joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44f040
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.00471ee0
lea ecx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.0045ac30
test al, al
je 0x44f0cb
cmp byte [esp + 0xf], 0
je 0x44f0cb
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 0
push 0xb29
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [0x5dad54]
add ecx, 0x74
push 0
push 0xa32
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov edi, dword [esi + 4]
test edi, edi
je 0x44f0c0
mov eax, dword [0x5db8dc]
mov ebx, 0x5db8dc
mov ecx, ebx
call dword [eax + 4]
test eax, eax
mov ecx, 0x5db860
cmove ebx, ecx
mov ecx, edi
push ebx
call fcn.004326b0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1ec]
mov word [0x5db9c8], 0
jmp 0x44f115
call fcn.004726c0
call fcn.00471f80
mov ecx, esi
call fcn.0044f610
mov ecx, esi
call fcn.0044fec0
mov edi, dword [esi + 4]
test edi, edi
je 0x44f115
mov eax, dword [0x5db8dc]
mov ebx, 0x5db8dc
mov ecx, ebx
call dword [eax + 4]
test eax, eax
mov ecx, 0x5db860
cmove ebx, ecx
mov ecx, edi
push ebx
call fcn.004326b0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1ec]
push 0x5af7d0
mov ecx, 0x5dadb8
call fcn.004045f0
test eax, eax
je 0x44f141
call fcn.00471e40
call fcn.004b3af0
test eax, eax
je 0x44f13c
push eax
call fcn.004020f0
call fcn.0044f6a0
push 1
mov ecx, esi
call fcn.0044f360
pop edi
mov ecx, esi
pop esi
pop ebx
add esp, 4
jmp fcn.0044f2e0
Function at 0x44f2e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0xc], 0
je 0x44f355
push ebx
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
push 0x90
setne bl
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov dl, bl
setne cl
call fcn.004731e0
mov ecx, dword [edi + 0xc]
add esp, 4
pop ebx
test al, al
je 0x44f33a
push dword [esp + 4]
add ecx, 0x22c
call fcn.0042a1c0
jmp 0x44f33f
call fcn.00427950
mov ecx, dword [0x5db978]
test ecx, ecx
je 0x44f355
add ecx, 0x14
pop edi
add esp, 4
jmp 0x521070
pop edi
pop ecx
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0xa0
mov edi, ecx
call esi
test eax, 0x8000
je 0x52108f
mov eax, 2
jmp 0x52109f
push 0xa1
call esi
test eax, 0x8000
jne 0x5210b6
xor eax, eax
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x5210ad
mov dword [ecx + 0x40], 0
cmp eax, 3
je 0x5210b6
test eax, eax
jne 0x5210c4
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x5210c4
mov dword [eax + 0x40], 0
push 0xa4
call esi
test eax, 0x8000
je 0x5210d9
mov eax, 8
jmp 0x5210e9
push 0xa5
call esi
test eax, 0x8000
jne 0x521100
xor eax, eax
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x5210f7
mov dword [ecx + 0x40], 0
cmp eax, 9
je 0x521100
test eax, eax
jne 0x52110e
mov eax, dword [edi + 0x24]
test eax, eax
je 0x52110e
mov dword [eax + 0x40], 0
push 0xa2
call esi
test eax, 0x8000
je 0x521123
mov eax, 5
jmp 0x521133
push 0xa3
call esi
test eax, 0x8000
jne 0x52114a
xor eax, eax
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x521141
mov dword [ecx + 0x40], 0
cmp eax, 6
je 0x52114a
test eax, eax
jne 0x521158
mov eax, dword [edi + 0x2c]
test eax, eax
je 0x521158
mov dword [eax + 0x40], 0
pop edi
pop esi
ret
Function at 0x4526c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5733e0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x1c], 0
mov ecx, dword [ebp + 8]
jne 0x4526fd
xor al, al
jmp 0x452878
cmp dword [esi + 0x20], 0
je 0x4526f6
xor eax, eax
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
mov edx, 0x5dbcb4
push eax
call fcn.004b40c0
add esp, 8
test al, al
jne 0x4527e7
mov eax, dword [esi + 0x20]
xor edi, edi
push edi
push edi
push 0xb0
push dword [eax + 4]
xor ebx, ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x45276d
mov edi, eax
movzx ebx, ax
shr edi, 0x10
mov ecx, dword [esi + 0x20]
lea eax, [ebp - 0x44]
push eax
call fcn.004d4880
lea eax, [edi - 1]
push eax
lea eax, [ebx - 1]
push eax
mov eax, dword [esi + 0x20]
push 0xb1
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x1c], 0
je 0x4527e7
mov edi, dword [esi + 0x1c]
cmp dword [edi + 0x1d4], 1
lea esi, [edi + 0x138]
je 0x4527e3
cmp dword [esi + 0x90], 0
mov dword [esi + 0x9c], 1
je 0x4527c9
mov eax, dword [esi]
mov ecx, esi
push 5
call dword [eax + 0x19c]
mov eax, dword [esi + 4]
test eax, eax
je 0x4527d9
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1ec]
xor bl, bl
jmp 0x452834
mov edi, dword [esi + 0x1c]
cmp dword [edi + 0x1d4], 0
lea esi, [edi + 0x138]
je 0x452832
cmp dword [esi + 0x90], 0
mov dword [esi + 0x9c], 0
je 0x452818
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x19c]
mov eax, dword [esi + 4]
test eax, eax
je 0x452828
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1ec]
mov bl, 1
mov eax, dword [ebp - 0x18]
cmp eax, 8
jb 0x45284b
push 2
inc eax
push eax
push dword [ebp - 0x2c]
call fcn.00403190
add esp, 0xc
mov ecx, dword [ebp - 0x30]
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp ecx, 8
jb 0x452876
push 2
inc ecx
push ecx
push dword [ebp - 0x44]
call fcn.00403190
add esp, 0xc
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4

Function at 0x4540f0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x30], 5
jne 0x454123
mov eax, dword [0x5db57c]
sub eax, 0
je 0x454118
sub eax, 1
je 0x454111
sub eax, 1
jne 0x454111
mov eax, 2
jmp 0x45411d
mov eax, 1
jmp 0x45411d
call fcn.004a8680
push eax
call fcn.0044f990
push esi
mov esi, dword [0x5dad54]
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret
Function at 0x472770
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, ecx
mov byte [edi], 0
mov eax, dword [0x5db590]
sub eax, dword [0x5db58c]
test eax, 0xfffffffc
je 0x472815
push 0x5af7d0
call fcn.004045f0
test eax, eax
je 0x472815
push esi
mov ecx, 0x5db588
call fcn.0046a660
test eax, eax
jne 0x4727cd
call fcn.004f5a40
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0x54]
cmp eax, 0xefffffff
jne 0x47285f
mov byte [edi], 1
cmp dword [0x5db610], 0
je 0x4727b8
call fcn.00472df0
mov ecx, dword [0x5db97c]
cmp eax, 0xffffffff
cmovne ecx, eax
mov dword [0x5db97c], ecx
xor ecx, ecx
call fcn.00472870
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
movups xmmword [ebp - 0x16], xmm0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x472840
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x18]
push 0x5af260
push eax
call fcn.00497b50
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0053f778
mov esp, ebp
pop ebp
ret

Function at 0x4731b0
Capabilities:
Get keyboard layout

Disassembly:
push 0x5af7d0
mov ecx, 0x5dadb8
call fcn.004045f0
test eax, eax
je 0x4731d0
cmp dword [0x5db610], 0
jne fcn.004b3bb0
ret
Function at 0x492020
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xbfc], 1
jne 0x49203c
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi + 0xbc8]
test eax, eax
je 0x492031
add eax, 0x14
je 0x492031
mov eax, dword [eax + 4]
test eax, eax
je 0x492031
mov eax, dword [eax + 4]
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00492190
mov ebx, eax
test bl, 4
je 0x4920e4
lea ecx, [esi + 0xb44]
call fcn.0050d750
mov ecx, esi
test bl, 0x40
je 0x4920b3
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004926e0
cmp eax, 0xffffffff
je 0x492177
push dword [ebp - 4]
mov ecx, esi
call fcn.00492a90
mov ecx, dword [ebp + 0x14]
pop ebx
pop edi
pop esi
mov dword [ecx], eax
mov eax, 0x20
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 4]
call fcn.00492a20
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov ecx, esi
mov eax, dword [ebp + 8]
push eax
call fcn.00492560
or edx, 0xffffffff
mov ecx, 0x10
cmp eax, 0xffffffff
pop ebx
cmove ecx, edx
pop edi
mov eax, ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10
test bl, 2
je 0x492177
push 0xa4
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
test eax, 0x8000
jne 0x492123
push 0x38
call fcn.00492a90
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea ecx, [esi + 0xb44]
call fcn.0050d750
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
test bl, 0x20
je 0x49215f
mov eax, dword [ebp + 0xc]
push 0x62
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004926e0
push dword [ebp - 4]
mov ecx, esi
call fcn.00492a90
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
lea ecx, [esi + 0xb44]
call fcn.0050d750
pop ebx
pop edi
mov eax, 0x20
pop esi
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 4]
call fcn.00492a20
mov ecx, dword [ebp + 0x14]
pop ebx
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x492380
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
test esi, esi
jne 0x4923b5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.005481a0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x4923a2
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0
push 1
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x108], 0
push eax
movzx eax, byte [ebp + 0xc]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
jne case.default.0x492432
push 0xa4
call dword [sym.imp.USER32.dll_GetKeyState]
test eax, 0x8000
je case.default.0x492432
lea eax, [esi - 0x60]
cmp eax, 9
ja case.default.0x492432
jmp dword [eax*4 + 0x492530]
mov eax, 0x30
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x31
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x32
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x33
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x34
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x35
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x36
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x37
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x38
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x39
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov ax, word [ebp - 0x108]
xor ecx, ebp
pop esi
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc
Function at 0x492560
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov ecx, dword [edi + 0x158]
mov dword [ebp - 4], ecx
cmp ecx, 0xffffffff
jne 0x492583
or eax, ecx
pop edi
mov esp, ebp
pop ebp
ret 4
push esi
test ecx, ecx
js 0x492653
mov eax, dword [edi + 0x18c]
sub eax, dword [edi + 0x188]
sar eax, 3
cmp ecx, eax
jge 0x492653
mov eax, dword [edi + 0x188]
shl ecx, 3
mov dword [ebp - 0xc], ecx
movzx esi, word [eax + ecx + 2]
mov eax, esi
and eax, 4
jne 0x4925c1
inc dword [edi + 0xfc]
test eax, eax
jne 0x4925c8
or esi, 2
mov eax, esi
and eax, 0xc
cmp al, 0xc
jne 0x4925d4
or esi, 0x10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, word [ebp + 8]
mov edi, eax
movzx eax, si
cdq
mov esi, eax
mov eax, dword [ebp - 8]
shld edx, esi, 0x10
mov edx, dword [ebp - 0xc]
shl esi, 0x10
sub edi, dword [eax + 0x160]
or esi, ecx
xor ecx, ecx
or ecx, edi
mov edi, eax
mov eax, dword [edi + 0x188]
mov dword [edx + eax], esi
mov dword [edx + eax + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [edi + 0x160], eax
movzx eax, word [ebp + 8]
cmp eax, 0x20
je 0x492646
cmp eax, 0xa
je 0x492646
cmp dword [edi + 0x16c], 1
mov ecx, dword [ebp - 4]
jne 0x492653
inc dword [edi + 0xf0]
mov dword [edi + 0x16c], 3
jmp 0x492653
mov ecx, dword [ebp - 4]
mov dword [edi + 0x16c], 1
cmp dword [edi + 0xbc8], 0
je 0x49268e
xor eax, eax
mov byte [edi + 0xbec], 0
mov dword [edi + 0xbf4], eax
xor edx, edx
mov dword [edi + 0xbf0], eax
mov word [edi + 0xbee], ax
mov dword [edi + 0xbf8], 0xffffffff
mov eax, dword [edi + 0xbc8]
mov word [eax + 0x5c], dx
mov eax, dword [edi + 0xbc8]
test eax, eax
je 0x4926a8
xor edx, edx
mov dword [edi + 0xbd4], 0
mov word [eax + 0x5c], dx
mov esi, dword [edi + 0x860]
test esi, esi
jne 0x4926bd
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 4
imul eax, ecx, 0x64
xor edx, edx
div esi
pop esi
mov dword [edi + 0xb40], eax
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x49e280
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov word [ebp - 0x18], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x18]
mov edi, edx
push eax
mov esi, ecx
movups xmmword [ebp - 0x16], xmm0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x49e2d4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x18]
push 0x5af260
push eax
call fcn.00497b50
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, edi
je 0x49e2de
push edi
call fcn.005093a0
push esi
mov edx, ebx
mov ecx, 2
call fcn.0049eb10
add esp, 4
test eax, eax
jne 0x49e322
push esi
push dword [ebp + 0xc]
mov edx, ebx
lea ecx, [eax + 2]
call fcn.0049f0a0
add esp, 8
test eax, eax
jne 0x49e322
push esi
mov edx, ebx
lea ecx, [eax + 2]
call fcn.0049f680
add esp, 4
test eax, eax
jne 0x49e322
mov dl, 1
mov ecx, esi
call fcn.0049d330
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053f778
mov esp, ebp
pop ebp
ret

Function at 0x4a9a80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], ecx
test edx, edx
js 0x4a9b4d
mov eax, dword [ecx + 0x188]
sub eax, dword [ecx + 0x184]
sar eax, 3
cmp edx, eax
jge 0x4a9b4d
mov eax, dword [ecx + 0x184]
shl edx, 3
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], edx
movzx ebx, word [eax + edx + 2]
push ebx
call fcn.004a9b60
mov eax, dword [ebp + 0x10]
cmp eax, 1
jne 0x4a9ad1
lea ebx, [eax + 0x1f]
jmp 0x4a9adc
test bl, 4
je 0x4a9ada
test al, 2
jne 0x4a9adc
or ebx, eax
mov eax, ebx
and eax, 0xc
cmp al, 0xc
jne 0x4a9ae8
or ebx, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, word [ebp + 0xc]
mov edi, eax
movzx eax, bx
mov ebx, dword [ebp - 4]
cdq
mov esi, eax
shld edx, esi, 0x10
sub edi, dword [ebx + 0x15c]
mov eax, dword [ebx + 0x184]
mov edx, dword [ebp + 8]
shl esi, 0x10
or esi, ecx
xor ecx, ecx
or ecx, edi
mov dword [edx + eax], esi
mov dword [edx + eax + 4], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
test al, 2
je 0x4a9b3a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x15c], eax
mov eax, dword [ebp + 0x10]
cmp eax, 1
je 0x4a9b4c
push eax
movzx eax, word [ebp + 0xc]
mov ecx, ebx
push eax
call fcn.004a9da0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b3bb0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x5af7d0
mov ecx, 0x5dadb8
call fcn.004045f0
test eax, eax
jne 0x4b3bd8
mov byte [ebp - 0x1d], al
jmp 0x4b3bfb
push 0x5dadb8
mov ecx, 0x5db588
call fcn.0046a660
test eax, eax
jne 0x4b3bf0
mov byte [ebp - 0x1d], al
jmp 0x4b3bfb
cmp dword [eax + 0x54], 0xefffffff
sete byte [ebp - 0x1d]
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
movups xmmword [ebp - 0x16], xmm0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
jne 0x4b3c1a
xor ecx, ecx
jmp 0x4b3c39
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
lea eax, [ebp - 0x18]
push 0x5af260
push eax
call fcn.00497b50
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
mov dl, byte [ebp - 0x1d]
push 0x5db8f4
call fcn.004b3300
add esp, 4
cmp dword [0x5dbcb0], 0
je 0x4b3c6a
call fcn.004f5a40
mov ecx, dword [0x5dbcb0]
xor edx, edx
cmp eax, ecx
cmove ecx, edx
mov dword [0x5dbcb0], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x4c1650
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578c48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
cmp dword [ecx + 0x14], 8
jb 0x4c1684
mov ecx, dword [ecx]
push 0
push 0
push 4
push 0
push 1
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
jne 0x4c16a5
lea eax, [esi + 1]
jmp 0x4c1758
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [edi + 0x10], 0
je 0x4c173a
test eax, eax
jne 0x4c16d8
lea ecx, [ebp - 0x2c]
call fcn.00524080
jmp 0x4c16e9
cmp eax, 2
jle 0x4c16e9
push 0xa
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408890
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.00404460
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
cmp dword [ebp - 0x18], 8
push 0
push edx
lea ecx, [eax + eax]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4c1726
lea esi, [eax + 2]
jmp 0x4c173f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4c1736
lea esi, [eax + 3]
jmp 0x4c173f
xor esi, esi
jmp 0x4c173f
mov esi, 0xd
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x4c1756
push 2
inc ecx
push ecx
push dword [ebp - 0x2c]
call fcn.00403190
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053f778
mov esp, ebp
pop ebp
ret
Function at 0x4d5100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x38
lea eax, [ebp - 0x3c]
mov esi, ecx
push 0
push eax
call fcn.005481a0
add esi, 0x9c
mov dword [ebp - 0x40], 0x3c
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x4d5138
mov esi, dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], esi
push eax
mov dword [ebp - 0x24], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0053f778
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d6720
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5d3070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
mov esi, ecx
call fcn.005481a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x20c], 0
mov esi, eax
jne 0x4d6775
xor ecx, ecx
jmp 0x4d678f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d6780
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.00402b20
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4

Function at 0x4d6860
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x5d3070]
xor eax, esp
mov dword [esp + 0x22c], eax
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 4]
test esi, esi
jne 0x4d689d
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4
push 0x208
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.005481a0
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], 0
mov word [esp + 8], ax
cmp word [esp + 0x28], ax
jne 0x4d68e4
xor ecx, ecx
jmp 0x4d68ff
lea ecx, [esp + 0x28]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d68f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x10]
call fcn.00402b20
push dword [ebp + 8]
mov ecx, dword [edi + 4]
lea edx, [esp + 0xc]
call fcn.004d6960
mov ecx, dword [esp + 0x20]
add esp, 4
mov esi, eax
cmp ecx, 8
jb 0x4d693b
push 2
inc ecx
push ecx
push dword [esp + 0x10]
call fcn.00403190
add esp, 0xc
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.0053f778
mov esp, ebp
pop ebp
ret 4