joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ffc
Capabilities:
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_SetPriorityClass
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40622c
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x40607f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x40622c
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x40607f
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406248
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x406108
xor eax, eax
push ebp
push 0x406101
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405e44
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x4060e6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406268
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x4060e6
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406108
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_TerminateProcess
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SizeofResource
push eax
call sub.KERNEL32.DLL_SetNamedPipeHandleState
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x406222
cmp byte [ebp - 0xd], 0
jne 0x40614f
cmp byte [ebp - 0x12], 0
je 0x406222
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_UnmapViewOfFile
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406168
dec ebx
cmp byte [ebx], 0x2e
je 0x406177
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406167
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x406222
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4061b4
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov esi, eax
test esi, esi
jne 0x406222
cmp byte [ebp - 0xd], 0
je 0x406222
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov esi, eax
test esi, esi
jne 0x406222
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SuspendThread
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409674
Capabilities:
Get keyboard layout

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
jmp 0x409694
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EnumClipboardFormats
test eax, eax
jne 0x409694
call sub.user32.dll_GetKeyboardLayout
jmp 0x4096d3
mov eax, dword [ebx + 0x18]
and eax, dword [ebx + 0x10]
jne 0x40967c
push esp
lea eax, [ebx + 0x2c]
push eax
call sub.user32.dll_EnableMenuItem
push ebx
lea eax, [ebx + 2]
push eax
lea eax, [esp + 8]
push eax
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebx + 0x38]
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x18]
mov dword [ebx + 8], eax
lea eax, [ebx + 0xc]
lea edx, [ebx + 0x44]
mov ecx, 0x104
call fcn.00404c0c
xor eax, eax
pop ecx
pop edx
pop ebx
ret

Function at 0x409728
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x14]
push eax
call sub.user32.dll_EnumClipboardFormats
test eax, eax
je 0x409745
mov eax, ebx
call fcn.00409674
pop ebx
ret
call sub.user32.dll_GetKeyboardLayout
pop ebx
ret

Function at 0x4098d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push esp
lea eax, [esp + 8]
push eax
push 0x104
mov eax, ebx
call fcn.00404e5c
push eax
call sub.user32.dll_GetKeyState
mov ecx, eax
lea edx, [esp + 4]
mov eax, esi
call fcn.00404a8c
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x40ae44
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xffffffe0
lea eax, [esp + 8]
push eax
call sub.user32.dll_GetKeyboardLayoutList
mov cx, word [esp + 0xe]
mov dx, word [esp + 0xa]
mov ax, word [esp + 8]
call fcn.0040ac38
fstp qword [esp + 0x18]
wait
mov ax, word [esp + 0x16]
push eax
mov cx, word [esp + 0x18]
mov dx, word [esp + 0x16]
mov ax, word [esp + 0x14]
call fcn.0040aa98
fadd qword [esp + 0x18]
fstp qword [esp]
wait
fld qword [esp]
add esp, 0x20
ret

Function at 0x40ae94
Capabilities:
Get keyboard layout

Disassembly:
add esp, 0xfffffff0
push esp
call sub.user32.dll_GetKeyboardLayoutList
mov ax, word [esp]
add esp, 0x10
ret

Function at 0x40c38c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_EnumWindows
jmp 0x40c3b3
dec eax
test eax, eax
jle 0x40c3c5
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x40c3b2
sub dl, 0xd
je 0x40c3b2
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.00404a8c
add esp, 0x100
pop ebx
ret

Function at 0x40c3d8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.user32.dll_GetKeyboardState
test eax, eax
jle 0x40c411
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404a8c
jmp 0x40c41a
mov eax, ebx
mov edx, esi
call fcn.004049f0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c424
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.user32.dll_GetKeyboardState
test eax, eax
jle 0x40c445
mov al, byte [esp]
jmp 0x40c447
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40d408
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d4de
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a34
lea eax, [ebp - 8]
call fcn.00404eac
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e5c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d4c8
mov eax, ebx
call fcn.00402764
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d4c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e5c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d4ab
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d4f0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d4ab
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d4c8
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d4e5
lea eax, [ebp - 8]
call fcn.0040499c
ret

Function at 0x40da9c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40db00
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404c0c
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_GetActiveWindow
mov edx, eax
pop eax
call fcn.00409168
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40db07
lea eax, [ebp - 0xc]
call fcn.0040499c
ret
Function at 0x40e2c0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x40e350
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayout
mov ebx, eax
test ebx, ebx
je 0x40e31c
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0040c38c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x10]
push eax
push 1
mov ecx, dword [0x4a9de4]
mov dl, 1
mov eax, dword [0x408938]
call fcn.0040ccb0
mov edx, eax
jmp 0x40e330
mov ecx, dword [0x4a9f3c]
mov dl, 1
mov eax, dword [0x408938]
call fcn.0040cc74
mov edx, eax
mov dword [edx + 0xc], ebx
mov eax, edx
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e357
lea eax, [ebp - 0x14]
call fcn.0040499c
ret

Function at 0x4181f0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x418213
add esp, 0xfffffff0
call fcn.00403ed0
mov esi, ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x418319
push dword fs:[eax]
mov dword fs:[eax], esp
cmp di, 0xffff
jne 0x41829b
mov edx, dword [ebp + 8]
mov eax, esi
call fcn.00409414
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.004180e8
cmp dword [ebx + 4], 0
jge 0x4182fe
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.004098d8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x1c]
call fcn.0040c38c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4a9ff4]
mov dl, 1
mov eax, dword [0x412cfc]
call fcn.0040ccb0
call fcn.00404338
jmp 0x4182fe
movzx edx, di
mov eax, esi
call fcn.00409398
mov ecx, eax
xor edx, edx
mov eax, ebx
call fcn.004180e8
cmp dword [ebx + 4], 0
jge 0x4182fe
lea edx, [ebp - 0x20]
mov eax, esi
call fcn.004098d8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x24]
call fcn.0040c38c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [0x4a98e4]
mov dl, 1
mov eax, dword [0x412d58]
call fcn.0040ccb0
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418320
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004049c0
ret
Function at 0x41bb90
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x41bba9
add esp, 0xfffffff0
call fcn.00403ed0
mov ebx, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x41bc3a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00403b7c
call fcn.0041b930
mov byte [esi + 0xe], bl
mov byte [esi + 0xc], bl
push esi
push 4
lea eax, [esi + 8]
push eax
mov ecx, 0x41bae8
xor edx, edx
xor eax, eax
call fcn.00404950
mov ebx, eax
mov dword [esi + 4], ebx
test ebx, ebx
jne 0x41bc24
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x10]
call fcn.0040c38c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4a9f14]
mov dl, 1
mov eax, dword [0x413e34]
call fcn.0040ccb0
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bc41
lea eax, [ebp - 0x10]
call fcn.0040499c
ret

Function at 0x41ed9c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41eda2
ret

Function at 0x420ce0
Capabilities:
Enumerate gui resources
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x420d7c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetKeyboardLayout
mov ebx, eax
test ebx, ebx
je 0x420d5e
push 0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x400
push ebx
push 0
push 0x1000
call sub.user32.dll_EnumWindows
test eax, eax
je 0x420d5e
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.00404c0c
mov ecx, dword [ebp - 0x104]
mov dl, 1
mov eax, dword [0x4130dc]
call fcn.0040cbb8
call fcn.00404338
jmp 0x420d63
call fcn.00420c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420d83
lea eax, [ebp - 0x104]
call fcn.0040499c
ret
Function at 0x42917c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
mov esi, eax
push edx
mov eax, dword [esi + 4]
push eax
call sub.user32.dll_RemoveMenu
sub eax, 0xffffffff
je 0x4291ae
dec eax
je 0x4291a6
sub eax, 0x80
je 0x4291a2
sub eax, 0x82
je 0x4291aa
jmp 0x4291ba
mov bl, 2
jmp 0x4291bc
xor ebx, ebx
jmp 0x4291bc
mov bl, 1
jmp 0x4291bc
mov bl, 3
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 8], eax
jmp 0x4291bc
mov bl, 3
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x42a6b8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42a869
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.0040504c
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x42a880
call fcn.00404ca8
mov eax, ebx
call fcn.0041c6a0
mov edi, eax
dec edi
test edi, edi
jl 0x42a770
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.0041c674
mov edx, dword [0x4309bc]
call fcn.00403d38
test al, al
je 0x42a76c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.0041c674
lea edx, [ebp - 0x14]
call fcn.00437d64
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.0040504c
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404d1c
inc esi
dec edi
jne 0x42a71e
mov al, byte [0x42a884]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x42a890
mov eax, dword [ebp - 0xc]
call fcn.0040e074
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404a34
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00437d64
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x42a880
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.00437d64
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x42a880
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x42a880
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x42a89c
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a870
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004049c0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004049c0
lea eax, [ebp - 0x14]
call fcn.0040499c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004049c0
ret
Function at 0x45923c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x459388
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
call fcn.0045890c
mov ebx, eax
test ebx, ebx
jbe 0x45935c
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call fcn.004588fc
call sub.user32.dll_GetKeyboardLayout
cmp eax, 0xea
jne 0x459352
mov eax, dword [ebp - 0x14]
mov ecx, 0x24
xor edx, edx
div ecx
mov esi, eax
inc esi
push esi
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x459214]
call fcn.00405d14
add esp, 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, esi
shl eax, 2
lea eax, [eax + eax*8]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call fcn.004588fc
test eax, eax
je 0x45934c
mov edi, dword [ebp - 0x18]
dec edi
test edi, edi
jl 0x45934c
inc edi
xor esi, esi
lea eax, [esi + esi*8]
mov edx, dword [ebp - 0x10]
cmp dword [edx + eax*4], 0
je 0x459348
lea eax, [ebp - 0x44]
lea edx, [esi + esi*8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + edx*4 + 4]
call fcn.00404b94
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec edi
jne 0x45931f
mov byte [ebp - 9], 1
jmp 0x459356
mov byte [ebp - 9], 0
push ebx
call fcn.004588dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45938f
lea eax, [ebp - 0x44]
call fcn.0040499c
lea eax, [ebp - 0x10]
mov edx, dword [0x459214]
call fcn.00405d20
lea eax, [ebp - 4]
call fcn.0040499c
ret
Function at 0x459768
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
mov eax, dword [ebp + 8]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x45993c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x459907
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebp - 5], 0
push 0xf003f
push 0
push 0x459950
call fcn.0045890c
mov ebx, eax
test ebx, ebx
jne 0x4597f8
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x18]
call fcn.0040c38c
mov ecx, dword [ebp - 0x18]
mov dl, 1
mov eax, dword [0x407fa4]
call fcn.0040cbb8
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459911
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
push 0
push 2
push 0x110
push 0xf01ff
push edi
push esi
push ebx
call fcn.004588ec
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x459858
call sub.user32.dll_GetKeyboardLayout
lea edx, [ebp - 0x1c]
call fcn.0040c38c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x407fa4]
call fcn.0040cbb8
call fcn.00404338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459911
mov byte [ebp - 5], 1
mov eax, dword [0x4a9f78]
cmp dword [eax], 0
je 0x4598f4
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.00404ebc
mov eax, 4
call fcn.00402764
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.00404c5c
inc eax
call fcn.00402764
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], ebx
xor eax, eax
push ebp
push 0x4598ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00409b5c
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a9f78]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4598f4
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00402784
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
mov eax, dword [ebp - 0xc]
push eax
call fcn.004588dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459911
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459943
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004049c0
lea eax, [ebp - 4]
call fcn.0040499c
lea eax, [ebp + 8]
call fcn.0040499c
ret
Function at 0x459bb4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404e4c
xor eax, eax
push ebp
push 0x459d1f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call fcn.0045890c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x459d01
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404e5c
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.00458914
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x459cf8
mov eax, dword [0x4a9ba8]
cmp dword [eax], 0
je 0x459cef
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a9ba8]
mov eax, dword [eax]
call eax
test eax, eax
jne 0x459cef
call sub.user32.dll_GetKeyboardLayout
cmp eax, 0x7a
jne 0x459cef
mov eax, dword [ebp - 0x14]
inc eax
call fcn.00402764
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x459ce8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x4a9ba8]
mov eax, dword [eax]
call eax
test eax, eax
je 0x459cd2
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
call fcn.00409cd8
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.004049f0
jmp 0x459cc2
mov edx, dword [ebx]
mov eax, 0x459d34
call fcn.00404fa0
mov edx, eax
mov eax, ebx
mov ecx, 2
call fcn.00404efc
mov edx, dword [ebx]
mov eax, 0x459d34
call fcn.00404fa0
test eax, eax
jg 0x459ca8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459cef
mov eax, dword [ebp - 0x10]
call fcn.00402784
ret
mov eax, dword [ebp - 0xc]
push eax
call fcn.004588dc
mov eax, dword [ebp - 8]
push eax
call fcn.004588dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459d26
lea eax, [ebp - 0x18]
call fcn.0040499c
lea eax, [ebp - 4]
call fcn.0040499c
ret