joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4533b0
Capabilities:
Create thread

Disassembly:
mov eax, 0x28b8
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2880], rax
cmp dword [rcx + 0x1e0], 0
mov qword [rsp + 0x28b0], rbx
mov qword [rsp + 0x28a8], rbp
mov qword [rsp + 0x28a0], rsi
mov qword [rsp + 0x2898], rdi
mov rbp, r9
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
je 0x4534e4
cmp dword [rcx + 0x1e4], 0
je 0x4534bc
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4534bc
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x2828
call fcn.00491ae0
mov rax, qword [rsp + 0x28e0]
mov r8, qword [rbx + 0x1e8]
mov qword [rsp + 0x70], rax
mov rax, qword [0x004d7ce8]
lea rcx, [rsp + 0x2860]
mov dword [rsp + 0x50], 0xa
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x68], rbp
mov qword [rcx], rax
mov rax, qword [0x004d7cf0]
mov qword [rcx + 8], rax
mov eax, dword [rbx + 0x1dc]
mov rcx, qword [rbx + 0x140]
mov dword [rsp + 0x2870], eax
xor eax, eax
mov dword [rsp + 0x38], 0x2828
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov edx, 0x4a
jmp 0x4534f4
cmp dword [rbx + 0xe28], 0
jne 0x4534e4
xor eax, eax
lea r8, [0x00451fa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r9, qword [rsp + 0x28e0]
mov r8, rbp
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x2898]
mov rsi, qword [rsp + 0x28a0]
mov rbp, qword [rsp + 0x28a8]
mov rbx, qword [rsp + 0x28b0]
mov rcx, qword [rsp + 0x2880]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x28b8
ret
Function at 0x453540
Capabilities:
Create thread

Disassembly:
mov eax, 0x28c8
call fcn.004ccbf0
sub rsp, rax
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2890], rax
cmp dword [rcx + 0x1e0], 0
mov qword [rsp + 0x28c0], rbx
mov qword [rsp + 0x28b8], rbp
mov qword [rsp + 0x28b0], rsi
mov qword [rsp + 0x28a8], rdi
mov qword [rsp + 0x28a0], r12
mov r12, qword [rsp + 0x2908]
mov rbp, r9
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
je 0x4536a9
cmp dword [rcx + 0x1e4], 0
je 0x453681
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x453681
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x2828
call fcn.00491ae0
mov rax, qword [rsp + 0x28f0]
mov r8, qword [rbx + 0x1e8]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x28f8]
lea rcx, [rsp + 0x2870]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x2900]
mov dword [rsp + 0x60], 0xb
mov dword [rsp + 0x8c], eax
mov rax, qword [0x004d7ce8]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rbp
mov qword [rcx], rax
mov rax, qword [0x004d7cf0]
lea r9, [rsp + 0x40]
mov edx, 0x4a
mov qword [rcx + 8], rax
mov eax, dword [rbx + 0x1dc]
mov rcx, qword [rbx + 0x140]
mov dword [rsp + 0x2880], eax
xor eax, eax
mov dword [rsp + 0x48], 0x2828
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4536da
cmp dword [rbx + 0xe28], 0
jne 0x4536a9
xor eax, eax
lea r8, [0x00451fa0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [rsp + 0x2900]
mov r9, qword [rsp + 0x28f0]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28f8]
mov r8, rbp
mov edx, esi
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov r12, qword [rsp + 0x28a0]
mov rdi, qword [rsp + 0x28a8]
mov rsi, qword [rsp + 0x28b0]
mov rbp, qword [rsp + 0x28b8]
mov rbx, qword [rsp + 0x28c0]
mov rcx, qword [rsp + 0x2890]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x28c8
ret
Function at 0x457490
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
sub rsp, 0x258
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
test rdx, rdx
mov qword [r11 + 0x20], rbx
mov qword [r11 - 8], rsi
mov qword [r11 - 0x10], rdi
mov rsi, rdx
mov rbx, rcx
mov rdi, r8
je 0x4575c2
cmp word [rdx], 0
je 0x4575c2
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], 0
call fcn.00491ae0
test rdi, rdi
je 0x45750c
cmp word [rdi], 0
je 0x45750c
lea rcx, [rsp + 0x20]
mov r8, rdi
mov edx, 0x104
call fcn.00494270
jmp 0x45751c
lea r8, [rsp + 0x20]
mov rdx, rsi
mov rcx, rbx
call fcn.0044f7c0
cmp word [rsp + 0x20], 0
je 0x4575c2
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4575c2
cmp qword [rbx + 0x1a8], 0
mov edi, 1
je 0x457550
mov dword [rbx + 0x1b8], edi
mov rcx, rbx
call fcn.0044ff50
cmp dword [rbx + 0xdb8], 0
je 0x457573
mov rcx, qword [0x0050b468]
mov edx, 0xfffd
call qword [sym.imp.USER32.dll_KillTimer]
lea rcx, [rbx + 0xd58]
mov edx, 0xffffffff
call fcn.004188a0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.00456450
test eax, eax
je 0x4575a1
mov edx, edi
mov rcx, rbx
call fcn.00454ab0
jmp 0x4575ad
xor edx, edx
mov rcx, rbx
call fcn.00454ab0
xor edi, edi
lea rcx, [rbx + 0xd58]
mov edx, 0xffffffff
call fcn.004159e0
mov eax, edi
jmp 0x4575c4
xor eax, eax
mov rdi, qword [rsp + 0x248]
mov rsi, qword [rsp + 0x250]
mov rbx, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x258
ret
Function at 0x464a50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov rdi, rcx
mov rcx, qword [rdx]
mov r12, r8
mov rbp, rdx
mov rax, qword [rcx]
lea r8, [r11 - 0x20]
mov edx, 0x10000301
mov qword [r11 - 0x10], r13
call qword [rax + 0x18]
mov rbx, qword [0x0050bfe0]
xor r13d, r13d
test rbx, rbx
je 0x464abd
movsxd rsi, dword [rsp + 0x38]
nop
mov rcx, qword [rbx]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x464be5
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x464aa0
mov rax, r13
mov rcx, qword [rax + 0x58]
lea rsi, [rax + 0x50]
mov dword [rsp + 0x30], r13d
test rcx, rcx
je 0x464ae9
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x30], 5
je 0x464b16
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x34], r13d
test rcx, rcx
je 0x464c5f
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 4
jne 0x464c5f
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 0x16
test r11b, 1
jne 0x464c5b
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
test byte [rsp + 0x34], 1
jne 0x464c5b
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 1
test r11b, 1
jne 0x464c5b
mov rcx, qword [r12]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 2
test r11b, 1
jne 0x464c5f
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 2
test r11b, 1
je 0x464c5f
add dword [rdi + 0x60], 1
cmp dword [rdi + 0x60], 1
jne 0x464bed
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x64], eax
jmp 0x464c5f
mov rax, qword [rbx]
jmp 0x464ac0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x5dc
cmp eax, dword [rdi + 0x64]
jae 0x464c08
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x64], eax
jmp 0x464c18
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x60], 1
mov dword [rdi + 0x64], eax
cmp dword [rdi + 0x60], 3
jne 0x464c5f
lea rcx, str.SynTPLpr
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
mov rbx, rax
je 0x464c5b
mov rcx, rsi
call fcn.0040a1f0
lea rcx, [0x0050b280]
mov r8d, 0x4e4
mov rdx, rbx
movzx r9d, al
mov qword [rsp + 0x20], r13
call fcn.00453210
mov dword [rdi + 0x60], r13d
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x466780
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
mov dword [rsp + 0x38], edi
mov rcx, qword [0x0050bf50]
mov rax, qword [rcx]
lea r8, [r11 - 0x40]
mov edx, 0x10000006
call qword [rax + 0x30]
cmp dword [rsp + 0x38], edi
jle 0x4667d9
lea eax, [rdi + 1]
jmp 0x466943
mov dword [rsp + 0x30], 0xffffffff
mov ebx, edi
mov rcx, qword [0x0050bf50]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + 0x20]
test eax, eax
jne 0x466941
lea rbp, method.b.virtual_16
lea rsi, method.b.virtual_16
mov qword [rsp + 0x48], rdi
mov eax, dword [0x0050b024]
test al, 1
jne 0x466837
or eax, 1
mov dword [0x0050b024], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x0050b020], eax
jmp 0x46683d
mov eax, dword [0x0050b020]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x466863
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x0050b020]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
lea r9, [0x004d3a90]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edx, dword [rsp + 0x30]
call qword [rax + 0x78]
test eax, eax
jne 0x4668eb
mov dword [rsp + 0x34], edi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x4668f0
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000107
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 0xf
jne 0x4668eb
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x466908
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x466908
mov rcx, qword [rsp + 0x48]
add ebx, 1
cmp ebx, 1
jg 0x46692a
mov qword [rsp + 0x40], rsi
test rcx, rcx
je 0x466908
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x0050bf50]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + 0x20]
test eax, eax
je 0x466811
jmp 0x466941
mov qword [rsp + 0x40], rsi
test rcx, rcx
je 0x46693a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 1
jmp 0x466943
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4669a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov eax, dword [rcx + 8]
test al, 2
je 0x4669ec
test al, 1
je 0x4669ec
call fcn.00466780
test eax, eax
je 0x4669ec
mov eax, 1
jmp 0x466ba0
mov eax, dword [rbx + 8]
test al, 0x20
je 0x466b9e
test al, 0x10
je 0x466b9e
mov dword [rsp + 0x30], 0xffffffff
mov rcx, qword [0x0050bf50]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x466b9e
xor ebx, ebx
lea rsi, method.b.virtual_16
lea rdi, method.b.virtual_16
nop
nop
nop
mov qword [rsp + 0x48], rbx
mov eax, dword [0x0050b024]
test al, 1
jne 0x466a66
or eax, 1
mov dword [0x0050b024], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x0050b020], eax
jmp 0x466a6c
mov eax, dword [0x0050b020]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x466a92
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x0050b020]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
lea r9, [0x004d3a90]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edx, dword [rsp + 0x30]
call qword [rax + 0x78]
test eax, eax
jne 0x466b4d
mov dword [rsp + 0x38], ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x466b08
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x38], 1
je 0x466b82
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], ebx
test rcx, rcx
je 0x466b2d
mov rax, qword [rcx]
lea r8, [rsp + 0x3c]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x3c], 3
je 0x466b82
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x466b52
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 6
je 0x466b82
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rdi
test rcx, rcx
je 0x466b62
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x0050bf50]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x466b9e
jmp 0x466a40
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x466b97
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 1
jmp 0x466ba0
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
add rsp, 0x78
ret
Function at 0x466f00
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov ecx, dword [rcx + 8]
xor r9d, r9d
test cl, 2
je 0x466f31
mov eax, ecx
and eax, 1
cmp edx, eax
je 0x466f31
test edx, edx
setne r9b
and ecx, 0xfffffffe
or r9d, ecx
mov dword [r8 + 8], r9d
mov r9d, 1
mov ecx, dword [r8 + 8]
test cl, 0x20
je 0x466f62
mov eax, ecx
shr eax, 4
and eax, 1
cmp edx, eax
je 0x466f62
neg edx
sbb eax, eax
and ecx, 0xffffffef
and eax, 0x10
or eax, ecx
mov rcx, r8
mov dword [r8 + 8], eax
add rsp, 0x28
jmp fcn.00466bf0
test r9d, r9d
je 0x466f6f
mov rcx, r8
call fcn.00466bf0
add rsp, 0x28
ret
Function at 0x46a050
Capabilities:
Enumerate process modules

Disassembly:
mov r11, rsp
sub rsp, 0x3d8
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov qword [r11 + 0x20], rbx
mov rcx, rdx
xor ebx, ebx
mov qword [r11 - 0x18], rdi
lea rdx, [rsp + 0x20]
mov rdi, r8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], ebx
jne 0x46a09d
xor eax, eax
jmp 0x46a287
lea rcx, [rsp + 0x280]
mov dword [rsp + 0x280], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46a096
mov eax, dword [rsp + 0x290]
mov qword [rsp + 0x3d0], rbp
mov qword [rsp + 0x3c8], rsi
cmp eax, 2
mov qword [rsp + 0x3b8], r12
mov qword [rsp + 0x3b0], r13
jne 0x46a14f
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x46a258
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x46a13f
mov rdx, qword [rsp + 0x28]
mov r9d, 0x104
mov r8, rdi
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
mov ebx, eax
jne 0x46a13f
mov word [rdi], ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x46a267
cmp eax, 1
jne 0x46a265
lea rcx, [0x004da5e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x46a265
lea rdx, [0x004da5c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x46a25c
test r13, r13
je 0x46a25c
test rbx, rbx
je 0x46a25c
xor edx, edx
lea ecx, [rdx + 2]
call rbx
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x46a25c
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x238
call r13
test eax, eax
mov ebx, eax
je 0x46a246
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x48], eax
je 0x46a217
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov dword [rsp + 0x40], 0x238
call r12
test eax, eax
mov ebx, eax
jne 0x46a1f2
jmp 0x46a246
lea rax, [rsp + 0x6c]
lea rcx, [rsp + 0x6c]
sub rdi, rax
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 2], ax
jne 0x46a230
mov ebx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
jmp 0x46a267
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r12, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3c8]
mov rbp, qword [rsp + 0x3d0]
mov r13, qword [rsp + 0x3b0]
mov rdi, qword [rsp + 0x3c0]
mov rbx, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x3d8
ret
Function at 0x46bc00
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov dword [rbx + 0x28], 0xffffffff
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbx + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x40], eax
add rsp, 0x20
pop rbx
ret
Function at 0x47bfd0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
sub rsp, 0x248
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [r11 + 0x18], rbx
mov rbx, rdx
mov qword [r11 + 0x20], rsi
mov rsi, rcx
mov edx, 0x40a
mov rcx, rbx
mov qword [r11 - 8], rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x47c04b
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsi + 0x28]
call fcn.00415b80
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.00491ae0
mov edx, 0x40c
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, qword [rsp + 0x260]
test rax, rax
je 0x47c0b2
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsi + 0x30]
call fcn.00415b80
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x248
ret
Function at 0x47c3c0
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
sub rsp, 0x2f8
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
mov r8d, 0x98
xor edx, edx
mov qword [r11 - 0x10], rdi
call fcn.00491ae0
xor edi, edi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x004db910]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.comdlg32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x47c4bf
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2f0], rsi
test rdx, rdx
je 0x47c492
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx - 1]
lea rcx, [rbx + 0x28]
mov r8d, edi
call fcn.00415b80
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2f0]
test eax, eax
je 0x47c4bf
mov rdx, rbp
mov rcx, rbx
call fcn.0047bf00
mov rdi, qword [rsp + 0x2e8]
mov rbp, qword [rsp + 0x318]
mov rbx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x2f8
ret
Function at 0x47e5a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov rsi, rcx
lea rcx, [rax - 0x20]
mov qword [rax - 0x18], r14
mov r12d, r8d
mov r13, rdx
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [rsi + 0xc]
mov r14d, 0xffff8001
imul ebx, dword [rsi + 0x48]
cmp ebx, 0x7fff
jle 0x47e5f0
mov ebx, 0x7fff
jmp 0x47e5f7
cmp ebx, r14d
cmovl ebx, r14d
mov qword [rsp + 0x88], rdi
mov eax, r12d
mov edi, r12d
shr edi, 2
and eax, 0x30000
and r12d, 0xc0000
and edi, 0x400000
mov ecx, 0x10
or edi, eax
shr edi, 2
or edi, r12d
shr edi, 0xe
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r12, qword [rsp + 0x60]
test ax, ax
jns 0x47e649
mov eax, ebx
cdq
and edx, 7
lea ebx, [rdx + rax]
sar ebx, 3
or edi, 4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x47e66a
mov eax, ebx
mov ebp, 1
cdq
sub eax, edx
sar eax, 1
or edi, 8
mov ebx, eax
mov ecx, dword [rsi + 0x20]
test cl, 2
jne 0x47e6a9
test ebp, ebp
jne 0x47e696
lea eax, [rbx + rbx*2]
add eax, eax
cdq
idiv dword [rsi + 0x4c]
cmp eax, 0x7fff
mov ebx, eax
jle 0x47e68f
mov ebx, 0x7fff
jmp 0x47e696
cmp eax, r14d
cmovl ebx, r14d
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jge 0x47e6a9
xor eax, eax
jmp 0x47e762
test edi, edi
je 0x47e6b2
test cl, 4
jne 0x47e71b
test cl, 1
jne 0x47e71b
bt ecx, 0xd
jae 0x47e6c7
call fcn.00488f80
cmp eax, 9
jge 0x47e71b
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x48]
movzx r9d, bx
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20a
or rcx, rax
movzx eax, di
mov rdx, r13
or r9, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
lea rcx, [0x0050b280]
call fcn.00453540
jmp 0x47e753
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x48]
movzx r9d, bx
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20a
or rcx, rax
movzx eax, di
mov rdx, r13
mov qword [rsp + 0x20], rcx
lea rcx, [0x0050b280]
or r9, rax
call fcn.00453210
mov eax, dword [rsi + 0x48]
mov dword [rsi + 0x48], 0
cdq
xor eax, edx
sub eax, edx
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret