rcx, qword [rsp + 0x40]
call fcn.14033c520
mov eax, 1
jmp 0x14033bc76
jmp case.0x14033bb4d.10
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x580], 0
je case.0x14033bb4d.10
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x580]
cmp dword [rax + 0x78], 0
je case.0x14033bb4d.10
mov r8d, 1
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx + 0x580]
mov rcx, qword [rsp + 0x40]
call fcn.14033c520
mov eax, 1
jmp 0x14033bc76
xor eax, eax
add rsp, 0x38
ret

Function at 0x14033cf80
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x23
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0x20]
cmp r11d, 0x31
jne 0x14033cfb5
mov dword [rsp + 0x24], 1
jmp 0x14033cfbd
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x14033cfd0
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call qword [0x140409500]
nop
cmp dword [rsp + 0x58], 0
je 0x14033d00b
mov dword [rsp + 0x38], 0x28
jmp 0x14033d013
mov dword [rsp + 0x38], 0x29
mov edx, 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CStdioFile::Flush]
mov r9d, 0xa
mov r8, rax
mov edx, dword [rsp + 0x38]
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CDataPathProperty::Open]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x14033d080
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call qword [0x140409500]
nop
mov edx, 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CStdioFile::Flush]
mov r9d, 0xa
mov r8, rax
mov edx, 0x1e
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CDataPathProperty::Open]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x14033d110
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x21
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0x20]
cmp r11d, 0x31
jne 0x14033d145
mov dword [rsp + 0x24], 1
jmp 0x14033d14d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret
Function at 0x14033d160
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x20]
call qword [0x140409500]
nop
mov edx, 0xa
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CStdioFile::Flush]
mov r9d, 0xa
mov r8, rax
mov edx, 0x1d
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CDataPathProperty::Open]
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov eax, dword [rsp + 0x28]
or eax, 1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x140347660
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0xa
mov r9d, 0xa
lea r8, [rsp + 0x30]
mov edx, 0x23
mov ecx, reloc.mfc90u.dll_CDHtmlControlSink::AddRef
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r11d, r11d
mov word [rsp + 0x32], r11w
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCR90.dll__wtoi]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403c2380
add rsp, 0x58
ret