joyce8/EMBER2024-capa huggingface dataset:
Function at 0x687c40
Capabilities:
Hide graphical window

Disassembly:
push esi
push ebp
mov esi, ecx
movzx ebp, byte [esp + 0xc]
push ebp
call fcn.00676ea0
movzx eax, al
test eax, eax
jne 0x687c5d
xor eax, eax
pop ebp
pop esi
ret 4
mov ecx, dword [esi + 0x114]
test ecx, ecx
je 0x687c7c
mov eax, 5
xor edx, edx
cmp ebp, 0
cmovne edx, eax
push edx
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
pop esi
ret 4

Function at 0x68c6d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68c800
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov esi, ecx
and byte [esi + 0x11c], 0xfe
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov edx, 4
movsx eax, ax
xor ebx, ebx
cmp eax, 0
cmovl ebx, edx
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
movsx eax, ax
mov edx, 8
xor ecx, ecx
cmp eax, 0
cmovl ecx, edx
or ebx, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
push 4
mov edx, ebx
or edx, 1
and eax, 0x8000
cmovne ebx, edx
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
push 2
shr eax, 0xb
or ebx, eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, ebx
or edx, 2
and eax, 0x8000
cmovne ebx, edx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x114]
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [0x859a28]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
sub dword [ebp - 0x24], eax
lea ecx, [ebp - 0x74]
sub dword [ebp - 0x20], edx
call fcn.0069c540
mov dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push ebx
mov ecx, esi
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push eax
call fcn.006912f0
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [esi + 0x5c]
mov edx, dword [ecx]
call dword [edx + 0x10]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x74], 0x88d7b4
lea ecx, [ebp - 0x74]
call fcn.0061de50
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x68cc80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68cd80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov ebx, ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0069c9f0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push 0x10
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x14], eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 8]
push 0x11
movsx eax, ax
shr eax, 0x1f
mov byte [edx + 0x31], al
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
movsx eax, ax
shr eax, 0x1f
mov byte [edi + 0x30], al
mov eax, ecx
shr eax, 0x10
and eax, 0x2000
shr eax, 0xd
mov byte [edi + 0x32], al
mov dword [edi + 8], ebx
mov dword [edi + 0x2c], esi
mov word [edi + 0x36], dx
mov dword [edi + 0x38], edx
mov dword [edi + 0x3c], ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x34]
push eax
push dword [ebx + 0x114]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x30]
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x6909b0
Capabilities:
Log keystrokes via application hook

Disassembly:
push esi
movzx eax, byte [esp + 8]
test eax, eax
je 0x6909e8
mov dword [0x859684], 0x690800
call fcn.006390e0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push esi
push dword [0x859684]
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x859680], eax
pop esi
ret
push dword [0x859680]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop esi
ret

Function at 0x690a00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push ebx
sub esp, 8
xor edx, edx
mov ebp, dword [esp + 0x14]
mov eax, ebp
call fcn.00690aa8
mov ebx, eax
cmp ebp, 0x16d
je 0x690a79
cmp ebp, 0x137
je 0x690a79
cmp ebp, 0x16c
je 0x690a79
movzx eax, bx
cmp eax, 1
jne 0x690a49
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, 2
cmp eax, 0
cmovne ebx, edx
jmp 0x690a61
cmp eax, 2
jne 0x690a61
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, 1
cmp eax, 0
cmovne ebx, edx
movzx eax, bx
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
shr eax, 0xf
add esp, 8
pop ebx
pop ebp
ret
movzx eax, bx
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
xor eax, eax
mov ecx, 1
cmp edx, 0
cmovne eax, ecx
add esp, 8
pop ebx
pop ebp
ret
Function at 0x690aa8
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push ebx
mov edi, edx
test edi, edi
je 0x690ab3
mov byte [edi], 1
xor edx, edx
cmp eax, dword [edx*8 + 0x7aeaa4]
je 0x690b4a
inc edx
cmp edx, 0x3c
jb 0x690ab5
lea edx, [eax - 0x138]
cmp edx, 0x49
ja case.0x690ada.318
mov edx, dword [edx*4 + 0x7ae960]
jmp edx
mov eax, 0x22
jmp 0x690b3b
mov eax, 0x21
jmp 0x690b3b
mov eax, 0x2d
jmp 0x690b3b
mov eax, 0x28
jmp 0x690b3b
mov eax, 0x27
jmp 0x690b3b
mov eax, 0x26
jmp 0x690b3b
mov eax, 0x25
jmp 0x690b3b
mov eax, 0x24
jmp 0x690b3b
mov eax, 0x23
jmp 0x690b3b
cmp eax, 0x7f
jne 0x690b27
mov eax, 0x2e
jmp 0x690b3b
movzx ebx, ax
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, al
cmp eax, 0xff
je 0x690b3e
pop ebx
pop edi
ret
test edi, edi
je 0x690b45
mov byte [edi], 0
mov eax, ebx
pop ebx
pop edi
ret
movzx eax, word [edx*8 + 0x7aeaa0]
pop ebx
pop edi
ret

Function at 0x6912f0
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x10
mov esi, ecx
mov edx, dword [esi]
lea eax, [esp]
push eax
call dword [edx + 0x60]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov eax, dword [esp]
neg eax
add eax, ebp
mov dword [ebx + 0x24], eax
mov edx, dword [esp + 4]
neg edx
add edx, dword [esp + 0x2c]
push 0x12
mov dword [ebx + 0x28], edx
mov eax, edi
and eax, 4
shr eax, 2
mov byte [ebx + 0x30], al
mov edx, edi
and edx, 8
shr edx, 3
mov byte [ebx + 0x2f], dl
mov ecx, edi
and ecx, 1
mov byte [ebx + 0x2c], cl
mov eax, edi
and eax, 0x10
shr eax, 4
mov byte [ebx + 0x2d], al
mov eax, edi
and eax, 2
shr eax, 1
mov byte [ebx + 0x2e], al
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
shr eax, 0x1f
mov byte [ebx + 0x31], al
call dword [sym.imp.USER32.dll_GetMessageTime]
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], ebp
mov ecx, esi
mov dword [esp + 0xc], edx
mov dword [ebx + 0x10], eax
mov dword [ebx + 8], esi
lea edi, [esp + 8]
lea ebp, [esp + 0xc]
push ebp
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x14], eax
push edi
mov eax, dword [esi]
call dword [eax + 0x1fc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx + 0xc]
mov dword [0x859644], eax
mov dword [0x859648], edx
mov dword [0x85964c], ecx
add esp, 0x10
pop ebx
pop ebp
pop esi
pop edi
ret 0x10
Function at 0x6e9d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7812b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 4], 1
mov dword [ecx], 0x8bfda4
add ecx, 8
mov dword [ebp - 0x14], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0x88d964
call fcn.00672d50
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x40], 0xffffffff
xor ecx, ecx
mov dword [eax + 0x24], ecx
mov ebx, 0x88d864
mov dword [eax + 0x20], ebx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x28], ebx
mov edx, dword [0x83b878]
mov dword [eax + 0x3c], edx
mov dword [eax + 0x44], ecx
lea ebx, [eax + 8]
mov esi, 0x85a020
cmp ebx, esi
je 0x6e9e2e
push 0x85a020
mov ecx, ebx
call fcn.0061e0a0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [0x85a028]
mov dword [ebx + 8], edx
movzx ecx, byte [0x85a02c]
mov byte [ebx + 0xc], cl
mov edi, pe_nt_image_headers32
xor esi, esi
movzx edx, byte [0x85a02d]
mov byte [ebx + 0xd], dl
movzx ecx, byte [0x85a02e]
mov byte [ebx + 0xe], cl
movzx edx, byte [0x85a02f]
mov byte [ebx + 0xf], dl
movzx ecx, byte [0x85a030]
mov byte [ebx + 0x10], cl
mov ebx, dword [ebp - 0x18]
mov word [eax + 0x1c], di
mov edi, dword [ebp - 0x20]
mov byte [eax + 0x1e], 1
mov dword [eax + 0x30], esi
mov dword [eax + 0x34], esi
mov esi, dword [ebp - 0x1c]
mov dword [eax + 0x38], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x6e9f50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ea050
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 4], 2
mov dword [ecx], 0x8c6370
mov eax, dword [0x83b878]
lea edi, [ecx + 0x20]
mov dword [edi], eax
mov dword [ecx + 0x10], 3
xor ebx, ebx
mov dword [ecx + 0x34], ebx
mov edx, dword [0x83b878]
mov dword [ecx + 0x38], ebx
mov dword [ecx + 0x3c], edx
push dword [0x83b878]
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov esi, 1
mov dword [ecx + 0x18], esi
mov word [ecx + 0x1c], bx
mov dword [ecx + 0x14], esi
mov ecx, edi
call fcn.00620740
mov ebx, dword [ebp - 0x20]
mov eax, dword [0x85a05c]
mov edx, dword [0x85a060]
xor ecx, ecx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x30], ecx
mov byte [ebx + 0x24], 1
mov dword [ebx + 0x34], eax
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x40], ecx
mov dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x44], ecx
call fcn.0070a500
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x3c]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0x48], eax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x6ea470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7812d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ecx
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx], 0x8c6398
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
mov dword [ecx + 0x28], eax
mov dword [ecx + 0x2c], eax
add ecx, 0x38
call fcn.006e9f50
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
call fcn.006ea540
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x30], 0x1010100
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov edx, 1
mov word [eax + 0x34], dx
mov byte [eax + 0x36], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x742d7e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x742dbb
cmp dword [ebp + 0x14], edi
je 0x742dbb
cmp ecx, edi
jne 0x742dc2
call fcn.00745b12
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.007516d7
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x742dd6
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x742df7
cmp ebx, 0xffffffff
je 0x742de6
push ebx
push edi
push ecx
call fcn.007467f0
add esp, 0xc
cmp esi, edi
je 0x742da3
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x742da3
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x742e13
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x742e1a
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x742f0b
test word [esi + 0xc], 0x10c
je 0x742e6e
mov eax, dword [esi + 4]
test eax, eax
je 0x742e6e
jl 0x742f6c
cmp ebx, eax
mov edi, ebx
jb 0x742e3f
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x742f13
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00751b76
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x742f03
cmp ebx, dword [ebp - 0xc]
jb 0x742edb
cmp dword [ebp - 0xc], 0
je 0x742e98
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x742e8d
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x742e94
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x742ea3
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x742ea3
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x742f3f
push eax
push dword [ebp - 8]
push esi
call fcn.0074e23a
pop ecx
push eax
call fcn.0074f1e7
add esp, 0xc
test eax, eax
je 0x742f7e
cmp eax, 0xffffffff
je 0x742f6c
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x742f03
push esi
call fcn.00751a56
cmp eax, 0xffffffff
pop ecx
je 0x742f70
cmp dword [ebp - 4], 0
je 0x742f3f
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x742e22
mov eax, dword [ebp + 0x14]
jmp 0x742dbd
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x742f2a
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.007467f0
add esp, 0xc
call fcn.00745b12
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x742db3
cmp dword [ebp + 0xc], 0xffffffff
je 0x742f55
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.007467f0
add esp, 0xc
call fcn.00745b12
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x742db3
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x742dbd
or dword [esi + 0xc], 0x10
jmp 0x742f70
Function at 0x7470f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x84cd00]
jne 0x7470fa
repz ret
jmp fcn.007578a6

Function at 0x75123c
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x84d1a0]
je 0x751257
inc edi
cmp edi, 0x17
jb 0x751248
cmp edi, 0x17
jae 0x7513d7
push ebp
push 3
call fcn.00758387
cmp eax, 1
pop ecx
je 0x7513a3
push 3
call fcn.00758387
test eax, eax
pop ecx
jne 0x75128b
cmp dword [0x84cb8c], 1
je 0x7513a3
cmp ebx, 0xfc
je 0x7513d6
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x87e170
push ebp
call fcn.0074b7dd
add esp, 0xc
test eax, eax
je 0x7512c1
push esi
push esi
push esi
push esi
push esi
call fcn.007515db
add esp, 0x14
push 0x104
mov esi, 0x87e189
push esi
push 0
mov byte [0x87e28d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x751305
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0074b7dd
add esp, 0xc
test eax, eax
je 0x751305
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.007515db
add esp, 0x14
push esi
call fcn.00746fb0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x75134a
push esi
call fcn.00746fb0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x87e484
push 0x79f4f4
sub ecx, eax
push ecx
push eax
call fcn.0074a074
add esp, 0x14
test eax, eax
je 0x75134a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.007515db
add esp, 0x14
jmp 0x75134c
xor esi, esi
push 0x7d4310
push ebx
push ebp
call fcn.0074b842
add esp, 0xc
test eax, eax
je 0x75136c
push esi
push esi
push esi
push esi
push esi
call fcn.007515db
add esp, 0x14
push dword [edi*8 + 0x84d1a4]
push ebx
push ebp
call fcn.0074b842
add esp, 0xc
test eax, eax
je 0x75138e
push esi
push esi
push esi
push esi
push esi
call fcn.007515db
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00761904
add esp, 0xc
jmp 0x7513d6
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x7513d6
cmp ebp, 0xffffffff
je 0x7513d6
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x84d1a4]
push dword [esi]
call fcn.00746fb0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x757eea
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00750c75
xor ebx, ebx
cmp dword [0x87eb50], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x757fc0
push 0x7d4d5c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x7580a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7d4d50
push edi
call esi
cmp eax, ebx
je 0x7580a0
push eax
call fcn.00750c07
mov dword [esp], 0x7d4d40
push edi
mov dword [0x87eb50], eax
call esi
push eax
call fcn.00750c07
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x87eb54], eax
call esi
push eax
call fcn.00750c07
mov dword [0x87eb58], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00744cf5
test eax, eax
pop ecx
pop ecx
je 0x757f8e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.007515db
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x757fc0
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.00750c07
cmp eax, ebx
pop ecx
mov dword [0x87eb60], eax
je 0x757fc0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00750c07
pop ecx
mov dword [0x87eb5c], eax
mov eax, dword [0x87eb5c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x758045
cmp dword [0x87eb60], ecx
je 0x758045
push eax
call fcn.00750c7e
push dword [0x87eb60]
mov esi, eax
call fcn.00750c7e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x758045
cmp edi, ebx
je 0x758045
call esi
cmp eax, ebx
je 0x758012
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x758012
test byte [ebp - 0x18], 1
jne 0x758045
lea eax, [ebp - 0x10]
push eax
call fcn.00744d2c
test eax, eax
pop ecx
je 0x75802d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.007515db
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x75803c
or dword [ebp + 0x10], 0x200000
jmp 0x758080
or dword [ebp + 0x10], 0x40000
jmp 0x758080
mov eax, dword [0x87eb54]
cmp eax, dword [ebp - 8]
je 0x758080
push eax
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x758080
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x758080
mov eax, dword [0x87eb58]
cmp eax, dword [ebp - 8]
je 0x758080
push eax
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x758080
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x87eb50]
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x7580a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x7580a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x761904
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00750c75
xor ebx, ebx
cmp dword [0x87ecd8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x7619da
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x761aba
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x7d5fa8
push edi
call esi
cmp eax, ebx
je 0x761aba
push eax
call fcn.00750c07
mov dword [esp], 0x7d4d40
push edi
mov dword [0x87ecd8], eax
call esi
push eax
call fcn.00750c07
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x87ecdc], eax
call esi
push eax
call fcn.00750c07
mov dword [0x87ece0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00744cf5
test eax, eax
pop ecx
pop ecx
je 0x7619a8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.007515db
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x7619da
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00750c07
cmp eax, ebx
pop ecx
mov dword [0x87ece8], eax
je 0x7619da
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00750c07
pop ecx
mov dword [0x87ece4], eax
mov eax, dword [0x87ece4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x761a5f
cmp dword [0x87ece8], ecx
je 0x761a5f
push eax
call fcn.00750c7e
push dword [0x87ece8]
mov esi, eax
call fcn.00750c7e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x761a5f
cmp edi, ebx
je 0x761a5f
call esi
cmp eax, ebx
je 0x761a2c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x761a2c
test byte [ebp - 0x18], 1
jne 0x761a5f
lea eax, [ebp - 0x10]
push eax
call fcn.00744d2c
test eax, eax
pop ecx
je 0x761a47
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.007515db
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x761a56
or dword [ebp + 0x10], 0x200000
jmp 0x761a9a
or dword [ebp + 0x10], 0x40000
jmp 0x761a9a
mov eax, dword [0x87ecdc]
cmp eax, dword [ebp - 8]
je 0x761a9a
push eax
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x761a9a
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x761a9a
mov eax, dword [0x87ece0]
cmp eax, dword [ebp - 8]
je 0x761a9a
push eax
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x761a9a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x87ecd8]
call fcn.00750c7e
cmp eax, ebx
pop ecx
je 0x761aba
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x761abc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret