joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473090
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov qword [r11 - 8], r12
mov rdi, rcx
mov rcx, qword [rdx]
mov r12, r8
mov rbp, rdx
mov rax, qword [rcx]
lea r8, [r11 - 0x20]
mov edx, 0x10000301
mov qword [r11 - 0x10], r13
call qword [rax + 0x18]
mov rbx, qword [0x005271d0]
xor r13d, r13d
test rbx, rbx
je 0x4730fd
movsxd rsi, dword [rsp + 0x38]
nop
mov rcx, qword [rbx]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x473225
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x4730e0
mov rax, r13
mov rcx, qword [rax + 0x58]
lea rsi, [rax + 0x50]
mov dword [rsp + 0x30], r13d
test rcx, rcx
je 0x473129
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x30], 5
je 0x473156
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x34], r13d
test rcx, rcx
je 0x47329f
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 4
jne 0x47329f
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000312
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 0x16
test r11b, 1
jne 0x47329b
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
test byte [rsp + 0x34], 1
jne 0x47329b
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 1
test r11b, 1
jne 0x47329b
mov rcx, qword [r12]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 2
test r11b, 1
jne 0x47329f
mov rcx, qword [rbp]
lea r8, [rsp + 0x34]
mov edx, 0x10000314
mov rax, qword [rcx]
call qword [rax + 0x18]
mov r11d, dword [rsp + 0x34]
shr r11d, 2
test r11b, 1
je 0x47329f
add dword [rdi + 0x60], 1
cmp dword [rdi + 0x60], 1
jne 0x47322d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x64], eax
jmp 0x47329f
mov rax, qword [rbx]
jmp 0x473100
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 0x5dc
cmp eax, dword [rdi + 0x64]
jae 0x473248
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x64], eax
jmp 0x473258
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x60], 1
mov dword [rdi + 0x64], eax
cmp dword [rdi + 0x60], 3
jne 0x47329f
lea rcx, str.SynTPLpr
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
mov rbx, rax
je 0x47329b
mov rcx, rsi
call fcn.0040be90
lea rcx, [0x00526380]
mov r8d, 0x4e4
mov rdx, rbx
movzx r9d, al
mov qword [rsp + 0x20], r13
call fcn.004618c0
mov dword [rdi + 0x60], r13d
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x474f00
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 8], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor edi, edi
mov dword [rsp + 0x38], edi
mov rcx, qword [0x00527140]
mov rax, qword [rcx]
lea r8, [r11 - 0x40]
mov edx, 0x10000006
call qword [rax + 0x30]
cmp dword [rsp + 0x38], edi
jle 0x474f59
lea eax, [rdi + 1]
jmp 0x4750c3
mov dword [rsp + 0x30], 0xffffffff
mov ebx, edi
mov rcx, qword [0x00527140]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + 0x20]
test eax, eax
jne 0x4750c1
lea rbp, vtable.h.0
lea rsi, method.h.virtual_0
mov qword [rsp + 0x48], rdi
mov eax, dword [0x00526114]
test al, 1
jne 0x474fb7
or eax, 1
mov dword [0x00526114], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00526110], eax
jmp 0x474fbd
mov eax, dword [0x00526110]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x474fe3
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x00526110]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
lea r9, [0x004eae00]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov qword [rsp + 0x40], rbp
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edx, dword [rsp + 0x30]
call qword [rax + 0x78]
test eax, eax
jne 0x47506b
mov dword [rsp + 0x34], edi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x475070
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000107
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 0xf
jne 0x47506b
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x475088
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x475088
mov rcx, qword [rsp + 0x48]
add ebx, 1
cmp ebx, 1
jg 0x4750aa
mov qword [rsp + 0x40], rsi
test rcx, rcx
je 0x475088
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x00527140]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor edx, edx
lea r8d, [rdx + 2]
call qword [rax + 0x20]
test eax, eax
je 0x474f91
jmp 0x4750c1
mov qword [rsp + 0x40], rsi
test rcx, rcx
je 0x4750ba
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 1
jmp 0x4750c3
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x475120
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov eax, dword [rcx + 8]
test al, 2
je 0x47516c
test al, 1
je 0x47516c
call fcn.00474f00
test eax, eax
je 0x47516c
mov eax, 1
jmp 0x475320
mov eax, dword [rbx + 8]
test al, 0x20
je 0x47531e
test al, 0x10
je 0x47531e
mov dword [rsp + 0x30], 0xffffffff
mov rcx, qword [0x00527140]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x47531e
xor ebx, ebx
lea rsi, vtable.h.0
lea rdi, method.h.virtual_0
nop
nop
nop
mov qword [rsp + 0x48], rbx
mov eax, dword [0x00526114]
test al, 1
jne 0x4751e6
or eax, 1
mov dword [0x00526114], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x00526110], eax
jmp 0x4751ec
mov eax, dword [0x00526110]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x475212
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov edx, 1
mov ecx, dword [0x00526110]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x58]
lea rcx, str.SynCom.PointingDevice
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
lea r11, [rsp + 0x48]
mov qword [rsp + 0x20], r11
lea r9, [0x004eae00]
xor edx, edx
lea r8d, [rdx + 0x15]
lea rcx, [rsp + 0x58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov edx, dword [rsp + 0x30]
call qword [rax + 0x78]
test eax, eax
jne 0x4752cd
mov dword [rsp + 0x38], ebx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x475288
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x38], 1
je 0x475302
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], ebx
test rcx, rcx
je 0x4752ad
mov rax, qword [rcx]
lea r8, [rsp + 0x3c]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x3c], 3
je 0x475302
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x34], ebx
test rcx, rcx
je 0x4752d2
mov rax, qword [rcx]
lea r8, [rsp + 0x34]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x34], 6
je 0x475302
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rdi
test rcx, rcx
je 0x4752e2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x00527140]
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x47531e
jmp 0x4751c0
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x475317
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 1
jmp 0x475320
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
add rsp, 0x78
ret
Function at 0x475750
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov ecx, dword [rcx + 8]
xor r9d, r9d
test cl, 2
je 0x475781
mov eax, ecx
and eax, 1
cmp edx, eax
je 0x475781
test edx, edx
setne r9b
and ecx, 0xfffffffe
or r9d, ecx
mov dword [r8 + 8], r9d
mov r9d, 1
mov ecx, dword [r8 + 8]
test cl, 0x20
je 0x4757b2
mov eax, ecx
shr eax, 4
and eax, 1
cmp edx, eax
je 0x4757b2
neg edx
sbb eax, eax
and ecx, 0xffffffef
and eax, 0x10
or eax, ecx
mov rcx, r8
mov dword [r8 + 8], eax
add rsp, 0x28
jmp fcn.00475370
test r9d, r9d
je 0x4757bf
mov rcx, r8
call fcn.00475370
add rsp, 0x28
ret
Function at 0x4788a0
Capabilities:
Enumerate process modules

Disassembly:
mov r11, rsp
sub rsp, 0x3d8
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x3a0], rax
mov qword [r11 + 0x20], rbx
mov rcx, rdx
xor ebx, ebx
mov qword [r11 - 0x18], rdi
lea rdx, [rsp + 0x20]
mov rdi, r8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], ebx
jne 0x4788ed
xor eax, eax
jmp 0x478ad7
lea rcx, [rsp + 0x280]
mov dword [rsp + 0x280], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4788e6
mov eax, dword [rsp + 0x290]
mov qword [rsp + 0x3d0], rbp
mov qword [rsp + 0x3c8], rsi
cmp eax, 2
mov qword [rsp + 0x3b8], r12
mov qword [rsp + 0x3b0], r13
jne 0x47899f
mov r8d, dword [rsp + 0x20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
mov rsi, rax
je 0x478aa8
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x47898f
mov rdx, qword [rsp + 0x28]
mov r9d, 0x104
mov r8, rdi
mov rcx, rsi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
mov ebx, eax
jne 0x47898f
mov word [rdi], ax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x478ab7
cmp eax, 1
jne 0x478ab5
lea rcx, [0x004f22e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rsi, rax
je 0x478ab5
lea rdx, [0x004f22c8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rsi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov r12, rax
je 0x478aac
test r13, r13
je 0x478aac
test rbx, rbx
je 0x478aac
xor edx, edx
lea ecx, [rdx + 2]
call rbx
cmp rax, 0xffffffffffffffff
mov rbp, rax
je 0x478aac
lea rdx, [rsp + 0x40]
mov rcx, rax
mov dword [rsp + 0x40], 0x238
call r13
test eax, eax
mov ebx, eax
je 0x478a96
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x48], eax
je 0x478a67
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov dword [rsp + 0x40], 0x238
call r12
test eax, eax
mov ebx, eax
jne 0x478a42
jmp 0x478a96
lea rax, [rsp + 0x6c]
lea rcx, [rsp + 0x6c]
sub rdi, rax
nop
nop
nop
movzx eax, word [rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 2], ax
jne 0x478a80
mov ebx, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
jmp 0x478ab7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov r12, qword [rsp + 0x3b8]
mov rsi, qword [rsp + 0x3c8]
mov rbp, qword [rsp + 0x3d0]
mov r13, qword [rsp + 0x3b0]
mov rdi, qword [rsp + 0x3c0]
mov rbx, qword [rsp + 0x3f8]
mov rcx, qword [rsp + 0x3a0]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x3d8
ret
Function at 0x47a550
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x48]
test rcx, rcx
je 0x47a588
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8460
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbx + 0x48], 0
mov dword [rbx + 0x28], 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov dword [rbx + 0x28], 0xffffffff
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbx + 0x38], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x40], eax
add rsp, 0x20
pop rbx
ret
Function at 0x48a8f0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
sub rsp, 0x248
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [r11 + 0x18], rbx
mov rbx, rdx
mov qword [r11 + 0x20], rsi
mov rsi, rcx
mov edx, 0x40a
mov rcx, rbx
mov qword [r11 - 8], rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
test rax, rax
je 0x48a96e
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsi + 0x28c0]
call fcn.00416fd0
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x208
call fcn.004a8900
mov edx, 0x40c
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, qword [rsp + 0x260]
test rax, rax
je 0x48a9d8
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsi + 0x28c8]
call fcn.00416fd0
mov rdi, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x248
ret
Function at 0x48ace0
Capabilities:
Check if file exists

Disassembly:
mov r11, rsp
sub rsp, 0x2f8
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rbx, rcx
mov rbp, rdx
lea rcx, [rsp + 0x20]
mov r8d, 0x98
xor edx, edx
mov qword [r11 - 0x10], rdi
call fcn.004a8900
xor edi, edi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
lea rax, [0x004f3610]
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x98
mov qword [rsp + 0x28], rbp
mov word [rsp + 0xc0], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x58], 0x208
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x80], 0x1800
call qword [sym.imp.comdlg32.dll_GetOpenFileNameW]
cmp eax, 1
jne 0x48ade5
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x2f0], rsi
test rdx, rdx
je 0x48adb2
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx - 1]
lea rcx, [rbx + 0x28c0]
mov r8d, edi
call fcn.00416fd0
mov rcx, qword [rbx + 0x28c0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rsi, qword [rsp + 0x2f0]
test eax, eax
je 0x48ade5
mov rdx, rbp
mov rcx, rbx
call fcn.0048a820
mov rdi, qword [rsp + 0x2e8]
mov rbp, qword [rsp + 0x318]
mov rbx, qword [rsp + 0x310]
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x2f8
ret
Function at 0x48cf80
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov rsi, rcx
lea rcx, [rax - 0x20]
mov qword [rax - 0x18], r14
mov r12d, r8d
mov r13, rdx
xor ebp, ebp
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, dword [rsi + 0xc]
mov r14d, 0xffff8001
imul ebx, dword [rsi + 0x58]
cmp ebx, 0x7fff
jle 0x48cfd0
mov ebx, 0x7fff
jmp 0x48cfd7
cmp ebx, r14d
cmovl ebx, r14d
mov qword [rsp + 0x88], rdi
mov eax, r12d
mov edi, r12d
shr edi, 2
and eax, 0x30000
and r12d, 0xc0000
and edi, 0x400000
mov ecx, 0x10
or edi, eax
shr edi, 2
or edi, r12d
shr edi, 0xe
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r12, qword [rsp + 0x60]
test ax, ax
jns 0x48d029
mov eax, ebx
cdq
and edx, 7
lea ebx, [rdx + rax]
sar ebx, 3
or edi, 4
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x48d04a
mov eax, ebx
mov ebp, 1
cdq
sub eax, edx
sar eax, 1
or edi, 8
mov ebx, eax
mov ecx, dword [rsi + 0x34]
test cl, 2
jne 0x48d089
test ebp, ebp
jne 0x48d076
lea eax, [rbx + rbx*2]
add eax, eax
cdq
idiv dword [rsi + 0x5c]
cmp eax, 0x7fff
mov ebx, eax
jle 0x48d06f
mov ebx, 0x7fff
jmp 0x48d076
cmp eax, r14d
cmovl ebx, r14d
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jge 0x48d089
xor eax, eax
jmp 0x48d142
test edi, edi
je 0x48d092
test cl, 4
jne 0x48d0fb
test cl, 1
jne 0x48d0fb
bt ecx, 0xd
jae 0x48d0a7
call fcn.0049de50
cmp eax, 9
jge 0x48d0fb
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x48]
movzx r9d, bx
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20a
or rcx, rax
movzx eax, di
mov rdx, r13
or r9, rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xc8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
lea rcx, [0x00526380]
call fcn.00461bf0
jmp 0x48d133
movzx ecx, word [rsp + 0x4c]
movzx eax, word [rsp + 0x48]
movzx r9d, bx
shl ecx, 0x10
shl r9d, 0x10
mov r8d, 0x20a
or rcx, rax
movzx eax, di
mov rdx, r13
mov qword [rsp + 0x20], rcx
lea rcx, [0x00526380]
or r9, rax
call fcn.004618c0
mov eax, dword [rsi + 0x58]
mov dword [rsi + 0x58], 0
cdq
xor eax, edx
sub eax, edx
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x491dd0
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x2048
call fcn.004e39b0
sub rsp, rax
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov qword [rsp + 0x2040], rbp
mov qword [rsp + 0x2038], rsi
mov qword [rsp + 0x2030], rdi
xor edi, edi
mov qword [rsp + 0x2068], rbx
mov rbp, r8
mov rsi, rdx
nop
nop
nop
lea rdx, [0x004f227c]
mov rcx, rbp
call fcn.004ac4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x491e55
test rbx, rbx
jne 0x491e8f
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
cmp edi, 0x3c
jl 0x491e20
xor eax, eax
mov rdi, qword [rsp + 0x2030]
mov rsi, qword [rsp + 0x2038]
mov rbp, qword [rsp + 0x2040]
mov rbx, qword [rsp + 0x2068]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x2048
ret
mov rcx, rbx
call fcn.004ac800
test eax, eax
jne 0x491edc
nop
nop
mov rcx, rbx
call fcn.004ac840
test eax, eax
jne 0x491edc
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.004acc70
test rax, rax
je 0x491edc
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.004ac250
mov rcx, rbx
call fcn.004ac800
test eax, eax
je 0x491ea0
lea rdx, str.End_KTL_Section_n
mov rcx, rsi
call fcn.004ac020
mov rcx, rsi
call fcn.004ae170
mov rcx, rbx
call fcn.004ac1b0
mov eax, 1
jmp 0x491e57

Function at 0x491f10
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x2048
call fcn.004e39b0
sub rsp, rax
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov qword [rsp + 0x2040], rbp
mov qword [rsp + 0x2038], rsi
mov qword [rsp + 0x2030], rdi
xor edi, edi
mov qword [rsp + 0x2068], rbx
mov rbp, r8
mov rsi, rdx
nop
nop
nop
lea rdx, [0x004f227c]
mov rcx, rbp
call fcn.004ac4c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x491f95
test rbx, rbx
jne 0x491fcf
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
add edi, 1
cmp edi, 0x3c
jl 0x491f60
xor eax, eax
mov rdi, qword [rsp + 0x2030]
mov rsi, qword [rsp + 0x2038]
mov rbp, qword [rsp + 0x2040]
mov rbx, qword [rsp + 0x2068]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x2048
ret
mov rcx, rbx
call fcn.004ac800
test eax, eax
jne 0x49201c
nop
nop
mov rcx, rbx
call fcn.004ac840
test eax, eax
jne 0x49201c
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x1000
call fcn.004acc70
test rax, rax
je 0x49201c
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.004ac250
mov rcx, rbx
call fcn.004ac800
test eax, eax
je 0x491fe0
mov rcx, rsi
call fcn.004ae170
mov rcx, rbx
call fcn.004ac1b0
mov eax, 1
jmp 0x491f97
Function at 0x4924c0
Capabilities:
Delete file

Disassembly:
mov eax, 0x2078
call fcn.004e39b0
sub rsp, rax
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov qword [rsp + 0x2070], rbx
mov qword [rsp + 0x2068], rbp
mov qword [rsp + 0x2060], rsi
mov qword [rsp + 0x2058], rdi
mov qword [rsp + 0x2050], r12
mov r12, qword [rsp + 0x20a8]
mov qword [rsp + 0x2048], r13
mov r13, rdx
mov edx, dword [rsp + 0x20a0]
sub edx, 2
mov qword [rsp + 0x2040], r14
mov r14, qword [rsp + 0x20b0]
mov rbx, r9
mov esi, r8d
mov rbp, rcx
je 0x492616
cmp edx, 1
jne 0x49267e
cmp r8d, 0xc
jne 0x49267e
mov rcx, r13
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test r12, r12
mov edi, eax
je 0x49267e
test rbx, rbx
je 0x49267e
test eax, eax
je 0x49267e
mov ecx, dword [rbx]
xor r10d, r10d
xor eax, eax
xor edx, edx
test ecx, ecx
je 0x4925a4
cmp ecx, edi
je 0x49259d
mov ecx, dword [rbx + rdx*4 + 8]
add rdx, 2
add eax, 2
test ecx, ecx
jne 0x492588
jmp 0x4925a4
cdqe
mov r10d, dword [rbx + rax*4 + 4]
lea r8, [rsp + 0x30]
mov r9d, 0x1000
mov edx, r10d
mov rcx, r12
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x49260c
lea r9, [0x0048fe40]
mov r8, r13
mov edx, 0xaa
mov rcx, r12
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rdi, rax
call fcn.00477180
test eax, eax
je 0x4925f4
mov rcx, rdi
call fcn.00476090
lea r8, [rsp + 0x30]
mov r9, r14
mov edx, 0x401
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x49267e
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x49267e
xor eax, eax
lea rdi, [rbp + 0x418]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x49263f
lea rcx, [rbp + 0x418]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea rdi, [rbp + 0x620]
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x492668
lea rcx, [rbp + 0x620]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, str.Mouse.hlp
mov r9, rbx
mov r8d, esi
mov rcx, r13
call qword [sym.imp.USER32.dll_WinHelpW]
mov r14, qword [rsp + 0x2040]
mov r13, qword [rsp + 0x2048]
mov r12, qword [rsp + 0x2050]
mov rdi, qword [rsp + 0x2058]
mov rsi, qword [rsp + 0x2060]
mov rbp, qword [rsp + 0x2068]
mov rbx, qword [rsp + 0x2070]
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.004a7100
add rsp, 0x2078
ret
Function at 0x49d2a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rsi
xor ebx, ebx
test r9, r9
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov r13, rdx
mov rdi, r9
mov rsi, r8
mov ebp, ebx
je 0x49d2d2
mov ebp, dword [r9]
test rdx, rdx
je 0x49d3a1
test r8, r8
je 0x49d3a1
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x49d393
cmp qword [rsp + 0x90], rbx
mov qword [rsp + 0x30], rcx
je 0x49d32a
mov rdx, qword [rsp + 0x90]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d393
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x78]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r13
mov dword [rsp + 0x78], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp qword [rsp + 0x90], rbx
mov r13d, eax
je 0x49d36d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r13d, r13d
jne 0x49d393
mov eax, dword [rsp + 0x88]
cmp eax, 4
je 0x49d38a
cmp eax, 3
jne 0x49d38f
cmp dword [rsp + 0x78], 4
jne 0x49d38f
mov ebx, 1
mov eax, ebx
jmp 0x49d3a3
test rdi, rdi
je 0x49d3a1
mov dword [rsi], ebp
mov eax, 1
jmp 0x49d3a3
xor eax, eax
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x68
ret