joyce8/EMBER2024-capa huggingface dataset:
Function at 0x762e29de
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [section..data]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
je 0x762e2a5a
test byte [eax + 2], 8
je 0x762e2a5a
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xc000000f
call sym.IMM32.dll_ImmLockClientImc
cmp dword [ebp + 0x10], edi
mov ebx, dword [ebp + 8]
mov esi, eax
mov dword [ebp - 0x10], esi
jne 0x762e2a26
cmp esi, edi
je 0x762e2a8d
and dword [esi + 8], 0xfffffffd
jmp 0x762e2a8d
cmp dword [ebp + 0xc], edi
jne 0x762e2a44
push 1
push ebx
call fcn.762e23c3
mov esi, eax
push esi
call sym.IMM32.dll_ImmLockIMC
cmp eax, edi
je 0x762e2a8d
mov dword [eax], ebx
push esi
jmp 0x762e2a88
cmp esi, edi
je 0x762e2a5a
push dword [ebp + 0xc]
call sym.IMM32.dll_ImmLockIMC
cmp eax, edi
jne 0x762e2a63
push esi
call sym.IMM32.dll_ImmUnlockClientImc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [eax], ebx
or dword [esi + 8], 2
test byte [eax + 0x14c], 2
je 0x762e2a79
mov dword [ebp - 4], 0x4000000f
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0x18]
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
call sym.IMM32.dll_ImmUnlockIMC
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayout]
push edi
call esi
mov ecx, eax
mov eax, dword [section..data]
cmp eax, edi
je 0x762e2ac3
test byte [eax + 2], 0x40
je 0x762e2ac3
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762e2ac3
push ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.762f3d9f
push edi
call esi
mov edi, eax
push edi
call sym.IMM32.dll_ImmLockImeDpi
mov esi, eax
test esi, esi
je 0x762e2af5
shr edi, 0x10
and di, 0xf000
cmp di, 0xe000
jne 0x762e2aef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [esi + 0x80]
push esi
call sym.IMM32.dll_ImmUnlockImeDpi
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x762e2b26
push dword [ebp - 4]
push dword [ebp + 0x10]
push 0x281
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp + 0x10], 0
je 0x762e2b48
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call fcn.762f45f4
jmp 0x762e2b48
cmp dword [ebp + 0x10], 0
jne 0x762e2b48
push 0
call sym.IMM32.dll_ImmGetDefaultIMEWnd
test eax, eax
je 0x762e2b48
push dword [ebp - 4]
push 0
push 0x281
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x10], 0
je 0x762e2b56
push dword [ebp - 0x10]
call sym.IMM32.dll_ImmUnlockClientImc
xor eax, eax
inc eax
jmp 0x762e2a5c
Function at 0x762e45f7
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
shr eax, 0x10
and ax, 0xf000
cmp ax, 0xe000
je 0x762e4641
mov eax, dword [section..data]
cmp eax, ebx
je 0x762e4641
test byte [eax + 2], 0x40
je 0x762e4641
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762e4641
xor esi, esi
inc esi
mov dword [ebp - 4], esi
jmp 0x762e4644
xor esi, esi
inc esi
push esi
push dword [ebp + 8]
call fcn.762f4608
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
jne 0x762e4665
push dword [ebp + 8]
call sym.IMM32.dll_ImmLockIMC
cmp eax, ebx
jne 0x762e466c
xor eax, eax
jmp 0x762e46ff
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp + 0xc]
xor edi, edi
cmp ecx, edx
mov dword [ebp - 8], ebx
je 0x762e4683
mov dword [ebp + 0xc], ecx
mov dword [eax + 0x18], edx
mov edi, esi
mov edx, dword [eax + 0x1c]
mov ecx, dword [ebp + 0x10]
cmp edx, ecx
je 0x762e4696
mov dword [ebp - 0xc], edx
mov dword [eax + 0x1c], ecx
mov dword [ebp - 8], esi
cmp edi, ebx
mov esi, dword [eax]
je 0x762e46a7
mov ebx, dword [eax + 4]
mov eax, dword [eax + 0x18]
mov dword [ebp + 0x10], eax
jmp 0x762e46aa
mov ebx, dword [ebp + 8]
push dword [ebp + 8]
call sym.IMM32.dll_ImmUnlockIMC
test edi, edi
jne 0x762e46bb
cmp dword [ebp - 4], edi
je 0x762e46dd
push 0
push 6
push 2
push dword [ebp + 0xc]
push 3
push esi
push dword [ebp + 8]
call fcn.762e3f20
test edi, edi
je 0x762e46dd
push dword [ebp + 0x10]
push ebx
push esi
call fcn.762f45f4
xor eax, eax
cmp dword [ebp - 8], eax
jne 0x762e46e9
cmp dword [ebp - 4], eax
je 0x762e46fc
push eax
push 7
push 4
push dword [ebp - 0xc]
push 3
push esi
push dword [ebp + 8]
call fcn.762e3f20
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x762e6867
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
push 0xe
call fcn.762f45e0
mov esi, eax
lea eax, [ebp - 0x80]
push eax
push 0x20
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor edx, edx
cmp esi, edx
mov edi, eax
je 0x762e68b1
cmp word [ebp + 0x18], dx
je 0x762e68a0
cmp si, word [ebp + 0x18]
jne 0x762e68b1
xor eax, eax
cmp edi, edx
jbe 0x762e68f9
cmp dword [ebp + eax*4 - 0x80], esi
je 0x762e68da
inc eax
cmp eax, edi
jb 0x762e68a6
cmp edi, edx
jbe 0x762e68f9
lea ecx, [ebp + edx*4 - 0x80]
push dword [ecx]
call fcn.762e6845
xor eax, dword [ebp + 0x14]
je 0x762e68d3
mov ax, word [ebp + 0x18]
test ax, ax
je 0x762e68de
cmp word [ecx], ax
je 0x762e68de
inc edx
cmp edx, edi
jae 0x762e68f9
jmp 0x762e68b5
mov ebx, esi
jmp 0x762e68e6
mov ebx, dword [ebp + edx*4 - 0x80]
test ebx, ebx
je 0x762e68f9
cmp dword [ebp + 0xc], ebx
je 0x762e68f9
push ebx
push 1
push 0x50
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
call fcn.762e6845
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x762e6e43
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x762f6184]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, esi
dec ecx
je 0x762e6ec4
dec ecx
je 0x762e6e92
mov ecx, esi
shr ecx, 0x10
and cx, 0xf000
cmp cx, 0xe000
jne 0x762e6f6e
cmp esi, eax
je 0x762e6f6e
push esi
call fcn.762e6db2
jmp 0x762e6f6e
mov ebx, 0x762f6020
push ebx
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov esi, dword [0x762f6198]
cmp esi, edi
je 0x762e6eb8
push dword [esi + 8]
call fcn.762e6db2
test eax, eax
jne 0x762e6e9e
mov esi, dword [esi]
jmp 0x762e6ea4
push ebx
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x762e6f6e
shr eax, 0x10
and ax, 0xf000
cmp ax, 0xe000
jne 0x762e6f6e
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push edi
movzx ebx, ax
call esi
cmp eax, edi
mov dword [ebp - 0x1c], eax
je 0x762e6f3d
shl eax, 2
push eax
push edi
call fcn.762e9949
mov edi, eax
test edi, edi
je 0x762e6f71
push edi
push dword [ebp - 0x1c]
call esi
xor ecx, ecx
test eax, eax
jbe 0x762e6f2e
mov dx, word [edi + ecx*4 + 2]
and dx, 0xf000
cmp dx, 0xe000
jne 0x762e6f21
inc ecx
cmp ecx, eax
jb 0x762e6f0b
cmp ecx, eax
jae 0x762e6f2e
mov ebx, dword [edi + ecx*4]
and ebx, 0xffff
push edi
push 0
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
lea eax, [ebp - 0x18]
push 0x762e6f94
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
add esp, 0xc
push 1
lea eax, [ebp - 0x18]
push eax
call esi
test eax, eax
jne 0x762e6f6e
push 0x201
push 0x762e6f80
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.762f4432
leave
ret 4
Function at 0x762e77cd
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push 0
mov bl, 1
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, eax
mov eax, dword fs:[0x18]
test byte [eax + 0x6cc], 0x40
je 0x762e77f3
xor bl, bl
cmp edi, dword [ebp + 8]
jne 0x762e7800
test bl, bl
jne 0x762e78a3
push esi
push dword [ebp + 8]
call sym.IMM32.dll_ImmLoadIME
cmp edi, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
je 0x762e786e
push edi
call sym.IMM32.dll_ImmLockImeDpi
test eax, eax
je 0x762e7844
mov esi, dword [eax + 0x10]
and esi, 0x100000
neg esi
sbb esi, esi
and esi, 0xfffffffd
push eax
add esi, 4
call sym.IMM32.dll_ImmUnlockImeDpi
push esi
push 0x762e703a
push 0
call sym.IMM32.dll_ImmEnumInputContext
push 0
call sym.IMM32.dll_ImmGetDefaultIMEWnd
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x762e7863
push edi
push 0
push 0x285
push esi
call ebx
push edi
push dword [ebp + 8]
call fcn.762f4658
jmp 0x762e7871
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x762e6cd7
push 0
mov dword [ebp - 4], edi
call sym.IMM32.dll_ImmEnumInputContext
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x762e78a2
push dword [ebp + 8]
push 1
push 0x285
push esi
call ebx
pop esi
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret 4
Function at 0x762e80b9
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx + 8]
push edi
xor edi, edi
cmp dword [ebx], 0x672c5c71
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
jne 0x762e828e
cmp dword [ebx + 4], 0x18
jb 0x762e828e
cmp dword [esi], edi
jne 0x762e828e
call dword [sym.imp.USER32.dll_GetFocus]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
je 0x762e828e
cmp eax, edi
je 0x762e828e
push dword [ebp - 0xc]
call sym.IMM32.dll_ImmGetContext
cmp eax, edi
mov dword [ebp - 0x14], eax
je 0x762e828e
push dword [ebp - 0x10]
call fcn.762e7719
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x762e828e
lea ecx, [ebp - 4]
push ecx
push 3
push dword [ebp - 0x14]
mov dword [ebp - 4], 0x100c
call dword [eax + 0x74]
test eax, eax
je 0x762e8281
mov dword [ebp - 4], edi
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x30], eax
test byte [esi + 4], 4
je 0x762e820b
mov eax, dword [esi + 0xc]
mov ecx, dword [ebx + 4]
cmp eax, ecx
ja 0x762e8281
mov edx, dword [esi + 8]
lea edx, [eax + edx*4]
cmp edx, ecx
ja 0x762e8281
or dword [ebp - 0x34], 0x10
lea eax, [eax + esi + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
test byte [eax + 0x12], 8
jne 0x762e820b
push dword [ebp - 0x10]
call sym.IMM32.dll_GetKeyboardLayoutCP
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
shl eax, 2
push eax
push 8
call fcn.762e9949
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
je 0x762e8281
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
jle 0x762e8202
push 0
push 2
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x24]
push 1
lea eax, [eax + ebx*4]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
call dword [sym.imp.USER32.dll_WCSToMBEx]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + ebx*4]
and eax, 0xffff0000
or dword [edi], eax
inc ebx
add edi, 4
cmp ebx, dword [ebp - 0x30]
jl 0x762e81cf
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
test byte [esi + 4], 0x20
je 0x762e8230
mov eax, dword [esi + 0x10]
mov ecx, dword [ebx + 4]
cmp eax, ecx
ja 0x762e826a
mov edx, dword [esi + 8]
lea edx, [eax + edx*2]
cmp edx, ecx
ja 0x762e826a
or dword [ebp - 0x34], 0x20
lea eax, [eax + esi + 0x18]
mov dword [ebp - 0x20], eax
test byte [esi + 4], 0x80
je 0x762e8255
mov eax, dword [esi + 0x14]
mov ebx, dword [ebx + 4]
cmp eax, ebx
ja 0x762e826a
mov ecx, dword [esi + 8]
lea ecx, [eax + ecx*2]
cmp ecx, ebx
ja 0x762e826a
or dword [ebp - 0x34], 0x40
lea eax, [eax + esi + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0xc]
push 0x100c
push dword [ebp - 0x14]
call dword [eax + 0x74]
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x762e8281
push dword [ebp - 8]
push 0
push dword [0x762f6888]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0xc]
call sym.IMM32.dll_ImmUnlockImeDpi
mov eax, dword [ebp - 4]
jmp 0x762e8290
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x762e829c
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.ntdll.dll_wcslen]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
pop ecx
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebx + 1]
cmp ecx, edi
jb 0x762e82cb
and word [esi], 0
jmp 0x762e82f3
test eax, eax
ja 0x762e82d6
sub edi, ebx
dec edi
cmp eax, edi
jae 0x762e82e7
lea esi, [esi + eax*2]
cmp word [esi - 2], 0x5c
je 0x762e82e7
mov word [esi], 0x5c
inc esi
inc esi
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ntdll.dll_wcscpy]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x762e8719
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x762f6184]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, ebx
push esi
mov esi, dword [ebp + 0xc]
shr eax, 0x10
push edi
xor edi, edi
and ax, 0xf000
cmp ax, 0xe000
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x214], edi
je 0x762e87e3
mov eax, dword [section..data]
cmp eax, edi
je 0x762e87e3
test byte [eax + 2], 0x40
je 0x762e87e3
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762e87e3
lea eax, [ebp - 0x214]
push eax
push 0x762e8888
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x762e87dc
lea eax, [ebp - 0x218]
push eax
lea eax, [esi + 0xb8]
push eax
push edi
push edi
push 0x762e2800
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push dword [ebp - 0x214]
je 0x762e8856
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x210]
call esi
xor eax, eax
jmp 0x762e8879
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push 0x10
push ebx
mov word [ebp - 0x21e], 0x208
call dword [sym.imp.ntdll.dll_RtlIntegerToUnicodeString]
test eax, eax
jl 0x762e87dc
lea eax, [ebp - 0x210]
push eax
push 0x762e2798
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x762e87dc
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x762e8793
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x762e87dc
mov word [esi + 0x156], di
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x210]
call edi
and dword [esi + 0x48], 0
push esi
mov dword [esi], ebx
call fcn.762e8567
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.762f4432
leave
ret 8
Function at 0x762e8ef7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x762f6184]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd4]
push eax
push 0x762e2798
push 0x80000002
mov dword [ebp - 0xe0], edi
call ebx
push 0x14
xor eax, eax
lea ecx, [ebp - 0x2c]
push ecx
push eax
push dword [ebp - 0xd4]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd0], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x762e9043
push esi
mov esi, dword [sym.imp.ntdll.dll_wcscpy]
add edi, 0x2c
cmp word [ebp - 0x2c], 0x45
je 0x762e8f73
cmp word [ebp - 0x2c], 0x65
jne 0x762e901c
cmp dword [ebp - 0xe0], 0
je 0x762e9010
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp + 0xc]
jge 0x762e9042
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xd4]
call ebx
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0
push 0
push 0x762e2800
push dword [ebp - 0xdc]
mov dword [ebp - 0xe4], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xdc]
and word [ebp - 0x2e], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
lea eax, [ebp - 0x2c]
push eax
call fcn.762e8c9c
mov dword [edi - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [edi - 0x28]
push eax
call esi
lea eax, [ebp - 0xcc]
push eax
push edi
call esi
add esp, 0x10
inc dword [ebp - 0xd0]
add edi, 0xcc
inc dword [ebp - 0xd8]
push 0x14
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0xd8]
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x762e8f61
pop esi
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xd0]
pop edi
pop ebx
call fcn.762f4432
leave
ret 8
Function at 0x762e9a21
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x762f6184]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
movzx esi, ax
cmp esi, dword [0x762f61a8]
jne 0x762e9a47
mov eax, dword [0x762f61ac]
jmp 0x762e9a79
push 7
lea eax, [ebp - 0x14]
push eax
push 0x1004
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x762e9a79
push 0xa
lea eax, [ebp - 0x14]
push 0
push eax
mov dword [0x762f61a8], esi
call dword [sym.imp.ntdll.dll_wcstol]
add esp, 0xc
mov dword [0x762f61ac], eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.762f4432
leave
ret 4

Function at 0x762e9e0d
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 8]
call sym.IMM32.dll_ImmLockClientImc
mov esi, eax
test esi, esi
je 0x762e9f23
push ebx
push edi
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [esi], 0
jne 0x762e9ef3
push 1
push dword [ebp + 8]
call fcn.762f4608
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 4], eax
mov ebx, dword [sym.imp.USER32.dll_GetKeyboardLayout]
jne 0x762e9e95
mov eax, dword [section..data]
test eax, eax
je 0x762e9e95
test byte [eax + 2], 0x40
je 0x762e9e95
mov eax, dword fs:[0x18]
test byte [eax + 0x6e0], 2
jne 0x762e9e95
push 0
call ebx
movzx eax, ax
mov edi, eax
shl edi, 0x10
or edi, eax
push edi
call fcn.762e7719
test eax, eax
je 0x762e9e95
push edi
call sym.IMM32.dll_CtfImmTIMActivate
push 2
push dword [ebp + 8]
call fcn.762f4608
test eax, eax
jne 0x762e9eb1
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
xor edi, edi
jmp 0x762e9f19
push 0x160
push 0x42
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor edi, edi
cmp eax, edi
mov dword [esi], eax
jne 0x762e9ed2
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x762e9f19
push dword [ebp + 0xc]
push dword [ebp - 4]
call ebx
push eax
push dword [ebp + 8]
call fcn.762e2cbf
test eax, eax
jne 0x762e9ef3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi], edi
jmp 0x762e9ec6
push dword [ebp + 8]
call fcn.762f4374
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalLock]
mov edi, eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call sym.IMM32.dll_ImmUnlockClientImc
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x762eb0b7
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 0xc]
push dword [0x762f6158]
call dword [sym.imp.USER32.dll_LoadBitmapW]
push dword [ebp + 8]
mov dword [ebp - 8], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 8]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov dword [ebp - 4], eax
call edi
and dword [ebp + 0xc], 0
mov dword [ebp - 0xc], eax
mov esi, 0x762f62c0
mov eax, dword [esi + 4]
push 0xcc0020
push 0
push dword [ebp + 0xc]
inc eax
push dword [ebp - 4]
inc eax
push 8
push 8
push eax
mov eax, dword [esi]
inc eax
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp + 0xc], 8
add esi, 8
cmp esi, 0x762f6438
jl 0x762eb0f7
push dword [ebp - 0xc]
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
leave
ret 8

Function at 0x762ebbd5
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
mov edi, dword [ebp + 8]
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x762ebd03
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x762ebd02
test byte [esi + 0xbc], 2
push ebx
je 0x762ebc39
lea ebx, [esi + 0xd4]
push ebx
add esi, 0xcc
push esi
push edi
call fcn.762eb728
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
push esi
push edi
call fcn.762eb728
jmp 0x762ebcf5
cmp dword [esi + 0xc8], 0xffffffff
je 0x762ebcf5
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x1c]
push eax
push edi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x1c]
push eax
call fcn.762eb879
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0xc0]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push ebx
call edi
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xbc]
mov dword [ebp - 4], eax
and dword [ebp - 4], 4
je 0x762ebca6
mov ecx, dword [esi + 0xc8]
cmp dword [ebp - 8], ecx
jne 0x762ebcb7
cmp dword [ebp - 4], 0
jne 0x762ebcdc
mov ecx, dword [esi + 0xc8]
cmp dword [ebp - 8], ecx
jne 0x762ebcdc
cmp ecx, 0x33
jne 0x762ebcc0
test al, 1
jne 0x762ebcd5
push ecx
push dword [ebp - 0xc]
call fcn.762eafa8
push dword [esi + 0xc8]
push ebx
call fcn.762eafa8
xor dword [esi + 0xbc], 4
push dword [ebp - 0x10]
push ebx
call edi
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor eax, eax
inc eax
pop ebx
pop esi
pop edi
leave
ret 0xc
Function at 0x762ec6dd
Capabilities:
Capture screenshot

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [0x762f6158]
call dword [sym.imp.USER32.dll_LoadBitmapW]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 4]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov dword [ebp + 0x10], eax
call edi
push 0xffffffffffffffd0
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
pop ebx
lea esi, [eax + 0x30]
sub ebx, eax
mov dword [ebp + 0xc], 0x2f
push 0xcc0020
push 0
lea eax, [ebx + esi]
push eax
push dword [ebp + 0x10]
push 8
push 8
push dword [esi + 4]
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_BitBlt]
add esi, 8
dec dword [ebp + 0xc]
jne 0x762ec726
push dword [ebp - 8]
push dword [ebp + 0x10]
call edi
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret 0xc