joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414870
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [0x48c7f8]
push edi
cmp byte [esi + 0x2db8], 0
je 0x41490f
cmp dword [esi + 0x2dc0], 0
lea edi, [esi + 0x2dc4]
je 0x414901
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x4148b9
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.00416030
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.00403790
mov edx, dword [edi]
mov ecx, 0x48c7f4
push dword [esi + 0x2dc0]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2dcc]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.00403790
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [0x48c7f8]
mov eax, ecx
mov dword [ebp - 8], eax
push edi
mov dword [esi + 0x2d90], 0
test eax, eax
je 0x4150ef
lea edi, [esi + 0x2d94]
mov dword [esi + 0x2d90], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x415035
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.00416030
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x41504a
push 8
mov ecx, edi
call fcn.00416030
mov eax, dword [edi]
xor ebx, ebx
mov ecx, dword [edi + 8]
mov byte [ecx + eax], 0
inc dword [edi]
mov eax, dword [esi + 0x2da0]
test eax, eax
jle 0x4150ac
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x415085
push 0x510
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibimguiimgui.h
push str.i___Size
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [esi + 0x2da8]
add eax, ecx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 4]
inc ebx
mov eax, dword [esi + 0x2da0]
add ecx, 0x18
add esp, 0xc
mov dword [ebp - 4], ecx
cmp ebx, eax
jl 0x415085
mov edi, dword [edi]
mov ebx, 0x48c7f4
mov ecx, dword [ebp - 8]
mov edx, 0x47ad00
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d9c]
test eax, eax
cmovne ebx, eax
call fcn.00402ff0
mov esi, eax
test esi, esi
je 0x4150ef
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b580
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [0x489918], 0
push ebx
push esi
push edi
je 0x43b76c
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [ebp - 8]
push 0
push 4
push eax
mov eax, dword [0x48c8bc]
add eax, dword [0x48c910]
push eax
push dword [0x48c870]
mov dword [ebp - 8], 0
call ebx
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov eax, dword [0x48c8cc]
add eax, dword [ebp - 8]
push eax
push dword [0x48c870]
call ebx
cmp dword [ebp - 0xc], 6
jne 0x43b76c
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov eax, dword [0x48c8a8]
add eax, dword [0x48c908]
push eax
push dword [0x48c870]
call ebx
mov al, byte [ebp - 0xc]
xor al, byte [0x48c898]
not al
test al, 1
jne 0x43b76c
cmp byte [0x489919], 0
jne 0x43b63b
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x43b76c
push 0
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov eax, dword [0x48c8d4]
add eax, dword [0x48c9a0]
push eax
push dword [0x48c870]
call ebx
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push 0
push 4
push eax
mov eax, dword [0x48c908]
and ecx, 0xfff
shl ecx, 4
add eax, 0xfffffff0
add ecx, dword [0x48c8a4]
add eax, ecx
mov dword [ebp - 4], 0
push eax
push dword [0x48c870]
call ebx
cmp dword [ebp - 4], 0
je 0x43b76c
lea ecx, [ebp - 4]
call fcn.0043ab40
test al, al
je 0x43b76c
lea ecx, [ebp - 0xc]
call fcn.0043abe0
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x43b76c
add eax, dword [0x48c8e0]
lea ecx, [ebp - 0xc]
mov esi, dword [0x489920]
push 0
push 4
push ecx
push eax
push dword [0x48c870]
mov dword [ebp - 0xc], 0
call ebx
add esi, 3
mov dword [ebp - 8], 0
push 0
push 4
lea eax, [ebp - 8]
lea edi, [esi + esi*2]
mov esi, dword [ebp - 0xc]
push eax
shl edi, 4
lea eax, [esi + 0xc]
add eax, edi
push eax
push dword [0x48c870]
call ebx
movss xmm0, dword [ebp - 8]
lea eax, [ebp - 8]
push 0
push 4
push eax
lea eax, [esi + 0x1c]
movss dword [ebp - 0x18], xmm0
add eax, edi
mov dword [ebp - 8], 0
push eax
push dword [0x48c870]
call ebx
movss xmm0, dword [ebp - 8]
lea eax, [ebp - 8]
push 0
push 4
push eax
lea eax, [esi + 0x2c]
movss dword [ebp - 0x14], xmm0
add eax, edi
mov dword [ebp - 8], 0
push eax
push dword [0x48c870]
call ebx
movss xmm0, dword [ebp - 8]
lea ecx, [ebp - 0x18]
movss dword [ebp - 0x10], xmm0
call fcn.0043b230
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43e2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x43e2dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x43e304
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x43e30a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x43e372
jg 0x43e321
test esi, esi
je 0x43e372
test ecx, ecx
jl 0x43e36d
jg 0x43e32b
test eax, eax
je 0x43e36d
cmp edi, ecx
jg 0x43e33f
jl 0x43e335
cmp esi, eax
jae 0x43e33f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x43e375
mov ecx, dword [ebp + 8]
jmp 0x43e37f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x43e399
jg 0x43e37f
test esi, esi
je 0x43e399
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x43e399
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43e3b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x43e3d4
jl 0x43e3c9
test ecx, ecx
jne 0x43e3d4
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x43e3ee
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push esi
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x43e434
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 4], edx
mov eax, dword [eax]
test eax, eax
je 0x43e43a
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x43e43a
lea eax, [ebx + 0x2c]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x43e4a9
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x43e466
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x43e497
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x43e4a9
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x43e473
test edi, edi
je 0x43e4a9
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43e830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x43e84c
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x43e87e
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x43e87e
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x43e941
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x43e8a6
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x43e8b2
movsx eax, bl
jmp 0x43e8ea
lea eax, [ebp + 8]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x43e90a
sub eax, 1
je 0x43e90a
sub eax, 2
jne 0x43e941
movsx eax, byte [ebp - 1]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x28]
sub edi, eax
je 0x43e928
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x43e941
lea ecx, [ebp - 1]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 8], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43f130
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x43f1bc
cmp byte [esi + 0x3d], 0
je 0x43f1bc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x43f1b4
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x43f185
sub eax, 1
je 0x43f189
sub eax, 2
jne 0x43f1b4
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x43f1a7
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x43f1b4
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x441460
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c5fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
lea edi, [esi + 0x38]
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [ebp + 8], edi
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x441507
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 5
lea ecx, [esi + 0x70]
mov al, byte [ebp + 0xc]
mov byte [esi + 0x60], al
push 9
mov byte [esi + 0x68], 9
call fcn.0043f6e0
cmp byte [esi + 0x68], 1
mov ebx, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
jne 0x441545
cmp dword [esi + 0x70], 0
jne 0x441545
push 0x452f
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibjsonjson.hpp
push str.m_type___value_t::object__m_value.object___nullptr
call ebx
add esp, 0xc
cmp byte [esi + 0x68], 2
jne 0x441565
cmp dword [esi + 0x70], 0
jne 0x441565
push 0x4530
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibjsonjson.hpp
push 0x481e90
call ebx
add esp, 0xc
cmp byte [esi + 0x68], 3
jne 0x441585
cmp dword [esi + 0x70], 0
jne 0x441585
push 0x4531
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibjsonjson.hpp
push str.m_type___value_t::string__m_value.string___nullptr
call ebx
add esp, 0xc
cmp byte [esi + 0x68], 8
jne 0x4415a5
cmp dword [esi + 0x70], 0
jne 0x4415a5
push 0x4532
push str.C:Users1337DownloadsDestiny.ut_masterDestiny.ut_masterlibjsonjson.hpp
push str.m_type___value_t::binary__m_value.binary___nullptr
call ebx
add esp, 0xc
mov byte [ebp - 4], 6
xor ebx, ebx
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x10]
mov byte [ebp + 0xf], 1
mov dword [ebp - 0x18], edx
test ecx, ecx
jns 0x4415d8
mov eax, ecx
neg eax
cmp ebx, eax
jae 0x4415d8
add ecx, ebx
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x4415e2
add ecx, ebx
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
and ecx, 0x1f
lea eax, [ebp + 0xf]
push ecx
push edx
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x10]
call fcn.00443720
mov ecx, dword [ebp + 0x34]
test ecx, ecx
je 0x441610
mov edx, dword [ecx]
lea eax, [ebp + 0x10]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x450dc0
Capabilities:
Log keystrokes via polling

Disassembly:
cmp dword [0x489e50], 0
jne 0x450dd9
push 0
push 0x10001
call fcn.00453f20
add esp, 8
ret
jmp fcn.004517b0

Function at 0x451240
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00452360
add esp, 0xc
test eax, eax
je 0x451374
mov edi, dword [ebp + 0x10]
cmp dword [edi], 0
je 0x4512e1
mov eax, dword [edi + 4]
cmp eax, 0x36001
jne 0x45128a
call fcn.00456700
test eax, eax
je 0x451374
push ebx
push edi
push esi
call fcn.00456270
jmp 0x4512c4
cmp eax, 0x36002
jne 0x4512a8
call fcn.00457a60
test eax, eax
je 0x451374
push ebx
push edi
push esi
call fcn.00457520
jmp 0x4512c4
cmp eax, 0x36003
jne 0x4512cf
call fcn.00458600
test eax, eax
je 0x451374
push ebx
push edi
push esi
call fcn.004583b0
add esp, 0xc
test eax, eax
je 0x451374
push edi
push esi
call fcn.00454860
add esp, 8
test eax, eax
je 0x451374
cmp dword [esi + 0x3c], 0
je 0x451344
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.00452130
push esi
call fcn.00452a60
mov eax, dword [ebp + 0xc]
add esp, 8
cmp dword [eax + 0x28], 0
je 0x45136a
push esi
call fcn.0044f340
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + 0x10], 0
je 0x45136a
push 8
push dword [esi + 0x2ac]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebx + 0x18], 0
je 0x45136a
push esi
call fcn.00451430
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x451940
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
je 0x4519ae
push esi
lea ecx, [edi + edi]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x451989
push str.Win32:_Failed_to_allocate_global_handle_for_clipboard
push 0x10008
call fcn.00458a00
add esp, 8
pop esi
pop edi
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x4519b1
push str.Win32:_Failed_to_lock_global_handle
push 0x10008
call fcn.00458a00
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebp
ret
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [0x48b154]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4519e3
push str.Win32:_Failed_to_open_clipboard
jmp 0x451999
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
pop esi
pop edi
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x451b00
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [0x48bf08], eax
jne 0x451b5d
cmp dword [ebp + 0xc], 0
je 0x451b24
push eax
call fcn.00452a10
add esp, 4
mov esp, ebp
pop ebp
ret
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x451b5d
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.00458a00
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x452810
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4898c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push edi
push eax
mov dword [0x48bf08], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x45286b
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [ebp - 0xc]
cvtdq2pd xmm0, xmm0
movsd qword [0x48bef8], xmm0
movd xmm0, dword [ebp - 8]
cvtdq2pd xmm0, xmm0
movsd qword [0x48bf00], xmm0
cmp dword [ebx + 0x68], 0x34001
jne 0x452890
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x452880
push dword [eax + 4]
jmp 0x452892
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
jmp 0x452892
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push ebx
call fcn.0044f340
add esp, 4
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x2ac]
call dword [sym.imp.USER32.dll_ClientToScreen]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_ClipCursor]
cmp dword [ebx + 0x1e8], 0
je 0x45291f
mov eax, dword [ebx + 0x2ac]
push 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push 1
push eax
mov dword [ebp - 0x10], 0x20001
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45291f
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.00458a00
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0045b097
mov esp, ebp
pop ebp
ret

Function at 0x452930
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x1e8], 0
je 0x45297c
push 0xc
push 1
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x20001
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x45297c
push str.Win32:_Failed_to_remove_raw_input_device
push 0x10008
call fcn.00458a00
add esp, 8
push 0
mov dword [0x48bf08], 0
call dword [sym.imp.USER32.dll_ClipCursor]
cvttsd2si eax, qword [0x48bf00]
cvttsd2si ecx, qword [0x48bef8]
mov dword [ebp - 4], eax
mov dword [esi + 0x2dc], eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x2ac]
mov dword [ebp - 8], ecx
mov dword [esi + 0x2d8], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetCursorPos]
cmp dword [esi + 0x68], 0x34001
jne 0x452a03
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4529ea
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x452a10
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push 0xc
push 1
mov dword [ebp - 0xc], 0x20001
mov eax, dword [eax + 0x2ac]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x452a54
push str.Win32:_Failed_to_register_raw_input_device
push 0x10008
call fcn.00458a00
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x452b70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
push edi
push 0x10
call ebx
movzx esi, ax
push 0x11
shr esi, 0xf
call ebx
mov edi, esi
or edi, 2
bt ax, 0xf
push 0x12
cmovae edi, esi
call ebx
mov ebx, edi
or ebx, 4
bt ax, 0xf
push 0x5c
cmovae ebx, edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
push 0x5b
mov si, ax
call edi
mov edi, ebx
or edi, 8
or si, ax
push 0x14
cmovns edi, ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
call ebx
mov esi, edi
or esi, 0x10
test al, 1
push 0x90
cmove esi, edi
call ebx
mov ecx, esi
or ecx, 0x20
test al, 1
pop edi
cmove ecx, esi
pop esi
mov eax, ecx
pop ebx
ret

Function at 0x456160
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
cmp eax, 0xffffffff
jne 0x45618a
push 0x476830
push 0x10008
call fcn.00458a00
add esp, 8
xor eax, eax
pop ebp
ret
mov dword [ecx], 1
mov eax, 1
pop ebp
ret