joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid
adc byte [rbx], ch
jnp 0x14001ad0d
movabs al, byte [0xec024616d2a410bf]
test al, 0x80
jle 0x14001acdc
invalid
movabs rdi, 0xbda6b7bcbba11db9
fadd qword [rdi + 0x7af033bd]
jg 0x14001acdd
and dword [rcx - 0x4f], eax
jmp 0x14001acdc
mov r9b, 0xeb
retf
Function at 0x140001000
Capabilities:
Connect socket
Initialize winsock library
Receive data
Receive data on socket
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, 1
mov ebx, 2
mov ecx, ebx
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test rax, rax
je 0x140001099
lea rcx, str.127.0.0.1
mov word [rsp + 0x20], bx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x7e7
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x22], ax
nop dword [rax]
nop word [rax + rax]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140001080
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
nop word [rax + rax]
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1400010b0
mov r8d, 6
lea rdx, str._EXIT_
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x1400010b0
or ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x46bbe0
Capabilities:
Create process on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov eax, dword [0x005877f8]
cmp eax, 0xffffffff
jne 0x46bce7
mov r8d, 0x68
mov edx, 0
lea rcx, [0x00c6b360]
call sub.msvcrt.dll_memset
mov dword [0x00c6b360], 0x68
mov r8d, 0x18
mov edx, 0
lea rcx, [0x00c6b3d0]
call sub.msvcrt.dll_memset
lea rax, [0x00c6b3d0]
mov qword [rsp + 0x48], rax
lea rax, [0x00c6b360]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.cmd.exe__c_ver
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
setne al
test al, al
je 0x46bcdd
mov rax, qword [0x00c6b3d0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [0x00c6b3d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x00c6b3d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov dword [0x005877f8], 1
jmp 0x46bce7
mov dword [0x005877f8], 0
mov eax, dword [0x005877f8]
add rsp, 0x50
pop rbp
ret
Function at 0x47e426
Capabilities:
Get file size

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov dword [rbp + 0x10], ecx
mov ecx, dword [rbp + 0x10]
call fcn.0047dff2
test eax, eax
sete al
test al, al
je 0x47e44e
mov rax, 0xfffffffffffffffe
jmp 0x47e4fd
mov rdx, qword [0x007230b0]
mov eax, dword [rbp + 0x10]
cdqe
imul rax, rax, 0x88
add rax, rdx
mov qword [0x00c845d8], rax
mov rax, qword [0x00c845d8]
movzx eax, byte [rax + 0x80]
test al, al
je 0x47e486
mov rax, 0xfffffffffffffffc
jmp 0x47e4fd
mov rdx, qword [0x007230a8]
mov eax, dword [rbp + 0x10]
cdqe
shl rax, 3
add rax, rdx
mov qword [0x00c845e0], rax
lea rdx, [0x00c845ec]
mov rax, qword [0x00c845e0]
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov edx, eax
lea rax, [0x00c845e8]
mov dword [rax], edx
mov rax, qword [0x00c845e8]
mov edx, eax
mov eax, 0xffffffff
cmp rdx, rax
jne 0x47e4f6
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
setne al
test al, al
je 0x47e4f6
mov rax, 0xfffffffffffffffd
jmp 0x47e4fd
mov rax, qword [0x00c845e8]
add rsp, 0x20
pop rbp
ret
Function at 0x47fe54
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov ecx, dword [rbp + 0x10]
call fcn.0047dff2
test eax, eax
sete al
test al, al
je 0x47fe86
mov eax, 0xfffffffe
jmp 0x48001d
mov rdx, qword [0x007230b0]
mov eax, dword [rbp + 0x10]
cdqe
imul rax, rax, 0x88
add rax, rdx
mov qword [0x00c846c0], rax
mov rax, qword [0x00c846c0]
movzx eax, byte [rax + 0xa]
test al, al
jne 0x47febc
mov eax, 0xfffffffd
jmp 0x48001d
cmp qword [rbp + 0x28], 0
jns 0x47fecd
mov eax, 0xfffffffc
jmp 0x48001d
cmp qword [rbp + 0x18], 0xffffffffffffffff
je 0x47ff03
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, dword [rbp + 0x10]
call fcn.0047fce8
mov dword [0x00c846c8], eax
mov eax, dword [0x00c846c8]
test eax, eax
setne al
test al, al
je 0x47ff03
mov eax, dword [0x00c846c8]
jmp 0x48001d
mov rdx, qword [0x007230a8]
mov eax, dword [rbp + 0x10]
cdqe
shl rax, 3
add rax, rdx
mov qword [0x00c846d0], rax
cmp qword [rbp + 0x28], 0
je 0x480018
mov eax, 0xffffffff
cmp qword [rbp + 0x28], rax
jle 0x47ff4d
mov dword [0x00c846d8], 0xffffffff
movabs rax, 0xffffffff00000001
add qword [rbp + 0x28], rax
jmp 0x47ff5f
mov rax, qword [rbp + 0x28]
mov dword [0x00c846d8], eax
mov qword [rbp + 0x28], 0
mov ecx, dword [0x00c846d8]
mov rax, qword [0x00c846d0]
mov rax, qword [rax]
mov rdx, qword [rbp + 0x20]
mov qword [rsp + 0x20], 0
lea r9, [0x00c846e0]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
sete al
test al, al
je 0x47ffce
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [0x00c846b8], eax
mov eax, dword [0x00c846b8]
cmp eax, 5
je 0x47ffc0
mov eax, dword [0x00c846b8]
cmp eax, 0x21
jne 0x47ffc7
mov eax, 0xfffffff9
jmp 0x48001d
mov eax, 0xfffffff7
jmp 0x48001d
mov rax, qword [0x00c846e0]
add qword [rbp + 0x20], rax
mov rax, qword [0x00c846c0]
mov rcx, qword [rax + 0x10]
mov rdx, qword [0x00c846e0]
mov rax, qword [0x00c846c0]
add rdx, rcx
mov qword [rax + 0x10], rdx
mov eax, dword [0x00c846d8]
mov edx, eax
mov rax, qword [0x00c846e0]
cmp rdx, rax
je 0x47ff1d
mov eax, 0xffffffff
jmp 0x48001d
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x48002b
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov qword [0x00c58b98], 0
mov ecx, dword [rbp + 0x10]
call fcn.0047dff2
test eax, eax
sete al
test al, al
je 0x480068
mov eax, 0xfffffffe
jmp 0x480268
mov rdx, qword [0x007230b0]
mov eax, dword [rbp + 0x10]
cdqe
imul rax, rax, 0x88
add rax, rdx
mov qword [0x00c846f0], rax
mov rax, qword [0x00c846f0]
movzx eax, byte [rax + 9]
test al, al
jne 0x48009e
mov eax, 0xfffffffd
jmp 0x480268
cmp qword [rbp + 0x28], 0
jns 0x4800af
mov eax, 0xfffffffc
jmp 0x480268
cmp qword [rbp + 0x18], 0xffffffffffffffff
je 0x4800e5
mov rax, qword [rbp + 0x18]
mov rdx, rax
mov ecx, dword [rbp + 0x10]
call fcn.0047fce8
mov dword [0x00c846f8], eax
mov eax, dword [0x00c846f8]
test eax, eax
setne al
test al, al
je 0x4800e5
mov eax, dword [0x00c846f8]
jmp 0x480268
mov rdx, qword [0x007230a8]
mov eax, dword [rbp + 0x10]
cdqe
shl rax, 3
add rax, rdx
mov qword [0x00c84700], rax
cmp qword [rbp + 0x28], 0
je 0x480258
mov eax, 0xffffffff
cmp qword [rbp + 0x28], rax
jle 0x48012f
mov dword [0x00c84708], 0xffffffff
movabs rax, 0xffffffff00000001
add qword [rbp + 0x28], rax
jmp 0x480141
mov rax, qword [rbp + 0x28]
mov dword [0x00c84708], eax
mov qword [rbp + 0x28], 0
mov ecx, dword [0x00c84708]
mov rdx, qword [rbp + 0x20]
mov rax, qword [0x00c84700]
mov rax, qword [rax]
mov qword [rsp + 0x20], 0
lea r9, [0x00c84710]
mov r8d, ecx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
call rax
test eax, eax
setne al
test al, al
je 0x480225
mov rax, qword [rbp + 0x20]
mov rdx, qword [0x00c84710]
add rax, rdx
mov qword [rbp + 0x20], rax
mov rax, qword [0x00c846f0]
mov rcx, qword [rax + 0x10]
mov rdx, qword [0x00c84710]
mov rax, qword [0x00c846f0]
add rdx, rcx
mov qword [rax + 0x10], rdx
mov rdx, qword [0x00c58b98]
mov rax, qword [0x00c84710]
add rax, rdx
mov qword [0x00c58b98], rax
mov eax, dword [0x00c84708]
mov edx, eax
mov rax, qword [0x00c84710]
cmp rdx, rax
je 0x4800ff
mov eax, dword [0x00c84708]
mov edx, eax
mov rax, qword [0x00c84710]
sub rdx, rax
mov rax, qword [rbp + 0x28]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0x20]
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [0x00c846f0]
mov byte [rax + 0x19], 1
mov eax, 0xfffffff6
jmp 0x480268
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [0x00c846e8], eax
mov eax, dword [0x00c846e8]
cmp eax, 5
je 0x48024a
mov eax, dword [0x00c846e8]
cmp eax, 0x21
jne 0x480251
mov eax, 0xfffffff9
jmp 0x480268
mov eax, 0xfffffff7
jmp 0x480268
mov rax, qword [0x00c846f0]
mov byte [rax + 0x19], 0
mov eax, 0
add rsp, 0x30
pop rbp
ret
Function at 0x495e74
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x495ebd
mov ecx, 7
call fcn.0044495a
mov rax, qword [rbp - 0x18]
jmp 0x495f4f
mov eax, dword [rbp - 4]
mov rdx, qword [rbp - 0x10]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call rax
mov edx, eax
sub dword [rbp - 4], 1
mov eax, dword [rbp - 4]
cmp edx, eax
setne al
test al, al
je 0x495f10
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
mov edx, 1
mov ecx, 0
call fcn.004463c2
mov qword [rbp - 0x18], rax
mov ecx, 0x33
call fcn.0044495a
mov rax, qword [rbp - 0x18]
jmp 0x495f4f
mov eax, dword [rbp - 4]
mov edx, 1
mov ecx, eax
call fcn.004463c2
mov qword [rbp - 0x20], rax
mov eax, dword [rbp - 4]
movsxd rcx, eax
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
mov rdx, qword [rbp - 0x10]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x20]
add rsp, 0x40
pop rbp
ret
Function at 0x49dc5c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
neg eax
add rsp, 0x20
pop rbp
ret

Function at 0x49dc7b
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 0x91
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
neg eax
add rsp, 0x20
pop rbp
ret

Function at 0x49dc9a
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov ecx, 0x90
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
neg eax
add rsp, 0x20
pop rbp
ret

Function at 0x49f060
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp edx, 0x66
mov rbx, rcx
ja case.0x49f082.20
lea r8, [0x005b6288]
mov ecx, edx
movsxd rax, dword [r8 + rcx*4]
add rax, r8
jmp rax
mov edx, 0x7f00
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f00
xor ecx, ecx
call rsi
movsxd r8, eax
mov rcx, qword [rbx]
mov edx, 0xfffffff4
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.USER32.dll_SetClassLongPtrA]
mov edx, 0x7f03
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f03
jmp 0x49f0a2
mov edx, 0x7f82
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f82
jmp 0x49f0a2
mov edx, 0x7f83
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f83
jmp 0x49f0a2
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursor]
xor r8d, r8d
jmp 0x49f0a9
mov edx, 0x7f89
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f89
jmp 0x49f0a2
mov edx, 0x7f01
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f01
jmp 0x49f0a2
mov edx, 0x7f02
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f02
jmp 0x49f0a2
mov edx, 0x7f84
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f84
jmp 0x49f0a2
mov edx, 0x7f86
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f86
jmp 0x49f0a2
mov edx, 0x7f8b
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f8b
jmp 0x49f0a2
mov edx, 0x7f85
xor ecx, ecx
mov rsi, qword [sym.imp.USER32.dll_LoadCursorA]
call rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov edx, 0x7f85
jmp 0x49f0a2
lea rcx, str.Unknown_cursor_type:__d
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.004a1bb0

Function at 0x49f260
Capabilities:
Write file on windows

Disassembly:
add rcx, 0x18
jmp fcn.0049f060
Function at 0x4a0830
Capabilities:
Query environment variable
Query or enumerate registry value
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rcx, str.GLUT_DIALS_SERIAL
call sub.msvcrt.dll_getenv
test rax, rax
je 0x4a09b0
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x74], 0
mov qword [rsp + 0x7c], 0
mov edx, 0xc0000000
mov qword [rsp + 0x84], 0
mov dword [rsp + 0x70], 0x1c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
test rax, rax
mov rbx, rax
je 0x4a0a24
mov ecx, 0x38
call sub.msvcrt.dll_malloc
mov ecx, 6
lea rbp, [rax + 8]
mov rsi, rax
xor eax, eax
lea rdx, [rsi + 0x1c]
mov rdi, rbp
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x70]
mov rcx, rbx
mov qword [rsi], rbx
call qword [sym.imp.KERNEL32.dll_GetCommState]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
lea rbp, [rsp + 0x50]
mov rdx, rdi
mov dword [rsp + 0x70], 0x1c
lea rcx, str.96_n_8_1
call qword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCommState]
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x60], 1
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov r9, rdi
mov rdx, rbp
mov rcx, qword [rsi]
mov r8d, 1
mov qword [0x00c87720], rsi
mov byte [rsp + 0x50], 0x20
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r8d, r8d
mov ecx, 0xa
lea rdx, [0x004a0600]
call fcn.0049e560
mov rax, qword [0x005d2990]
mov byte [rax + 0xb0], 1
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x4c], 0x100
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x50], 1
lea rdx, str.SOFTWAREFreeGLUT
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4a099a
lea rax, [rsp + 0x4c]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
lea rbx, [0x00c87620]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
lea rdx, str.DialboxSerialPort
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x4a0a40
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x4a0850
mov qword [0x00c87720], 0
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a099a

Function at 0x4a0aa0
Capabilities:
Query environment variable
Query or enumerate registry value
Write file on windows

Disassembly:
mov rax, qword [0x005d2990]
cmp byte [rax + 0xb0], 0
je 0x4a0ab1
ret
jmp fcn.004a0830
Function at 0x4a0b30
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
cmp byte [rcx + 0x1d0], 0
mov r13, rcx
mov r12, rdx
je 0x4a0b70
xor eax, eax
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.CurrentJoystickSettings
mov edx, 0x100
mov rsi, qword [sym.imp.msvcrt.dll__snprintf]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rbp, [rsp + 0x48]
lea rax, [rcx + 0x70]
mov rcx, rbx
lea r9, str.SystemCurrentControlSetControlMediaResourcesJoystick
mov qword [rsp + 0x20], rax
lea r8, str._s_s_s
call rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rdx, rbx
mov rcx, 0xffffffff80000002
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rdi
test eax, eax
jne 0x4a0b52
mov eax, dword [r13 + 0x1c8]
lea rdx, str.OEMName
mov rcx, rbx
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x20], rdx
lea r15, [rsp + 0x44]
mov edx, 0x100
lea r8, str.Joystick_d_s
lea r9d, [rax + 1]
call rsi
lea r10, [rsp + 0x150]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r10
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r10
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov qword [rsp + 0x28], r15
call r14
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x34], eax
mov r13, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call r13
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x4a0b52
mov r10, qword [rsp + 0x38]
lea r9, str.SystemCurrentControlSetControlMediaPropertiesPrivatePropertiesJoystickOEM
mov edx, 0x100
mov rcx, rbx
lea r8, str._s_s
mov qword [rsp + 0x20], r10
call rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov r9d, 1
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rdi
test eax, eax
jne 0x4a0b52
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x28], r15
lea rdx, str.OEMName
mov dword [rsp + 0x44], pe_nt_image_headers64
mov qword [rsp + 0x20], r12
call r14
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call r13
xor eax, eax
test ebx, ebx
sete al
jmp 0x4a0b54

Function at 0x4a1af0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ecx, 0xa0
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 1
call rsi
test ax, ax
js 0x4a1b1b
mov ecx, 0xa1
call rsi
movsx ebx, ax
shr ebx, 0x1f
mov ecx, 0xa2
call rsi
test ax, ax
jns 0x4a1b42
mov ecx, 0xa4
or ebx, 2
call rsi
test ax, ax
jns 0x4a1b60
or ebx, 4
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0xa3
call rsi
mov edx, ebx
mov ecx, 0xa4
or edx, 2
test ax, ax
cmovs ebx, edx
call rsi
test ax, ax
js 0x4a1b36
mov ecx, 0xa5
call rsi
mov edx, ebx
or edx, 4
test ax, ax
cmovs ebx, edx
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x4a1bb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x005d2990]
mov qword [rsp + 0x68], rdx
mov rsi, rcx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
cmp qword [rbx + 0xd0], 0
je 0x4a1bf5
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
call qword [rbx + 0xd0]
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x68]
mov ecx, 2
mov rdi, qword [fcn.004c4d80]
mov qword [rsp + 0x28], rax
call rdi
mov r8d, 9
mov edx, 1
lea rcx, str.freeglut
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbp, qword [rbx + 0xa0]
test rbp, rbp
je 0x4a1c4c
mov ecx, 2
call rdi
lea rdx, str.__s_:
mov r8, rbp
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rbp, qword [rsp + 0x28]
mov ecx, 2
call rdi
mov rdx, rsi
mov rcx, rax
mov r8, rbp
call sub.msvcrt.dll_vfprintf
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
cmp byte [rbx + 0x1c], 0
jne 0x4a1c8a
mov ecx, 1
call sub.msvcrt.dll_exit
call fcn.0049f800
jmp 0x4a1c80

Function at 0x4a1ca0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rbx, qword [0x005d2990]
mov qword [rsp + 0x58], rdx
mov rsi, rcx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
cmp qword [rbx + 0xd8], 0
je 0x4a1ce3
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
call qword [rbx + 0xd8]
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rax, [rsp + 0x58]
mov ecx, 2
mov rdi, qword [fcn.004c4d80]
mov qword [rsp + 0x28], rax
call rdi
mov r8d, 9
mov edx, 1
lea rcx, str.freeglut
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rbx + 0xa0]
test rbx, rbx
je 0x4a1d3a
mov ecx, 2
call rdi
lea rdx, str.__s_:
mov r8, rbx
mov rcx, rax
call sub.msvcrt.dll_fprintf
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call rdi
mov rdx, rsi
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
mov ecx, 2
call rdi
mov ecx, 0xa
mov rdx, rax
call sub.msvcrt.dll_fputc
nop
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret

Function at 0x4a7b80
Capabilities:
Hide graphical window

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x005d2990]
cmp byte [rsi + 0x1c], 0
je 0x4a7bc0
mov rbx, qword [0x005d29c0]
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x4a7be3
mov rcx, qword [rax + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rbx + 0x30]
mov byte [rax + 0x54], 0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rdx, str.glutHideWindow
lea rcx, [0x005b7bd8]
call fcn.004a1bb0
mov rbx, qword [0x005d29c0]
mov rax, qword [rbx + 0x30]
test rax, rax
jne 0x4a7ba3
cmp dword [rsi + 0x94], 2
je 0x4a7ba3
lea rdx, str.glutHideWindow
lea rcx, str._ERROR:__Function___s__called_with_no_current_window_defined.
call fcn.004a1bb0
mov rax, qword [rbx + 0x30]
jmp 0x4a7ba3