joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433440
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64516d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.CAppLogItem.0
call fcn.00427a50
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
lea edi, [esi + 0x28]
mov ecx, 0x700724
mov dword [ebp - 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
lea edi, [esi + 0x2c]
mov ecx, 0x700724
mov dword [ebp - 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 4
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
lea edi, [esi + 0x30]
mov ecx, 0x700724
mov dword [ebp - 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 6
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
lea edi, [esi + 0x34]
mov ecx, 0x700724
mov dword [ebp - 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 8
mov eax, dword [0x700724]
mov edx, dword [eax + 0xc]
lea edi, [esi + 0x38]
mov ecx, 0x700724
mov dword [ebp - 0x10], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0xa
lea edi, [esi + 0x3c]
push 0x24
mov dword [ebp - 0x18], edi
mov dword [edi + 8], ebx
call fcn.00611c8b
add esp, 4
cmp eax, ebx
je 0x433563
mov dword [edi + 4], eax
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov ecx, dword [edi + 4]
mov al, 1
mov byte [ecx + 0x20], al
mov edx, dword [edi + 4]
mov byte [edx + 0x21], al
mov byte [ebp - 4], 0xe
mov dword [esi + 0x4c], ebx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.00610cdf
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x24], vtable.std::bad_alloc.0
mov byte [ebp - 4], 0xa
push 0x6b9848
lea ecx, [ebp - 0x24]
push ecx
call fcn.0060fb01
int3
Function at 0x434ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6452a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
push esi
push 0x80
push 3
push esi
push 1
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x1c], edi
push 0x1fa0
call fcn.005fb5ce
add esp, 4
mov ebx, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], esi
mov byte [ebp - 4], 1
cmp edi, esi
jne 0x434b55
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x434b39
and eax, 0xffff
or eax, 0x80070000
push str.hFile
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040de50
push 0x6ba4dc
lea ecx, [ebp - 0x3c]
push ecx
call fcn.0060fb01
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], esi
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0x9c]
call fcn.00433440
mov byte [ebp - 4], 2
push 0
lea edx, [ebp - 0x2c]
push edx
mov eax, 0x1fa0
sub eax, esi
push eax
lea ecx, [esi + ebx]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
add esi, eax
mov dword [ebp - 0x28], esi
add dword [ebp - 0x20], eax
test eax, eax
je 0x434c29
xor esi, esi
mov dword [ebp - 0x18], esi
jmp 0x434bb3
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
sub edi, esi
add ebx, esi
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push edi
push ebx
lea ecx, [ebp - 0x9c]
mov edx, dword [ebp - 0x9c]
mov eax, dword [edx + 0xc]
call eax
cmp eax, 0xffffffff
je 0x434bf3
test eax, eax
je 0x434c19
add esi, eax
mov dword [ebp - 0x18], esi
cmp esi, dword [ebp - 0x28]
jb 0x434c15
xor esi, esi
mov dword [ebp - 0x18], esi
jmp 0x434c19
cmp edi, 0x1fa0
ja 0x434bec
push edi
push ebx
push 0x1fa0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0060fbd3
add esp, 0x10
mov esi, edi
mov dword [ebp - 0x18], esi
jmp 0x434c19
test eax, eax
jg 0x434bb0
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 0
jne 0x434b77
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c]
call fcn.004332f0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x434c4c
push ebx
call fcn.00611a0b
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x434c79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437d10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [edi + 0x971]
mov byte [esi + 0x971], al
movzx ecx, byte [edi + 0x970]
mov byte [esi + 0x970], cl
movzx edx, byte [edi + 0x972]
mov byte [esi + 0x972], dl
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
movzx ecx, byte [edi + 8]
mov byte [esi + 8], cl
movzx edx, byte [edi + 0x973]
mov byte [esi + 0x973], dl
movzx eax, byte [edi + 0x14]
mov byte [esi + 0x14], al
movzx ecx, byte [edi + 0x15]
mov byte [esi + 0x15], cl
movzx edx, byte [edi + 5]
mov byte [esi + 5], dl
movzx eax, byte [edi + 0x975]
mov byte [esi + 0x975], al
movzx ecx, byte [edi + 0x974]
mov byte [esi + 0x974], cl
movzx edx, byte [edi + 4]
mov byte [esi + 4], dl
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
mov ebx, esi
fld qword [edi + 0x958]
mov dword [ebp + 8], 0
fstp qword [esi + 0x958]
sub ebx, edi
fld qword [edi + 0x960]
fstp qword [esi + 0x960]
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x24], ecx
mov edx, dword [edi + 0x96c]
mov dword [esi + 0x96c], edx
mov eax, dword [edi + 0x968]
mov dword [esi + 0x968], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
lea ecx, [esi + 0x82e]
lea eax, [edi + 0x82a]
lea esp, [esp]
movzx edx, word [eax]
test dx, dx
je 0x437e73
mov word [ebx + eax], dx
movzx edx, word [eax + 2]
test dx, dx
je 0x437e73
mov word [ecx - 2], dx
movzx edx, word [eax + 4]
test dx, dx
je 0x437e73
mov word [ecx], dx
movzx edx, word [eax + 6]
test dx, dx
je 0x437e73
mov word [ecx + 2], dx
movzx edx, word [eax + 8]
test dx, dx
je 0x437e73
mov word [ecx + 4], dx
movzx edx, word [eax + 0xa]
test dx, dx
je 0x437e73
mov word [ecx + 6], dx
mov edx, dword [ebp + 8]
add edx, 6
add eax, 0xc
add ecx, 0xc
mov dword [ebp + 8], edx
cmp edx, 0x96
jl 0x437e10
push 0x400
lea ecx, [edi + 0x2a]
push ecx
lea edx, [esi + 0x2a]
push 0x400
push edx
call fcn.0060fbd3
push 0x400
lea eax, [edi + 0x42a]
push eax
lea ecx, [esi + 0x42a]
push 0x400
push ecx
call fcn.0060fbd3
push 0x400
add edi, 0x9f2
push edi
push 0x400
add esi, 0x9f2
push esi
call fcn.0060fbd3
add esp, 0x30
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x438fa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
mov eax, edx
push edi
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438fd8
sub eax, edi
push eax
push edx
mov ecx, esi
call fcn.00438e10
mov ecx, esi
call fcn.00438ec0
pop edi
lea eax, [esi + 0x68]
pop esi
pop ebp
ret 4
Function at 0x4446d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44472b
mov eax, dword [ebp - 0x104]
cmp eax, 2
jne 0x44470e
cmp dword [ebp - 0x110], 5
jb 0x44472b
mov al, 1
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x44472b
cmp dword [ebp - 0x110], 4
jb 0x44472b
cmp dword [ebp - 0x10c], 0x5a
jb 0x44472b
mov al, al
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x4451b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x712c90]
sub esp, 0x100
push esi
call fcn.005b2cb0
mov eax, dword [0x712c94]
mov ecx, dword [eax]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call esi
test eax, eax
je 0x4452b3
mov edx, dword [0x712c94]
mov eax, dword [edx]
push eax
call esi
test eax, eax
je 0x4452b3
mov ecx, dword [0x712c94]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4452b3
mov eax, dword [0x712c8c]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x445228
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x120
je 0x4452b3
mov eax, dword [0x716738]
push 0x80
lea edx, [ebp - 0x100]
push edx
push 0xe001
xor ecx, ecx
push eax
mov word [ebp - 0x100], cx
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [0x712c98]
mov eax, dword [edx]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x100]
push ecx
push 0x100
push 0x40b
push eax
call esi
mov ecx, dword [0x712c94]
mov edx, dword [ecx]
push 0
push 0x64
push 0x402
push edx
call esi
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x712c94]
mov ecx, dword [eax]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x712c94]
mov eax, dword [edx]
push 0
push 0
push 0x402
push eax
call esi
mov ecx, dword [0x712c90]
call fcn.005b2bb0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x447680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x658df0
push eax
mov dword fs:[0], esp
push esi
mov dword [ebp - 4], 0
mov ecx, dword [0x712c90]
call fcn.005b2cb0
mov eax, dword [0x712c94]
mov ecx, dword [eax]
mov esi, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call esi
test eax, eax
je 0x4477b0
mov edx, dword [0x712c94]
mov eax, dword [edx]
push eax
call esi
test eax, eax
je 0x4477b0
mov ecx, dword [0x712c8c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4477a3
mov edx, dword [ebp + 8]
mov eax, dword [0x712c98]
mov ecx, dword [eax]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edx
push 0x100
push 0x40b
push ecx
call esi
movzx edx, word [ebp + 0xc]
mov eax, dword [0x712c94]
mov ecx, dword [eax]
shl edx, 0x10
push edx
push 0
push 0x401
push ecx
call esi
mov edx, dword [ebp + 0x10]
mov eax, dword [0x712c94]
mov ecx, dword [eax]
push 0
push edx
push 0x404
push ecx
call esi
mov edx, dword [0x712c94]
mov eax, dword [edx]
push 0
push 0
push 0x402
push eax
call esi
mov ecx, dword [0x712c94]
mov edx, dword [ecx]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x712c90]
call fcn.005b2bb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x447792
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x712c90]
call fcn.005b2bb0
jmp 0x4477bb
mov ecx, dword [0x712c90]
call fcn.005b2bb0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4477e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
xor al, al
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44a040
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0xac], ebx
jne 0x44a063
mov dword [esi + 0x24], ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
push 0x10
and eax, 0x8000
mov dword [ebp - 4], eax
call edi
movzx edi, ax
movzx eax, word [ebp + 8]
add eax, 0xffffffdf
and edi, 0x8000
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, 7
ja case.0x44a09b.37
movzx eax, byte [eax + 0x44a1ac]
jmp dword [eax*4 + 0x44a1a4]
mov ecx, dword [esi + 4]
push 0
push 9
lea ebx, [esi + 4]
push 0x110a
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esi + 0xb0], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
jne 0x44a0d3
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], ebx
cmp dword [ebp - 4], 0
jne case.0x44a09b.37
test edi, edi
jne case.0x44a09b.37
xor eax, eax
push eax
mov ecx, esi
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
call fcn.00449c30
mov edx, dword [ebp + 0x10]
movzx eax, word [ebp + 8]
mov ecx, dword [esi + 0x20]
shl edx, 0x10
or edx, dword [ebp + 0xc]
lea ebx, [esi + 4]
push edx
push eax
mov eax, dword [ebx]
push 0x100
push eax
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [ebp - 0xc], 0
je 0x44a196
cmp dword [ebp - 4], 0
jne 0x44a127
test edi, edi
je 0x44a196
mov edx, dword [ebx]
push 0
push 9
push 0x110a
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x44a143
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 8]
test edi, edi
je 0x44a17b
push 1
sub esp, 8
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov ecx, dword [esi + 0xb0]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esi + 0xb4]
mov ecx, esi
mov dword [eax + 4], edx
call fcn.00449ab0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp - 4], 0
je 0x44a196
push 1
push 1
sub esp, 8
mov ecx, esp
mov dword [ecx], eax
mov dword [ecx + 4], ebx
mov ecx, esi
call fcn.00445580
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x44a8d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x654b36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi + 4], ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], eax
mov dword [eax + 0xc], ecx
mov dword [ebp - 4], 1
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [ebp - 4], 3
push 0x58
push ecx
lea ebx, [esi + 0x20]
push ebx
call fcn.006100a0
mov edx, dword [ebp + 8]
xor eax, eax
xor ecx, ecx
lea edi, [esi + 0x27c]
add esp, 0xc
mov word [edi], ax
mov word [esi + 0x7c], cx
mov dword [esi + 0x78], edx
mov dword [ebx], 0x58
call fcn.00425150
test al, al
je 0x44a950
mov dword [ebx], 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [esi + 0x5c], eax
or ecx, 0x880020
lea eax, [esi + 0x7c]
mov dword [esi + 0x44], eax
mov dword [esi + 0x54], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x104
mov dword [esi + 0x48], 0x100
mov dword [esi + 0x2c], edx
mov eax, dword [0x716738]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x64], 0x427de0
mov dword [esi + 0x24], ecx
test eax, eax
je case.0x44a9b8.0
push 0xffffffffffffffff
push eax
push 0x104
push edi
call fcn.00613a6b
add esp, 0x10
cmp eax, 0x50
ja case.0x44a9b8.1
movzx edx, byte [eax + 0x44aa0c]
jmp dword [edx*4 + 0x44a9fc]
push 0x8007000e
call fcn.004011d0
push 0x80070057
call fcn.004011d0
push 0x80004005
call fcn.004011d0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44ac20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x646ea2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0045afd0
xor edx, edx
mov dword [ebp - 4], edx
lea eax, [esi + 0x3584]
lea ecx, [eax + 4]
mov dword [esi], vtable.Mortimer::COptionSheetDialogImpl_class_Mortimer::COptionSelectionTreeCtrl__class_CAgentPropertiesSheet_.1.0
mov dword [esi + 0x30], vtable.Mortimer::COptionSheetDialogImpl_class_Mortimer::COptionSelectionTreeCtrl__class_CAgentPropertiesSheet_.0
mov dword [eax], vtable.Mortimer::COptionSelectionCtrl.0
lea edi, [ecx + 8]
mov dword [ecx + 4], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [edi + 0xc], edx
mov byte [ebp - 4], 2
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edx
mov byte [ebp - 4], 3
mov edi, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ecx + 0x20], edi
mov byte [ebp - 4], 5
mov dword [eax], vtable.Mortimer::COptionSelectionTreeCtrl.1.0
mov dword [ecx], vtable.Mortimer::COptionSelectionTreeCtrl.0
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp + 8]
mov dword [esi + 0x35bc], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x44e880
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
add eax, 0xc
push eax
lea edi, [esi + 4]
push edi
call fcn.0044e3d0
mov ecx, dword [esi + 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 0xc], edx
mov eax, dword [esi + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov eax, dword [esi + 8]
lea edx, [eax + 0xc]
mov eax, dword [eax]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xc]
add ecx, dword [esi + 0xc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [eax + 0x14], ecx
mov eax, dword [esi + 8]
mov edx, dword [eax + 0x10]
add edx, dword [esi + 0x10]
mov dword [eax + 0x18], edx
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push eax
push 0
mov dword [eax + 8], 7
mov eax, dword [ecx]
push 0x401
push eax
call ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44e920
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push eax
push 0
mov dword [eax + 8], 1
mov edx, dword [ecx]
push 0x401
push edx
call ebx
test eax, eax
jne 0x44e95a
mov eax, dword [esi + 8]
mov dword [eax + 4], 0
mov ecx, dword [esi + 0x14]
add ecx, dword [ebp + 8]
mov edx, dword [esi + 8]
mov dword [edx + 0xc], ecx
mov eax, dword [esi + 0x18]
add eax, dword [ebp + 0xc]
mov ecx, dword [esi + 8]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + 0xc]
add edx, dword [esi + 0xc]
mov dword [eax + 0x14], edx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x10]
add ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov edx, dword [esi + 8]
add edx, 0xc
push edx
push edi
mov ecx, esi
call fcn.0044e3d0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x44ea20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x652e58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x44ea69
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebp + 0x14], ebx
xor edi, edi
mov dword [ebp - 4], edi
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jle 0x44ebb9
push esi
push 0x30
lea edx, [ebp - 0x40]
push 0
push edx
call fcn.006100a0
push pe_nt_image_headers32
lea eax, [ebp - 0x150]
push 0
push eax
mov dword [ebp - 0x40], 0x30
call fcn.006100a0
add esp, 0x18
lea ecx, [ebp - 0x154]
push ecx
mov dword [ebp - 0x154], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x44eae4
mov eax, dword [ebp - 0x150]
cmp eax, 5
jae 0x44eaeb
cmp eax, 4
jne 0x44eae4
cmp dword [ebp - 0x14c], 0x5a
jae 0x44eaeb
mov dword [ebp - 0x40], 0x2c
lea eax, [ebp - 0x40]
push eax
push 1
push edi
lea edx, [ebp - 0x21c]
push ebx
mov dword [ebp - 0x18], 0x64
mov dword [ebp - 0x3c], 0x3f
mov dword [ebp - 0x1c], edx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test dword [ebp - 0x38], 0x100
jne 0x44eba8
push 0x10
call fcn.00611c8b
mov esi, eax
add esp, 4
test esi, esi
je 0x44eba8
mov eax, dword [ebp - 0x38]
or eax, 0x100
mov dword [ebp - 0x38], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0x34]
mov dword [esi + 8], ecx
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x44eb50
add ecx, 0xffffff3c
jmp 0x44eb52
xor ecx, ecx
push esi
lea edx, [ebp - 0x40]
push edx
call fcn.004448d0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005fb5ce
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x44eb97
lea ecx, [ebp - 0x21c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x40]
push edx
push 1
push edi
push ebx
mov dword [ebp - 0x20], esi
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push ebx
inc edi
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp edi, eax
jl 0x44ea86
pop esi
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0x10]
push eax
add ecx, 0x20
mov dword [ebp + 0x10], ebx
call fcn.00594900
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4593e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [ebp + 8]
lea esi, [eax + 1]
mov eax, dword [ebx]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, esi
or ecx, edx
jge 0x459412
push esi
mov ecx, ebx
call fcn.00401400
mov eax, dword [ebx]
push esi
push eax
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, eax
cmp eax, 0xffffffff
jne 0x45943f
mov ecx, dword [ebx]
test ecx, ecx
je 0x459443
lea esi, [ecx + 2]
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x459430
sub ecx, esi
sar ecx, 1
test ecx, ecx
js 0x45945c
mov edx, dword [ebx]
cmp ecx, dword [edx - 8]
jg 0x45945c
mov dword [edx - 0xc], ecx
mov edx, dword [ebx]
xor esi, esi
pop edi
mov word [edx + ecx*2], si
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.004011d0
int3