joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a458
Capabilities:
Get file system object information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rsi
push rdi
sub rsp, 0x310
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
and dword [rax + 8], 0
mov rdx, r8
mov rcx, rbx
call fcn.004021f8
mov dword [rsp + 0x330], 1
mov rcx, qword [rsi + 0x1b0]
mov rax, qword [rcx]
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x340]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
mov r9, qword [rdi + 0x48]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x18]
test eax, eax
js 0x47a528
mov dword [rsp + 0x20], 0x208
mov r9d, 0x2b8
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x340]
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test rax, rax
je 0x47a513
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rsp + rcx*2 + 0x5e]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.00406d38
mov rcx, qword [rsi + 0x1a8]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x340]
call qword [rax + 0x28]
mov rax, rbx
add rsp, 0x310
pop rdi
pop rsi
pop rbx
ret
Function at 0x47a8f4
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x80
mov rsi, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x30]
lea rcx, [rax - 0x40]
call fcn.006aba40
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x113e
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 4
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rbx, rbx
and rbx, qword [rsp + 0x70]
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x47a962
cmp eax, 5
jne 0x47a9af
and dword [rsp + 0x38], 0
mov rcx, qword [rbx + 0x48]
and qword [rsp + 0x30], 0
movzx ebp, word [rcx]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
xor r8d, r8d
xor edx, edx
sub ebp, 0x41
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x47aa75
mov eax, dword [rsp + 0x90]
movsxd rcx, ebp
mov dword [rdi + rcx*4 + 0x140], eax
mov rcx, qword [rbx + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47a9f9
test al, 0x10
je 0x47a9f9
mov rcx, qword [rdi + 8]
mov r9, rsi
mov edx, 0x110a
mov r8d, 4
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x47aaa6
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.004793ec
jmp 0x47aaa6
mov rdx, qword [rdi + 0x108]
cmp rsi, rdx
jne 0x47aa15
xor r8d, r8d
mov rcx, rdi
call fcn.00479194
jmp 0x47aaa6
cmp rsi, qword [rdi + 0x100]
je 0x47aa68
cmp qword [rbx + 0xa0], 0
jne 0x47aa68
mov rcx, qword [rdi + 8]
mov r9, rsi
mov edx, 0x110a
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 8]
mov r9, rsi
xor r8d, r8d
mov edx, 0x1101
mov rbx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.0047a87c
jmp 0x47aaa6
mov rdx, rsi
mov rcx, rdi
call fcn.0047ac60
jmp 0x47aaa6
movsxd rax, ebp
mov r9, rsi
mov edx, 0x1102
or dword [rdi + rax*4 + 0x140], 0xffffffff
mov rcx, qword [rdi + 8]
mov r8d, 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8b, 1
mov rdx, rsi
mov rcx, rdi
call fcn.0047b3a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x47b44c
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [r8 + 0x60]
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rax - 0x38]
call fcn.006aba40
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0x98], 4
lea r9, [rsp + 0x98]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rbx, rbx
and rbx, qword [rsp + 0xc8]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.004021f8
nop
mov rax, qword [rbp + 0x60]
cmp rax, qword [rdi + 0x100]
je 0x47b5cc
cmp qword [rbx + 0xa0], 0
jne 0x47b5cc
cmp rax, qword [rdi + 0x108]
je 0x47b5cc
mov rdx, qword [rsp + 0x80]
mov rax, rdx
mov rcx, qword [rsp + 0x88]
sub rax, rcx
and rax, 0xfffffffffffffffe
cmp rax, 6
jne 0x47b531
cmp word [rcx + 2], 0x3a
jne 0x47b531
cmp word [rcx + 4], 0x5c
je 0x47b5dc
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47b5cc
mov r9, qword [rbp + 0x60]
mov edx, 0x110a
mov r8d, 3
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
mov r9, qword [rbp + 0x60]
xor r8d, r8d
mov edx, 0x1101
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.0047a87c
and dword [rsi], 0
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x47b5bd
test rcx, rcx
je 0x47b5bd
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x47b5b8
call fcn.006a4944
jmp 0x47b5bd
call fcn.006a3610
movabs rax, 1
jmp 0x47b668
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
and rdx, 0xfffffffffffffffe
cmp rdx, 6
jne 0x47b631
cmp word [rcx + 2], 0x3a
jne 0x47b631
cmp word [rcx + 4], 0x5c
jne 0x47b631
movzx eax, word [rcx]
sub eax, 0x41
cdqe
lea r9, [rdi + rax*4 + 0x140]
and dword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov rcx, qword [rsp + 0x88]
and dword [rsi], 0
lea rax, [rsp + 0x40]
cmp rcx, rax
je 0x47b666
test rcx, rcx
je 0x47b666
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x47b661
call fcn.006a4944
jmp 0x47b666
call fcn.006a3610
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x47e62c
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x70
lea rbp, [rsp + 0x20]
mov rcx, qword [rcx + 8]
mov qword [rbp + 0x78], rbx
movzx ebx, r8w
mov edx, ebx
mov qword [rbp + 0x88], rsi
mov rsi, r9
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r12, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rcx, r8d
add rcx, rcx
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x47e681
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.006e5e00
sub rsp, rax
mov rcx, r12
lea rdi, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rbp + 0x80]
lea rcx, [rbp]
mov rdx, rdi
call fcn.004023b4
movzx eax, word [rdi]
xor r12d, r12d
mov r11, rdi
mov rcx, rdi
cmp ax, r12w
je 0x47e71c
mov r8d, 0x3eb
add r11, 2
cmp ax, 0x24
je 0x47e712
cmp ax, 0x7c
je 0x47e712
cmp bx, r8w
je 0x47e6e5
cmp ax, 0x20
je 0x47e712
mov edx, 0x3e9
cmp bx, dx
je 0x47e6ff
cmp bx, r8w
je 0x47e6ff
mov edx, 0x46e
cmp bx, dx
jne 0x47e70b
cmp ax, 0x3c
je 0x47e712
cmp ax, 0x3e
je 0x47e712
mov word [rcx], ax
add rcx, 2
mov ax, word [r11]
cmp ax, r12w
jne 0x47e6c9
mov word [rcx], r12w
lea rcx, [rbp]
mov rdx, rdi
call fcn.004205f4
cmp al, r12b
jne 0x47e7a1
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x80]
mov edx, 0xb0
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov r11d, dword [rbp + 0x80]
cmp r11d, r12d
jle 0x47e76c
dec r11d
mov dword [rbp + 0x80], r11d
mov eax, dword [rbp + 0x70]
cmp eax, r12d
jle 0x47e779
dec eax
mov dword [rbp + 0x70], eax
movsxd r9, eax
movsxd r8, r11d
mov edx, 0xb1
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xb7
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp + 0x48]
lea rax, [rbp]
cmp rcx, rax
je 0x47e7d5
cmp rcx, r12
je 0x47e7d5
mov rdx, qword [rbp]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x47e7d0
call fcn.006a4944
jmp 0x47e7d5
call fcn.006a3610
mov rbx, qword [rbp + 0x78]
mov rsi, qword [rbp + 0x88]
movabs rax, 1
lea rsp, [rbp + 0x50]
pop r12
pop rdi
pop rbp
ret

Function at 0x47f79c
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov eax, 0x632
cmp r8w, ax
sete r8b
lea rdx, [rsp + 0x28]
call fcn.0047fa44
mov rbx, rax
mov rcx, qword [0x008669d0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x47f7e2
mov rcx, rbx
call fcn.0055cb24
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x47f819
test rcx, rcx
je 0x47f819
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x47f814
call fcn.006a4944
jmp 0x47f819
call fcn.006a3610
xor eax, eax
add rsp, 0x80
pop rbx
ret
Function at 0x480abc
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x480b03
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
mov r9, qword [rcx + 0x10]
mov r8d, dword [rcx + 8]
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_CallWindowProcW]
cmp byte [rsi + 0xd2], 0
je 0x480c2f
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
movsxd rdi, eax
mov eax, 2
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0xc0], rax
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r8, [rsp + 0xb0]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.004023b4
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.00480474
nop
lea rax, [rsp + 0x50]
mov edi, 0x100
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x480bb7
test rcx, rcx
je 0x480bb7
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x480bb2
call fcn.006a4944
jmp 0x480bb7
call fcn.006a3610
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_HideCaret]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, qword [rsp + 0x40]
sub rcx, qword [rsp + 0x38]
test rcx, 0xfffffffffffffff0
je 0x480bee
mov r8, rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.004808bc
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_ShowCaret]
mov byte [rsi + 0xd0], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x480c27
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, rdi
jbe 0x480c21
call fcn.006a4944
jmp 0x480c27
call fcn.006a3610
nop
mov rcx, rbx
call fcn.006a5088
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x480c44
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rsi, rdx
mov rdi, rcx
and dword [rsp + 0x60], 0
mov rax, r8
shr rax, 0x20
movzx r9d, ax
shl r9d, 0x10
movzx eax, r8w
or r9, rax
xor r8d, r8d
mov edx, 0xd7
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
movsx r12, ax
test r12d, r12d
jns 0x480cb1
lea rdx, [0x0085e850]
mov rcx, rsi
call fcn.004021f8
mov rax, rsi
jmp 0x480d90
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
inc eax
movsxd rbp, eax
mov eax, 2
mul rbp
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0x78], rax
mov r8d, ebp
mov rdx, rax
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rdi + 0xb8], r12
mov qword [rdi + 0xc0], r12
test r12d, r12d
je 0x480d2d
mov rax, qword [rdi + 0xb8]
movzx ecx, word [rbx + rax*2 - 2]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
je 0x480d2d
add qword [rdi + 0xb8], r13
cmp qword [rdi + 0xb8], 0
ja 0x480d06
dec rbp
cmp qword [rdi + 0xc0], rbp
jae 0x480d5f
mov rax, qword [rdi + 0xc0]
movzx ecx, word [rbx + rax*2 + 2]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
je 0x480d5f
inc qword [rdi + 0xc0]
cmp qword [rdi + 0xc0], rbp
jb 0x480d39
mov rax, qword [rdi + 0xb8]
mov r8, qword [rdi + 0xc0]
sub r8, rax
inc r8
lea rdx, [rbx + rax*2]
lea r9, [rsp + 0x60]
mov rcx, rsi
call fcn.0042100c
nop
mov rcx, rbx
call fcn.006a5088
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x48e6b0
Capabilities:
Get graphical window text

Disassembly:
push rdi
mov eax, 0x3580
call fcn.006e5e00
sub rsp, rax
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov qword [rsp + 0x3598], rbx
mov qword [rsp + 0x35a0], rsi
mov dil, dl
mov rbx, rcx
mov rdx, qword [rcx + 0x7b8]
add rdx, 0x340
mov rcx, qword [0x00862c98]
call fcn.005c7d60
test rax, rax
jne 0x48e96a
lea rcx, [rsp + 0x2b0]
call fcn.00473254
nop
mov r8d, 0xff
lea rdx, [rsp + 0xb0]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rbx + 0x7c0]
lea rax, [rsp + 0x2e0]
cmp rdx, rax
je 0x48e753
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x2e0]
call fcn.0040289c
lea r8, [rsp + 0x3590]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.004023b4
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.00402190
nop
lea rcx, [rsp + 0x2b0]
cmp rax, rcx
je 0x48e7a1
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
lea rcx, [rsp + 0x2b0]
call fcn.0040289c
nop
lea rax, [rsp + 0x20]
mov esi, 0x100
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x48e7d4
test rcx, rcx
je 0x48e7d4
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
cmp rdx, rsi
jbe 0x48e7ce
call fcn.006a4944
jmp 0x48e7d4
call fcn.006a3610
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x48e80b
test rcx, rcx
je 0x48e80b
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rsi
jbe 0x48e806
call fcn.006a4944
jmp 0x48e80b
call fcn.006a3610
lea r8, [rsp + 0x3590]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x50]
call fcn.004023b4
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.00402190
nop
lea rcx, [rsp + 0x310]
cmp rax, rcx
je 0x48e859
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x28]
lea rcx, [rsp + 0x310]
call fcn.0040289c
nop
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
je 0x48e887
test rcx, rcx
je 0x48e887
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
cmp rdx, rsi
jbe 0x48e881
call fcn.006a4944
jmp 0x48e887
call fcn.006a3610
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x48e8be
test rcx, rcx
je 0x48e8be
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rsi
jbe 0x48e8b9
call fcn.006a4944
jmp 0x48e8be
call fcn.006a3610
mov rdx, qword [rbx + 0x7b8]
add rdx, 0xe8
lea rax, [rsp + 0x29f8]
cmp rdx, rax
je 0x48e8ee
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x29f8]
call fcn.0040289c
mov byte [rsp + 0x3273], 1
mov rdx, qword [rbx + 0x7b8]
add rdx, 0xb8
lea rax, [rsp + 0x340]
cmp rdx, rax
je 0x48e926
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x340]
call fcn.0040289c
mov byte [rsp + 0x3a0], dil
lea rdx, [rsp + 0x2b0]
mov rcx, qword [0x00862c98]
call fcn.005c1510
mov r9b, 1
mov r8d, 3
lea rdx, [0x0086b260]
mov rcx, rbx
call fcn.004983bc
nop
lea rcx, [rsp + 0x2b0]
call fcn.004732f8
jmp 0x48e982
mov r9b, 1
mov r8d, 3
lea rdx, [0x0086b2b0]
mov rcx, rbx
call fcn.004983bc
lea r11, [rsp + 0x3580]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x48e998
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0xb0
mov qword [rsp + 0x50], 0xfffffffffffffffe
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
lea r9, [rsp + 0x20]
mov qword [rsp + 0x48], r9
mov byte [rsp + 0x20], 0
movzx edx, r8w
sub edx, 0x78
je 0x48ea76
sub edx, 1
je 0x48ea46
sub edx, 0xcd
je 0x48ea19
cmp edx, 1
jne 0x48eb3b
mov rdx, qword [rcx + 0x7b8]
add rdx, 0x88
lea rax, [rsp + 0x20]
cmp rdx, rax
je 0x48eb3b
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x20]
call fcn.0040289c
jmp 0x48eab7
mov rdx, qword [rcx + 0x7b8]
add rdx, 0x58
lea rax, [rsp + 0x20]
cmp rdx, rax
je 0x48eb3b
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x20]
call fcn.0040289c
jmp 0x48eab7
mov rdx, qword [rcx + 0x7b8]
add rdx, 0x340
lea rax, [rsp + 0x20]
cmp rdx, rax
je 0x48eb3b
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x20]
call fcn.0040289c
jmp 0x48eab7
mov rcx, qword [rcx + 0x7b8]
lea rdx, [rcx + 0x370]
mov rax, qword [rdx + 0x28]
cmp rax, qword [rdx + 0x20]
lea rax, [rcx + 0x340]
cmove rdx, rax
lea rax, [rsp + 0x20]
cmp rdx, rax
je 0x48eb3b
mov r8, qword [rdx + 0x20]
mov rdx, qword [rdx + 0x28]
lea rcx, [rsp + 0x20]
call fcn.0040289c
mov r9, qword [rsp + 0x48]
cmp r9, qword [rsp + 0x40]
je 0x48eb3b
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.00401f00
mov rbx, rax
mov rcx, qword [0x008669d0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x48eaef
mov rcx, rbx
call fcn.0055cb24
nop
lea rax, [rsp + 0x58]
mov rcx, qword [rsp + 0xa0]
cmp rcx, rax
je 0x48eb36
test rcx, rcx
je 0x48eb36
mov rax, qword [rsp + 0x58]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x48eb2a
call fcn.006a4944
mov r9, qword [rsp + 0x48]
jmp 0x48eb3b
call fcn.006a3610
mov r9, qword [rsp + 0x48]
jmp 0x48eb3b
mov r9, qword [rsp + 0x48]
lea rax, [rsp + 0x20]
cmp r9, rax
je 0x48eb6d
test r9, r9
je 0x48eb6d
mov rdx, qword [rsp + 0x20]
sub rdx, r9
cmp rdx, 0x100
jbe 0x48eb65
mov rcx, r9
call fcn.006a4944
jmp 0x48eb6d
mov rcx, r9
call fcn.006a3610
xor eax, eax
add rsp, 0xb0
pop rbx
ret
Function at 0x49b400
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
cmp word [r8 + 0x18], 9
mov rbx, r8
mov rdi, rcx
jne 0x49b422
call fcn.00494920
jmp 0x49b4d2
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jbe 0x49b4d2
cmp word [rbx + 0x18], 0x4d
jne 0x49b4d2
mov rcx, qword [rdi + 0x1450]
mov r9d, 2
or r8, 0xffffffffffffffff
mov edx, 0x100c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
jmp 0x49b4cd
xor edx, edx
lea rcx, [rsp + 0x24]
lea r8d, [rdx + 0x44]
call fcn.006aba40
mov rcx, qword [rdi + 0x1450]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x104b
mov dword [rsp + 0x24], ebx
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x48]
add rcx, 0x10
call fcn.00548810
mov rcx, qword [rdi + 0x1450]
movsxd r8, ebx
mov edx, 0x100c
mov r9d, 2
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49b467
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x4a4bc0
Capabilities:
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx + 0x40]
sub rcx, qword [rdx + 0x48]
sar rcx, 1
lea rcx, [rcx*4 + 1]
call fcn.006a43c4
mov rbx, rax
mov qword [rsp + 0xe0], rax
mov rax, qword [rsi + 0x40]
mov r8, qword [rsi + 0x48]
sub rax, r8
sar rax, 1
lea eax, [rax*4 + 1]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0x5182
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r11, qword [rdi + 0xa0]
test r11, r11
je 0x4a4c50
mov rdx, rbx
mov rcx, qword [rdi + 8]
call r11
jmp 0x4a4cac
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.00420f08
nop
lea rcx, [rdi + 0x40]
mov r8, rax
lea rdx, [rsp + 0x48]
call fcn.004a4e6c
nop
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0xa8]
cmp rcx, rax
je 0x4a4cac
test rcx, rcx
je 0x4a4cac
mov rax, qword [rsp + 0x60]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, 0x100
jbe 0x4a4ca6
call fcn.006a4944
jmp 0x4a4cac
call fcn.006a3610
nop
lea rdx, [rdi + 0x10]
mov r9d, 3
mov r8d, 0xc0000000
lea rcx, [rsp + 0x48]
call fcn.005944d4
nop
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
or edx, 0xffffffff
cmp eax, edx
jne 0x4a4cf3
lea rcx, [rsp + 0xd0]
call fcn.00594950
mov rdx, rax
jmp 0x4a4d03
mov edx, dword [rsp + 0xd0]
shl rdx, 0x20
mov eax, eax
or rdx, rax
mov rax, rdx
sar rax, 0x20
mov dword [rsp + 0xd8], eax
xor r9d, r9d
lea r8, [rsp + 0xd8]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.00594b34
mov r8d, 1
lea rdx, [0x00799bf8]
lea rcx, [rsp + 0x50]
call fcn.00594b34
nop
lea rax, [0x007955b8]
mov qword [rsp + 0x48], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
call fcn.0059492c
nop
jmp 0x4a4d8b
mov rcx, rbx
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
jmp fcn.006a5088

Function at 0x4a5814
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2f0
mov rsi, rcx
mov dil, r8b
mov rbx, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x2b8
call fcn.006aba40
mov rcx, qword [rbx + 0x48]
neg dil
sbb eax, eax
lea r8, [rsp + 0x30]
mov r9d, 0x2b8
and eax, 2
xor edx, edx
add eax, 0x4001
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8d, dword [rsp + 0x38]
mov rdx, rax
mov rcx, rsi
call fcn.004a56e0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x4a5890
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2f0
mov rsi, rcx
mov bl, r8b
mov rdi, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x2b8
call fcn.006aba40
neg bl
lea r8, [rsp + 0x30]
sbb eax, eax
mov r9d, 0x2b8
mov rcx, rdi
and eax, 2
xor edx, edx
add eax, 0x4009
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov r8d, dword [rsp + 0x38]
mov rdx, rax
mov rcx, rsi
call fcn.004a56e0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x4ad624
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov eax, r8d
mov rbp, rdx
mov r14d, 1
shr eax, 4
mov ebx, r8d
mov rsi, rcx
add ax, r14w
lea r8d, [r14 + 5]
mov rcx, rbp
movzx edx, ax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r13d, r13d
mov r12, rax
cmp rax, r13
je 0x4ad79a
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp rax, r13
je 0x4ad79a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rax, r13
je 0x4ad79a
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x4ad6d0
cmp rdi, r11
jae 0x4ad79a
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x4ad6ba
cmp rdi, r11
jae 0x4ad79a
cmp word [rdi], r13w
je 0x4ad79a
mov rax, qword [rsi]
movzx ebx, word [rdi]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x4ad702
mov edx, ebx
mov rcx, rsi
call fcn.004a87a4
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x4ad723
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, r14d
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.006a6bd0
cmp eax, r13d
je 0x4ad772
cmp eax, 0xc
je 0x4ad767
cmp eax, 0x16
je 0x4ad75c
cmp eax, 0x22
je 0x4ad75c
cmp eax, 0x50
je 0x4ad772
mov ecx, 0x80004005
call fcn.00401c88
int3
mov ecx, 0x80070057
call fcn.00401c88
int3
mov ecx, 0x8007000e
call fcn.00401c88
int3
cmp ebx, r13d
jl 0x4ad78f
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x4ad78f
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, r14d
mov word [rdi + rcx], r13w
jmp 0x4ad79c
mov ecx, 0x80070057
call fcn.00401c88
int3
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret