joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4713dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x100], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4715d6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xac]
cmp dword [ebp - 0xb0], 0
jne 0x47148f
test byte [ebp - 0xc5], 0x40
je 0x47148f
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x47144f
test byte [ebx + 0x1c], 2
je 0x47144f
mov eax, ebx
mov edx, dword [0x464d40]
call fcn.00405540
test al, al
je 0x47144f
mov eax, ebx
call fcn.004754f4
mov dword [ebp - 0xb0], eax
jmp 0x47148f
mov eax, dword [edi + 8]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0x11
lea eax, [ebp - 0xfc]
push eax
push 0
lea edx, [ebp - 0x100]
mov eax, dword [0x4a83b4]
call fcn.0040a2a4
mov ecx, dword [ebp - 0x100]
mov dl, 1
mov eax, dword [0x423d38]
call fcn.00415870
call fcn.00405de4
mov eax, dword [ebp - 0xa4]
mov dword [edi + 0x254], eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x80]
push eax
mov eax, dword [ebp - 0x98]
push eax
call fcn.0040bc5c
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4714c9
mov edx, 0x468dd0
cmp edx, dword [ebp - 0xf0]
je 0x471506
test al, al
je 0x4714dd
mov eax, dword [ebp - 0x98]
push eax
lea eax, [ebp - 0x80]
push eax
call sub.user32.dll_IsWindow
mov dword [ebp - 0xa4], 0x468dd0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0xa8]
push eax
call sub.user32.dll_GetKeyboardLayout
test ax, ax
jne 0x471506
call fcn.00417664
mov dword [0x4a7ab4], edi
lea edx, [ebp - 0xcc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xb0]
cmp dword [edi + 0x258], 0
jne 0x47152a
call fcn.00417664
push 0xfffffffffffffff0
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, 0x40000000
je 0x471560
push 0xfffffffffffffff4
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_DispatchMessageW
test eax, eax
jne 0x471560
mov eax, dword [edi + 0x258]
push eax
push 0xfffffffffffffff4
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [edi + 0x174]
call fcn.00412080
xor eax, eax
mov dword [edi + 0x174], eax
mov eax, edi
call fcn.004758ac
push 1
mov eax, dword [edi + 0x64]
call fcn.00447430
mov ecx, eax
mov edx, 0x30
mov eax, edi
call fcn.0046dd7c
cmp byte [edi + 0x5e], 0
je 0x4715a3
mov eax, edi
mov si, 0xffef
call fcn.004055b0
mov eax, dword [edi + 0xac]
mov eax, dword [eax + 8]
test eax, eax
je 0x4715bd
test byte [edi + 0x52], 0x20
je 0x4715bd
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4715dd
lea eax, [ebp - 0x100]
call fcn.00407284
ret
Function at 0x475044
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, eax
mov ebx, dword [edi + 0x258]
test ebx, ebx
je 0x475068
push ebx
call sub.user32.dll_FillRect
test eax, eax
jne 0x47506c
xor eax, eax
jmp 0x47506e
mov al, 1
mov byte [esp + 8], al
cmp byte [esp + 8], 0
je 0x475093
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [edi + 0x258]
push eax
call sub.user32.dll_GetMenuItemInfoW
mov eax, edi
call fcn.0047113c
mov esi, eax
dec esi
test esi, esi
jl 0x47510d
inc esi
xor ebp, ebp
mov edx, ebp
mov eax, edi
call fcn.00471100
mov ebx, eax
mov eax, ebx
mov edx, dword [0x464d40]
call fcn.00405540
test al, al
je 0x4750c9
cmp dword [ebx + 0x258], 0
jne 0x4750d8
mov eax, dword [esp]
add dword [ebx + 0x40], eax
mov eax, dword [esp + 4]
add dword [ebx + 0x44], eax
jmp 0x475109
cmp byte [esp + 8], 0
jne 0x475109
push 0x14
mov eax, ebx
mov edx, dword [eax + 0x4c]
push edx
mov edx, dword [eax + 0x48]
push edx
mov edx, dword [eax + 0x44]
add edx, dword [esp + 0x10]
push edx
mov edx, dword [eax + 0x40]
add edx, dword [esp + 0x10]
push edx
push 0
mov eax, dword [eax + 0x258]
push eax
call sub.user32.dll_GetWindowTextW
inc ebp
dec esi
jne 0x4750a4
xor edx, edx
mov eax, edi
call fcn.00470b98
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47b2cc
Capabilities:
Clear file content
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4a850c]
cmp byte [eax + 0xc], 0
je 0x47b439
push 0x8000
call sub.KERNEL32.DLL_MultiByteToWideChar
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b432
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ae240], 0
jne 0x47b320
push 0x47b440
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
push 0x47b450
push ebx
call fcn.0040b6d8
mov dword [0x4ae240], eax
cmp dword [0x4a7c5c], 0
jne 0x47b41b
push 0x47b470
call sub.KERNEL32.DLL_GetUserDefaultUILanguage
mov dword [0x4a7c5c], eax
cmp dword [0x4a7c5c], 0
je 0x47b41b
push 0x47b484
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae244], eax
push 0x47b4a0
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae248], eax
push 0x47b4c4
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae24c], eax
push 0x47b4f4
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae250], eax
push 0x47b524
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae254], eax
push 0x47b548
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae258], eax
push 0x47b578
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae25c], eax
push 0x47b5a8
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae260], eax
push 0x47b5dc
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae264], eax
push 0x47b5f0
mov eax, dword [0x4a7c5c]
push eax
call fcn.0040b6d8
mov dword [0x4ae268], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b439
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
ret
pop ebx
pop ecx
pop ebp
ret
Function at 0x47b7b4
Capabilities:
Clear file content
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47b93f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x47b958
call fcn.0041217c
mov edx, dword [ebp - 4]
mov eax, 0x4ae1f8
call fcn.00407294
mov eax, dword [0x4ae1f8]
call fcn.00407320
push eax
call sub.KERNEL32.DLL_FindFirstFileW
mov word [0x4ae1f4], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x4abc40]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.KERNEL32.DLL_InitializeCriticalSection
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x47b97c
call fcn.0041217c
mov edx, dword [ebp - 0x10]
mov eax, 0x4ae1fc
call fcn.00407294
mov eax, dword [0x4ae1fc]
call fcn.00407320
push eax
call sub.KERNEL32.DLL_FindFirstFileW
mov word [0x4ae1f6], ax
mov eax, dword [0x4ae1fc]
call fcn.00407320
push eax
call sub.user32.dll_GetKeyboardLayoutNameW
mov dword [0x4ae200], eax
mov dl, 1
mov eax, dword [0x424828]
call fcn.0042f814
mov dword [0x4ae238], eax
call fcn.0047b2cc
mov dl, 1
mov eax, dword [0x467bf0]
call fcn.0047b044
mov dword [0x4ae1e0], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48ade4]
call fcn.004966f4
mov edx, dword [0x4a84e8]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48be28]
call fcn.00497d24
mov edx, dword [0x4a8370]
mov dword [edx], eax
mov eax, dword [0x4a8370]
mov eax, dword [eax]
mov dl, 1
call fcn.0049a41c
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4629c4]
call fcn.0046b674
mov dword [0x4ae23c], eax
push 0x47b9a4
call sub.KERNEL32.DLL_SetEndOfFile
mov ebx, eax
mov ecx, 0x469284
mov edx, 0x469294
mov eax, dword [0x45e340]
call fcn.0042e894
test ebx, ebx
je 0x47b921
push 0x47b9b4
push ebx
call fcn.0040b6d8
mov dword [0x4a7aac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b946
lea eax, [ebp - 0x10]
call fcn.00407284
lea eax, [ebp - 4]
call fcn.00407284
ret
Function at 0x47c95c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x424114]
call fcn.004052fc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47ca5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40]
call fcn.0042f9b4
mov edi, eax
xor eax, eax
push ebp
push 0x47ca12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 8]
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
dec ebx
test ebx, ebx
jl 0x47c9ec
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
dec eax
cmp esi, eax
jne 0x47c9cc
xor edx, edx
mov eax, edi
call fcn.0042f0d0
mov dword [ebp - 4], eax
jmp 0x47c9e8
xor edx, edx
mov eax, edi
call fcn.0042f0d0
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0042ef68
xor edx, edx
mov eax, edi
call fcn.0042efc0
inc esi
dec ebx
jne 0x47c9b6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ca19
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 8
push eax
call sub.KERNEL32.DLL_GetLocaleInfoW
ret

Function at 0x48da88
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
test esi, esi
je 0x48dacf
push 0xffffffffffffffec
push esi
call sub.user32.dll_DispatchMessageW
test bl, bl
je 0x48daaa
test ah, 2
jne 0x48dacf
or eax, 0x200
jmp 0x48dab4
test ah, 2
je 0x48dacf
and eax, 0xfffffdff
push eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowPlacement
push 0x37
push 0
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_GetWindowTextW
pop esi
pop ebx
ret
Function at 0x4915e8
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
add esp, 0xfffffff4
mov edi, eax
cmp dl, byte [edi + 0x299]
je 0x49177f
mov byte [edi + 0x299], dl
cmp byte [edi + 0x274], 0
je 0x491619
movzx eax, byte [edi + 0x299]
sub al, 2
je 0x49161d
sub al, 3
je 0x49161d
xor edx, edx
jmp 0x49161f
mov dl, 1
mov eax, edi
call fcn.0048f060
mov eax, edi
call fcn.004758a0
test al, al
je 0x49177f
test byte [edi + 0x1c], 0x10
je 0x49164f
test byte [edi + 0x1c], 0x10
je 0x49177f
cmp dword [edi + 0x34], 0
je 0x49177f
push 0xfffffffffffffff0
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_DispatchMessageW
mov dword [esp], eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_DispatchMessageW
mov dword [esp + 4], eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004754f4
push eax
call fcn.0040bc64
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
lea edx, [esp + 4]
mov eax, edi
mov si, 0xffa9
call fcn.004055b0
lea ecx, [esp + 4]
mov edx, esp
mov eax, edi
mov si, 0xffaa
call fcn.004055b0
mov eax, dword [esp]
push eax
push 0xfffffffffffffff0
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffec
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [esp + 8]
push eax
push 0xffffffffffffffe6
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetWindow
mov eax, edi
call fcn.004758a0
test al, al
je 0x49175c
mov eax, dword [0x4a827c]
cmp byte [eax], 0
je 0x49173d
cmp byte [edi + 0x299], 3
je 0x491727
mov eax, edi
call fcn.00493754
push eax
push 1
push 0x80
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetMenuState
jmp 0x49173d
push 0
push 1
push 0x80
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetMenuState
push 0xffffffffffffffff
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_DestroyCursor
push 0
xor ecx, ecx
mov edx, 0x81
mov eax, edi
call fcn.0046dd7c
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowTextW
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0x90]
add esp, 0xc
pop edi
pop esi
ret
Function at 0x491a08
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp bl, byte [eax + 0x29e]
je 0x491b77
test bl, bl
jne 0x491a33
mov eax, dword [ebp - 4]
cmp byte [eax + 0x29e], 3
je 0x491a44
cmp bl, 3
jne 0x491aa2
mov eax, dword [ebp - 4]
cmp byte [eax + 0x29e], 0
jne 0x491aa2
mov eax, dword [ebp - 4]
mov byte [eax + 0x29e], bl
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x491b77
mov eax, dword [ebp - 4]
call fcn.004758a0
test al, al
je 0x491b77
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x29e], 3
sete al
and eax, 0x7f
mov eax, dword [eax*4 + 0x4a7d74]
push eax
mov eax, dword [ebp - 4]
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowTextW
jmp 0x491b77
cmp bl, 1
jne 0x491abd
mov eax, dword [ebp - 4]
cmp byte [eax + 0x29f], 0
jne 0x491abd
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00491f00
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
setne al
xor al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x491adc
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004772b0
xor edx, edx
push ebp
push 0x491b70
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 5], 0
je 0x491afb
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc0]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x29e]
mov edx, dword [ebp - 4]
mov byte [edx + 0x29e], bl
cmp bl, 2
je 0x491b17
cmp al, 2
jne 0x491b35
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1e9], 0
jne 0x491b35
mov eax, dword [ebp - 4]
call fcn.00492034
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0046cbcc
cmp byte [ebp - 5], 0
je 0x491b43
mov eax, dword [ebp - 4]
call fcn.00471d0c
cmp bl, 1
jne 0x491b52
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004906bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491b77
cmp byte [ebp - 5], 0
je 0x491b6f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004772b0
ret
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x491c44
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x491e58
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x491cd8
mov eax, dword [0x4ae288]
call fcn.00496a50
dec eax
test eax, eax
jl 0x491cd8
inc eax
mov dword [ebp - 4], eax
xor edi, edi
mov edx, edi
mov eax, dword [0x4ae288]
call fcn.00496a3c
cmp esi, dword [eax + 0x2b4]
jne 0x491cd2
mov edx, edi
mov eax, dword [0x4ae288]
call fcn.00496a3c
cmp ebx, eax
je 0x491cd2
mov eax, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x4a8184]
call fcn.0040a2a4
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x423d38]
call fcn.00415870
call fcn.00405de4
inc edi
dec dword [ebp - 4]
jne 0x491c7d
mov eax, dword [ebx + 0x2b4]
test eax, eax
je 0x491ce9
xor edx, edx
call fcn.0045cf68
test byte [ebx + 0x1c], 8
jne 0x491cf9
test esi, esi
je 0x491cfb
test byte [esi + 0x1c], 8
je 0x491cfb
xor esi, esi
mov dword [ebx + 0x2b4], esi
test esi, esi
je 0x491d0e
mov edx, ebx
mov eax, esi
call fcn.00439910
test esi, esi
je 0x491dc1
test byte [ebx + 0x1c], 0x10
jne 0x491d29
cmp byte [ebx + 0x299], 3
je 0x491dc1
mov eax, dword [ebx + 0x2b4]
cmp byte [eax + 0x64], 0
jne 0x491d3e
cmp byte [ebx + 0x29e], 1
jne 0x491d44
test byte [ebx + 0x1c], 0x10
je 0x491d9c
mov eax, ebx
call fcn.004758a0
test al, al
je 0x491ddb
mov eax, dword [ebx + 0x2b4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov edi, eax
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_ActivateKeyboardLayout
cmp edi, eax
je 0x491d8a
mov eax, dword [ebx + 0x2b4]
mov edx, dword [eax]
call dword [edx + 0x38]
push eax
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetScrollRange
mov eax, ebx
call fcn.004754f4
mov edx, eax
mov eax, esi
call fcn.0045cf68
jmp 0x491ddb
cmp byte [ebx + 0x29e], 1
je 0x491ddb
mov eax, ebx
call fcn.004758a0
test al, al
je 0x491ddb
push 0
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetScrollRange
jmp 0x491ddb
mov eax, ebx
call fcn.004758a0
test al, al
je 0x491ddb
push 0
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetScrollRange
cmp byte [ebx + 0x29d], 0
je 0x491ded
mov dl, 1
mov eax, ebx
call fcn.004935e0
mov eax, ebx
call fcn.00491b7c
cmp dword [ebx + 0x2bc], 0
je 0x491e42
test byte [ebx + 0x1c], 0x10
je 0x491e42
cmp dword [ebx + 0x34], 0
je 0x491e42
push 0x37
push 0
push 0
push 0
push 0
push 0
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowTextW
push 0
xor ecx, ecx
mov edx, 0x85
mov eax, ebx
call fcn.0046dd7c
push 0
xor ecx, ecx
mov edx, 0xf
mov eax, ebx
call fcn.0046dd7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491e5f
lea eax, [ebp - 0x10]
call fcn.00407284
ret
Function at 0x495b94
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
test byte [ebx + 0x1c], 0x10
jne 0x495c6c
cmp dword [0x4a7d10], 0
je 0x495c6c
mov eax, ebx
call fcn.004758a0
test al, al
je 0x495c6c
push 0xffffffffffffffec
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_DispatchMessageW
mov esi, eax
cmp byte [ebx + 0x340], 0
jne 0x495be1
cmp byte [ebx + 0x368], 0
je 0x495c40
test esi, 0x80000
jne 0x495bff
or esi, 0x80000
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowPlacement
movzx eax, byte [ebx + 0x340]
mov eax, dword [eax*4 + 0x4a7da0]
movzx edx, byte [ebx + 0x368]
or eax, dword [edx*4 + 0x4a7da8]
push eax
movzx eax, byte [ebx + 0x341]
push eax
mov eax, dword [ebx + 0x36c]
call fcn.00446d6c
push eax
mov eax, ebx
call fcn.004754f4
push eax
call dword [0x4a7d10]
jmp 0x495c6c
and esi, 0xfff7ffff
push esi
push 0xffffffffffffffec
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetWindowPlacement
push 0x485
push 0
push 0
mov eax, ebx
call fcn.004754f4
push eax
call sub.user32.dll_GetKeyState
pop esi
pop ebx
ret
Function at 0x4980f0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor edx, edx
mov dword [ebp - 0x2c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4982a1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0xac], 0
jne 0x49828b
mov eax, dword [0x4a83e4]
cmp byte [eax], 0
jne 0x49828b
push ebx
push fcn.004989ac
call fcn.0048df00
mov dword [ebx + 0x174], eax
mov eax, fcn.0040bb6c
mov dword [fcn.0040bb6c], eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [0x4a7e40]
push eax
mov eax, dword [0x4abc40]
push eax
call fcn.0040bc5c
test eax, eax
jne 0x498195
mov eax, dword [0x4abc40]
mov dword [0x4a7e2c], eax
push 0x4a7e1c
call sub.user32.dll_GetKeyboardLayout
test ax, ax
jne 0x498195
lea edx, [ebp - 0x2c]
mov eax, dword [0x4a8120]
call fcn.0040a2a4
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x423c98]
call fcn.00415834
call fcn.00405de4
push 0x84ca0000
push 0
mov eax, dword [0x4a81e8]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x4981ac
adc eax, 0
push eax
push 1
mov eax, dword [0x4a81e8]
mov eax, dword [eax]
call eax
sar eax, 1
jns 0x4981bf
adc eax, 0
push eax
push 0
push 0
push 0
push 0
mov eax, dword [0x4abc40]
push eax
push 0
mov eax, dword [ebx + 0x8c]
call fcn.00407320
mov ecx, eax
mov edx, dword [0x4a7e40]
mov eax, 0x80
call fcn.0040c080
mov dword [ebx + 0x170], eax
mov byte [ebx + 0xac], 1
mov eax, dword [ebx + 0x174]
push eax
push 0xfffffffffffffffc
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowPlacement
mov eax, dword [0x4a827c]
cmp byte [eax], 0
je 0x49824a
mov eax, ebx
call fcn.0049914c
push eax
push 1
push 0x80
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetMenuState
mov eax, ebx
call fcn.0049914c
push eax
push 0xfffffffffffffff2
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindow
push 0
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_DestroyCursor
mov ebx, eax
push 0
push 0xf030
push ebx
call fcn.0040bb74
push 0
push 0xf000
push ebx
call fcn.0040bb74
mov eax, dword [0x4a827c]
cmp byte [eax], 0
je 0x49828b
push 0
push 0xf010
push ebx
call fcn.0040bb74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4982a8
lea eax, [ebp - 0x2c]
call fcn.00407284
ret
Function at 0x4983c4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x498466
cmp dword [ebx + 0x94], 0
jne 0x498460
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x498310
call fcn.0040bc24
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x498460
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_CheckMenuItem
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_DispatchMessageW
test al, 8
je 0x498426
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x498460
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0042f0d0
push eax
call sub.user32.dll_GetWindowTextW
dec esi
cmp esi, 0xffffffff
jne 0x498435
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x499620
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, dword [esi + 4]
cmp eax, 0x100
jb 0x49970e
cmp eax, 0x109
ja 0x49970e
call fcn.0040bc54
mov ebp, eax
test ebp, ebp
jne 0x4996d0
mov ebp, dword [esi]
mov eax, dword [edi + 0x44]
test eax, eax
je 0x499673
cmp ebp, dword [eax + 0x37c]
jne 0x499673
call fcn.004754f4
mov ebp, eax
jmp 0x499688
push ebp
call sub.user32.dll_ClientToScreen
mov ebp, eax
mov eax, ebp
call fcn.00468f70
test al, al
jne 0x499682
test ebp, ebp
jne 0x49966b
test ebp, ebp
jne 0x499688
mov ebp, dword [esi]
push ebp
call sub.user32.dll_EnumWindows
test eax, eax
je 0x4996b1
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetMenuState
test eax, eax
je 0x49970e
mov bl, 1
jmp 0x49970e
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetMenuStringW
test eax, eax
je 0x49970e
mov bl, 1
jmp 0x49970e
push esp
push ebp
call sub.user32.dll_DrawFrameControl
lea eax, [esp + 4]
push eax
mov eax, dword [edi + 0x170]
push eax
call sub.user32.dll_DrawFrameControl
mov eax, dword [esp]
cmp eax, dword [esp + 4]
jne 0x49970e
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi + 8]
push eax
mov eax, dword [esi + 4]
add eax, 0xbc00
push eax
push ebp
call sub.user32.dll_GetMenuState
test eax, eax
je 0x49970e
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret