joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42acb0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov qword [rcx + 0x2978], rax
movzx eax, word [rsp + 0x98]
mov qword [rsp + 0x50], rsi
mov rbx, rcx
mov dword [rcx + 0x28e8], 1
mov dword [rcx + 0x2974], 2
mov word [rcx + 0x2980], ax
mov qword [rsp + 0x48], rdi
mov ecx, 0x14
mov qword [rsp + 0x40], r12
mov edi, r9d
movzx esi, dx
mov r12, r8
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
mov bp, ax
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
and r11d, 1
mov dword [rbx + 0x28e4], r11d
je 0x42ad46
test edi, edi
jne 0x42ad46
mov dword [rbx + 0x28e4], edi
mov ecx, dword [rbx + 0x28e0]
test ecx, ecx
jne 0x42ad5a
test edi, edi
jne 0x42ad5a
cmp si, 0xd
je 0x42ada8
movzx eax, si
add eax, 0xffffffa5
cmp eax, 2
jbe 0x42ada8
cmp dword [rbx + 0x59a0], 0
je 0x42ada8
cmp ecx, 0x100
je 0x42ada8
mov edx, dword [rbx + 0x28e4]
mov dword [rsp + 0x30], 1
lea rcx, [rbx + 0x28c0]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edx
mov r9d, edi
movzx edx, si
mov r8, r12
call fcn.0042a840
mov eax, 1
jmp 0x42adaa
xor eax, eax
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x42b120
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x288
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rsi, rcx
mov qword [r11 - 0x28], r12
add rcx, 0x28c0
mov qword [r11 - 0x30], r13
mov ebx, r9d
mov r12d, r8d
movzx edi, dx
call fcn.0042abb0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
mov r13d, eax
call fcn.004a8900
lea rcx, [rbx + rbx*2 + 0x29a]
add rcx, rcx
lea rdx, [rsp + 0x30]
mov r8d, 0x104
mov ecx, dword [rsi + rcx*8]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
lea rcx, [rsi + 0x28c0]
movzx edx, di
call fcn.0042abb0
test eax, eax
jle 0x42b1c8
test r12d, r12d
je 0x42b1c1
add dword [rsi + 0x5988], 1
jmp 0x42b1c8
add dword [rsi + 0x5988], 0xffffffff
mov rbp, qword [rsp + 0x278]
test r13d, r13d
mov r13, qword [rsp + 0x258]
je 0x42b2c0
cmp word [rsp + 0x30], 0
je 0x42b30e
lea rdi, [0x004ebd34]
mov eax, 0x7b
xor ebx, ebx
nop
nop
mov rdx, qword [rsi + 0x5990]
mov rcx, qword [rsi + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rdi + 2]
add rdi, 2
test eax, eax
jne 0x42b200
movzx eax, word [rsp + 0x30]
lea rdi, [rsp + 0x30]
test eax, eax
je 0x42b26e
nop
mov rdx, qword [rsi + 0x5990]
mov rcx, qword [rsi + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rdi + 2]
add rdi, 2
test eax, eax
jne 0x42b240
lea rax, str._DN
cmp r12d, 1
lea rdi, str._UP
cmove rdi, rax
movzx eax, word [rdi]
test eax, eax
je 0x42b30e
nop
mov rdx, qword [rsi + 0x5990]
mov rcx, qword [rsi + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rdi + 2]
add rdi, 2
test eax, eax
jne 0x42b290
jmp 0x42b30e
cmp r12d, 1
jne 0x42b30e
movzx eax, word [rsp + 0x30]
lea rdi, [rsp + 0x30]
test eax, eax
je 0x42b30e
xor ebx, ebx
nop
nop
nop
mov rdx, qword [rsi + 0x5990]
mov rcx, qword [rsi + 0x5998]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rdi + 2]
add rdi, 2
test eax, eax
jne 0x42b2e0
mov r12, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x268]
mov rsi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x288
ret
Function at 0x431b60
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x438
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x420], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x431c9e
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x431c9e
lea rdx, str.Netscape
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
je 0x431bd7
mov eax, 1
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x438
ret
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x431bba
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x431bba
lea rdx, str.Opera
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x431bba
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x431bba
call fcn.0049ede0
test rax, rax
je 0x431c9e
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x431c9e
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x431bba
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x438
ret
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x438
ret
Function at 0x435850
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [r11 - 8], rbx
mov rbx, qword [0x005271d0]
mov qword [r11 - 0x10], rsi
test rbx, rbx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15d, r9d
mov r12d, r8d
movsxd r13, edx
mov r14, rcx
je 0x4358b9
mov rcx, qword [rbx]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x43590b
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x4358a0
xor eax, eax
mov r15, qword [rsp + 0x240]
mov r14, qword [rsp + 0x248]
mov r13, qword [rsp + 0x250]
mov r12, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x278
ret
mov rsi, qword [rbx]
test rsi, rsi
je 0x4358b9
lea rcx, str.OmgBJMainWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
test rax, rax
mov rdi, rax
jne 0x43596f
lea rcx, str.WinDVDClass
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x43596c
lea rdx, [0x004ec918]
lea rcx, [rsp + 0x20]
call fcn.004a8fa0
test rax, rax
jne 0x43596f
mov rdi, rbx
cmp dword [rsp + 0x2a0], ebx
je 0x4359d6
mov ecx, r12d
sub ecx, 0x1f
je 0x4359a6
sub ecx, 1
je 0x43599f
sub ecx, 1
je 0x435998
cmp ecx, 1
jne 0x4358b9
lea ebx, [rcx + 3]
jmp 0x4359b3
mov ebx, 6
jmp 0x4359b3
mov ebx, 8
jmp 0x4359b3
cmp dword [rsi + 0x790], 2
sete bl
add ebx, 2
test rdi, rdi
mov dword [rsi + 0x790], ebx
mov dword [rsi + 0x740], 2
je 0x4359e5
mov r8d, r12d
mov rdx, rdi
mov rcx, r14
call fcn.00431e10
test rdi, rdi
je 0x4359e5
mov eax, 1
jmp 0x4358bb
mov r9d, dword [rsp + 0x2a0]
mov r8d, r15d
mov edx, r13d
mov rcx, r14
call fcn.00431ea0
jmp 0x4358bb
Function at 0x436ec0
Capabilities:
Find taskbar

Disassembly:
mov rax, rsp
sub rsp, 0x148
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
mov qword [rsp + 0x20], rcx
mov dword [rcx + 8], 2
lea rax, [0x004ed228]
mov qword [rcx], rax
mov edi, 0x200
mov eax, SafeArrayAllocDescriptor
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.004a5e00
test rax, rax
je 0x436f5b
lea edx, [rdi - 1]
lea rcx, [rax + 8]
xor ebx, ebx
nop
mov dword [rcx - 8], ebx
mov dword [rcx - 4], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov dword [rcx + 0x10], ebx
add rcx, 0x20
sub edx, 1
jns 0x436f40
jmp 0x436f60
xor ebx, ebx
mov rax, rbx
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x58], ebx
mov dword [rbp + 0x5c], edi
lea rax, [0x004ed110]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp + 0xa4], 1
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
mov dword [rbp + 0xa0], ebx
lea rax, [0x004ed1e0]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rbp + 0xf8]
call fcn.004275b0
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x437021
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp + 0x18], rax
mov r8d, 0x80
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x30]
lea rdi, str.Button
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
je 0x437025
mov qword [rbp + 0x18], rbx
jmp 0x437025
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x10], rbx
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x70], eax
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x74], eax
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, eax
mov eax, dword [rbp + 0x70]
lea ecx, [rdx + rax - 1]
mov dword [rbp + 0x78], ecx
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [rbp + 0x74]
lea edx, [rax + rcx - 1]
mov dword [rbp + 0x7c], edx
mov dword [rbp + 0x54], ebx
mov dword [rbp + 0x4c], 0x4b
mov dword [rbp + 0x48], 0x1f4
mov dword [rbp + 0x50], ebx
mov dword [rbp + 0x3c], ebx
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x44], ebx
mov dword [rbp + 0x68], ebx
mov dword [rbp + 0x6c], ebx
mov dword [rbp + 0x80], ebx
mov dword [rbp + 0x38], ebx
mov rax, rbp
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
ret
Function at 0x438f20
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
sub rsp, 0x138
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.00438d90
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x438fd8
lea rcx, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
nop
nop
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x438fc0
jmp 0x4390b4
mov dword [rsp + 0x20], 0
mov r9, qword [rsi + 8]
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.00476a20
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x439017
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.0042cc70
cmp qword [rax + 0x20], 8
jb 0x439038
mov rdx, qword [rax + 8]
jmp 0x43903c
lea rdx, [rax + 8]
sub rdx, rbx
nop
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x439053
add rbx, 2
test eax, eax
jne 0x439040
test ecx, ecx
setne bl
cmp qword [rsp + 0x60], 8
jb 0x43906a
mov rcx, qword [rsp + 0x48]
call fcn.004a6f90
test bl, bl
je 0x4390a7
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
cmp r8, 8
cmovae rcx, r9
movzx eax, word [rcx]
mov word [rdi], ax
add rcx, 2
add rdi, 2
test ax, ax
jne 0x439092
jmp 0x4390b4
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x70]
cmp r8, 8
jb 0x4390c2
mov rcx, r9
call fcn.004a6f90
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
add rsp, 0x138
ret
Function at 0x4393f0
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
xor ebx, ebx
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov ecx, dword [rcx + 0x59a4]
test ecx, ecx
mov ebp, edx
mov eax, ebx
jne 0x43942a
cmp dword [rdi + 0x59a0], ebx
jne 0x43942a
cmp dword [rdi + 0x599c], ebx
je 0x439509
test ecx, ecx
mov qword [rsp + 0x60], rsi
je 0x43946f
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x12]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x439449
mov esi, eax
shl esi, 0x10
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28c0]
mov r8d, esi
mov r9d, ebp
mov dx, 0x12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.0042a840
cmp dword [rdi + 0x59a0], ebx
je 0x4394b3
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x43948d
mov esi, eax
shl esi, 0x10
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28c0]
mov r8d, esi
mov r9d, ebp
mov dx, 0x11
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.0042a840
cmp dword [rdi + 0x599c], ebx
je 0x4394fd
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x4394d1
mov esi, eax
shl esi, 0x10
mov edx, dword [rdi + 0x599c]
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28c0]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edx
mov r8d, esi
mov dx, 0x10
mov r9d, ebp
call fcn.0042a840
mov rsi, qword [rsp + 0x60]
test eax, eax
setne bl
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x439830
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
sub rsp, 0x138
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x68]
call fcn.00438d90
nop
mov edx, dword [rsi + 0x28f0]
test edx, edx
jne 0x4398e8
lea rcx, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x28f4]
nop
nop
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x4398d0
jmp 0x4399c4
mov dword [rsp + 0x20], 0
mov r9, qword [rsi + 8]
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.00476a20
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x439927
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x28f4]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.0042cc70
cmp qword [rax + 0x20], 8
jb 0x439948
mov rdx, qword [rax + 8]
jmp 0x43994c
lea rdx, [rax + 8]
sub rdx, rbx
nop
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x439963
add rbx, 2
test eax, eax
jne 0x439950
test ecx, ecx
setne bl
cmp qword [rsp + 0x60], 8
jb 0x43997a
mov rcx, qword [rsp + 0x48]
call fcn.004a6f90
test bl, bl
je 0x4399b7
mov dword [rsi + 0x28f0], 0
lea rcx, [rsp + 0x70]
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
cmp r8, 8
cmovae rcx, r9
movzx eax, word [rcx]
mov word [rdi], ax
add rcx, 2
add rdi, 2
test ax, ax
jne 0x4399a2
jmp 0x4399c4
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x70]
cmp r8, 8
jb 0x4399d2
mov rcx, r9
call fcn.004a6f90
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
add rsp, 0x138
ret
Function at 0x448470
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], r12
xor r12d, r12d
cmp dword [rcx + 0x1e8], r12d
mov esi, r9d
mov rbp, r8
mov edi, edx
mov rbx, rcx
je 0x448529
test edx, edx
jne 0x448529
mov rdx, rcx
mov rcx, qword [0x00526530]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x1e8], r12d
mov dword [rbx + 0x1ec], r12d
mov dword [rbx + 0x258], r12d
mov qword [0x005260f8], r12
cmp dword [rbx + 0x1f4], r12d
je 0x448518
mov rcx, qword [rbx + 0x10]
call fcn.0040fe40
test al, 0x40
jne 0x448529
mov rcx, qword [rbx + 0x10]
call fcn.0040fe40
test al, 0x40
jne 0x44850a
mov rax, qword [rbx]
lea edx, [rdi + 1]
mov rcx, rbx
call qword [rax + 0xa0]
mov rcx, qword [0x00527cb0]
call fcn.0047a550
jmp 0x448529
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0xa0]
mov eax, dword [rbx + 0x24]
test al, 0x40
je 0x448532
neg edi
mov edx, dword [rbx + 0x30]
shr edx, 3
and edx, 1
test al, al
jns 0x448549
test edx, edx
mov eax, r12d
sete al
mov edx, eax
mov rcx, qword [rbx + 0x38]
mov r8d, dword [rbx + 0x40]
mov dword [rsp + 0x38], esi
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov r9d, edi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call qword [rax + 0x48]
cmp dword [rbx + 0x1e8], 0
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov edi, eax
je 0x4485e9
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4485b9
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4485b9
mov ecx, SafeArrayAllocDescriptor
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4485e9
mov ecx, SafeArrayAllocDescriptor
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4485d3
mov dword [0x005264b8], 1
mov rcx, rbx
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
jmp fcn.004477d0
test edi, edi
je 0x4485fc
cmp edi, 1
jle 0x44860d
cmp edi, 3
jle 0x4485d3
cmp edi, 4
jne 0x44860d
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0xa0]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x451c80
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
xorps xmm2, xmm2
lea rbx, [r8 - 1]
movss xmm0, dword [rbx + 0x2b0]
comiss xmm0, xmm2
jbe 0x451d2f
cmp dword [rbx + 0x2b8], 0
je 0x451cb1
addss xmm0, dword [0x004eeac4]
jmp 0x451cb9
subss xmm0, dword [0x004eeac4]
ucomiss xmm0, xmm2
movss dword [rbx + 0x2b0], xmm0
movaps xmm1, xmm0
jp 0x451ccb
je 0x451d0c
movzx eax, byte [rbx + 0x84]
mov rcx, qword [0x00526530]
mov edx, 0x202020
mov r9d, 3
cvtsi2ss xmm0, eax
mulss xmm0, xmm1
divss xmm0, dword [rbx + 0x2b4]
cvttss2si r8, xmm0
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x00526530]
call qword [sym.imp.USER32.dll_BringWindowToTop]
movss xmm0, dword [rbx + 0x2b0]
ucomiss xmm0, dword [rbx + 0x2b4]
jp 0x451d8b
jne 0x451d8b
mov dword [rbx + 0x2b8], 0
add rsp, 0x20
pop rbx
ret
mov rdx, r8
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x2a0], 1
mov dword [rbx + 0x1c], 0
mov rcx, qword [0x00526530]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x00526530]
lea r9, [0x00450470]
mov r8d, 0x3e8
mov rdx, rbx
mov qword [0x00526348], 0
mov qword [0x00526350], 0
call qword [sym.imp.USER32.dll_SetTimer]
add rsp, 0x20
pop rbx
ret
Function at 0x4573e0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x290
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
lea rdx, [rcx + 0x58]
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], 0
mov word [rsp + 0x48], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.00402570
nop
mov r8d, 4
lea rdx, str..syn
lea rcx, [rsp + 0x40]
call fcn.00406450
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea r8, str.w__ccsUNICODE
lea rcx, [rsp + 0x30]
call fcn.004ac4d0
cmp qword [rsp + 0x30], 0
je 0x457561
test eax, eax
jne 0x457561
lea rax, str.Overwrite
mov qword [rsp + 0x28], rax
lea rax, [0x004eef98]
mov qword [rsp + 0x20], rax
lea r9, str.Version
lea r8, str._s_s_n_s1_n
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.004aa800
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.004ac250
cmp qword [rbx + 0x28], 8
jb 0x4574e0
mov r9, qword [rbx + 0x10]
jmp 0x4574e4
lea r9, [rbx + 0x10]
lea r8, str.Description
lea rdx, [0x004ef278]
mov rcx, qword [rsp + 0x30]
call fcn.004ac020
lea r11, str.SoftwareSynapticsScrybe
mov qword [rsp + 0x20], r11
lea r9, str.SoftwareSynaptics
mov r8, 0xffffffff80000001
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call fcn.004560e0
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call fcn.004ac1b0
test ebx, ebx
jne 0x45754b
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp qword [rsp + 0x60], 8
jb 0x45755d
mov rcx, qword [rsp + 0x48]
call fcn.004a6f90
mov eax, ebx
jmp 0x457575
cmp qword [rsp + 0x60], 8
jb 0x457573
mov rcx, qword [rsp + 0x48]
call fcn.004a6f90
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x290
pop rbx
ret

Function at 0x4575b0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x58
lea rdx, [rcx + 0x58]
lea r8, str..syn
lea rcx, [rsp + 0x20]
call fcn.00456f10
cmp qword [rax + 0x20], 8
jb 0x4575d6
mov rcx, qword [rax + 8]
jmp 0x4575da
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [rsp + 0x40], 8
jb 0x4575f2
mov rcx, qword [rsp + 0x28]
call fcn.004a6f90
add rsp, 0x58
ret

Function at 0x457600
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rdx, [rcx + 0x58]
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], 0
mov word [rsp + 0x30], 0
mov r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x28]
call fcn.00402570
nop
mov r8d, 4
lea rdx, str..syn
lea rcx, [rsp + 0x28]
call fcn.00406450
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
cmp qword [rsp + 0x48], 8
jb 0x457694
mov rcx, qword [rsp + 0x30]
call fcn.004a6f90
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x60
pop rbx
ret