joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140146150
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rdx, str.c:program_filesDitto_
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
mov edi, 1
mov dword [rsp + 0x20], edi
call fcn.14016b090
test al, al
je 0x140146194
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
jmp 0x1401461b7
lea rcx, [rsp + 0x50]
call fcn.140168f40
nop
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rdx, str.Ditto.db
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
nop
lea r8, [rsp + 0x50]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140145040
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140146234
mov r9d, edi
mov r8, qword [rbx]
lea rdx, str._sDitto__d.db
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
inc edi
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140146201
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14014f450
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x438]
mov r9, rdx
mov edx, CMFCRibbonInfo::XImage::XImage
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [rsi + 8]
cmp eax, 0x100
jne 0x14014f5a9
mov rax, qword [rsi + 0x10]
cmp rax, 0x1b
jne 0x14014f4c6
lea ecx, [rax - 0xb]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
mov rcx, rbx
jae 0x14014f5ba
call fcn.14014f340
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, 0x53
jne 0x14014f551
lea ecx, [rax - 0x42]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14014f58f
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14014f508
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14014f58f
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
mov rcx, rbx
jae 0x14014f537
call fcn.14014f2d0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14014f2c0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, 0x4e
jne 0x14014f58f
lea ecx, [rax - 0x3d]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x14014f58f
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14014f587
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14014f58f
mov rcx, rbx
call fcn.14014f2b0
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sub.mfc140u.dll_CPreviewView::OnVScroll
cmp eax, 0x104
jne 0x14014f58f
cmp qword [rsi + 0x10], 0x73
jne 0x14014f58f
mov rcx, rbx
call fcn.14014eb20
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14014f690
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
xor r8d, r8d
mov rdx, qword [rcx]
lea rcx, [rsp + 0x60]
call fcn.14015a060
nop
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rdi, rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbx]
mov r8, qword [rsp + 0x60]
lea rdx, str.SetFocus___AppName:__s__Active:__d__Focus:__d
lea rcx, [rsp + 0x78]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, 0x7f
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x78]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
test rsi, rsi
je 0x14014f77e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rsi
je 0x14014f75d
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014f7a0
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rdi
sub rsp, 0x38
mov rdi, rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
mov r9, qword [rdi + 8]
mov r8, qword [rdi]
lea rdx, str.Activate_Target___Active:__d__Focus:__d
lea rcx, [rsp + 0x68]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, 0xaf
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14014f826
mov edx, 9
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [rsp + 0x50], 0
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, CDaoRecordset::IsFieldNullable
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, CDaoRecordset::IsFieldNullable
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
je 0x14014f8de
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, SetErrorInfo
mov r8, rax
xor edx, edx
lea rcx, str.Attach_to_process__calling_set_foreground_from_non_forground_window
call fcn.14015b6c0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov r8d, 1
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14014f8de
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
xor r8d, r8d
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x14014f8f0
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov rdx, qword [rdi]
lea rcx, [rsp + 0x58]
call fcn.14015a060
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
mov rcx, rax
call fcn.14016da70
test eax, eax
je 0x14014f92c
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
mov rcx, rdi
call fcn.14014f690
xor r9d, r9d
mov r8, qword [rsp + 0x50]
xor edx, edx
mov ecx, CDaoRecordset::IsFieldNullable
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14014f980
Capabilities:
Log keystrokes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, rcx
mov qword [rdx], 0xffffffffffffffff
mov rcx, qword [rcx]
mov rdi, rdx
mov esi, 0xffffffff
test rcx, rcx
je 0x14014faf0
xor edx, edx
mov dword [rsp + 0x30], 0x48
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14014fa11
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_CopyRect]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x14014fa11
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
mov qword [rdi], rcx
mov rcx, qword [r14 + 8]
call qword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [rdi], esi
je 0x14014fa1e
cmp dword [rdi + 4], esi
jne 0x14014faf0
cmp qword [r14 + 8], 0
je 0x14014faf0
cmp qword [r14], 0
je 0x14014faf0
mov qword [rsp + 0xc0], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [r14]
xor edx, edx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14014fac9
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetCaretPos]
test eax, eax
je 0x14014faa2
cmp dword [rdi], 0
je 0x14014faa2
cmp dword [rdi + 4], 0
je 0x14014faa2
mov rcx, qword [r14 + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rdi + 4]
test eax, eax
je 0x14014fa9b
cmp dword [rdi], 0
je 0x14014fa9b
lea esi, [rax + 0x14]
mov dword [rdi + 4], esi
jmp 0x14014faa9
mov dword [rdi], esi
mov dword [rdi + 4], esi
jmp 0x14014faa9
mov qword [rdi], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [r14]
xor edx, edx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0xc0]
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402654f0
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
mov rax, rdi
jmp 0x14014fad4

Function at 0x14014fc70
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.14015a800
test al, al
je 0x14014fc98
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14014f7a0
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140150800
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jge 0x140150858
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rsi
je 0x140150898
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call fcn.14014f7a0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, ebx
jl 0x140150831
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x78
mov r8, rax
xor edx, edx
lea rcx, str.Didnt_find_focus
call fcn.14015b6c0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
mov r8d, eax
lea rdx, str.found_focus_wait__d
lea rcx, [rsp + 0x20]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, WSACleanup
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
jmp 0x140150883
Function at 0x140152370
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x90
mov rsi, r8
mov rbx, rcx
mov r9d, edx
lea r8, str.SELECT_lID__mText_FROM_Main_WHERE_bIsGroup__1_AND_lParentID___d
lea rdx, [rsp + 0x68]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rsp + 0x68]
call fcn.1401437b0
test al, al
jne 0x14015250a
xor r14d, r14d
nop
lea rcx, [rsp + 0x68]
call fcn.1401437b0
test al, al
jne 0x14015250a
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rsp + 0x68]
call fcn.140144630
lea r8, [0x1402ac320]
lea rdx, str.mText
lea rcx, [rsp + 0x68]
cmp eax, dword [rbx + 0xec]
jne 0x14015245d
call fcn.1401446b0
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x22]
mov rcx, rbx
call sub.mfc140u.dll_CPaneContainerManager::GetVisiblePaneCount
mov rdi, rax
mov r9, rax
mov edx, 0x110b
mov r8d, 9
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140152499
call fcn.1401446b0
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, rax
lea edx, [r9 + 0x23]
mov rcx, rbx
call sub.mfc140u.dll_CPaneContainerManager::GetVisiblePaneCount
mov rdi, rax
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rsp + 0x68]
call fcn.140144630
cdqe
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8d, [r9 + 4]
mov rdx, rdi
mov rcx, rbx
call sub.mfc140u.dll_CPane::SetBorders
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rsp + 0x68]
call fcn.140144630
mov r8, rdi
mov edx, eax
mov rcx, rbx
call fcn.140152370
lea rcx, [rsp + 0x68]
call fcn.1401446f0
jmp 0x1401523c0
lea rcx, [rsp + 0x68]
call fcn.140143000
nop
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x140152530
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r9d, dword [0x1403c5674]
mov rbx, rcx
mov rcx, qword [rcx + 0x40]
xor r8d, r8d
mov edx, 0x111d
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [0x1403c5678]
xor r8d, r8d
mov rcx, qword [rbx + 0x40]
mov edx, 0x111e
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
mov r9, 0xffffffffffff0000
xor r8d, r8d
mov edx, reloc.mfc140u.dll_COleDocIPFrameWndEx::EnableAutoHidePanes
call qword [sym.imp.USER32.dll_SendMessageW]
xor esi, esi
mov qword [rsp + 0x48], 0xffffffffffff0002
mov qword [rsp + 0x40], 0xffffffffffff0000
lea r8, str._No_Group_
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
mov rcx, rbx
lea edx, [rsi + 1]
mov dword [rsp + 0x28], esi
mov byte [rbx + 0x120], 0
mov dword [rsp + 0x20], esi
call sub.mfc140u.dll_CPaneContainerManager::GetVisiblePaneCount
mov qword [rsp + 0x40], 0xffffffffffffffff
lea r8d, [rsi + 4]
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov dword [rsp + 0x30], esi
mov rdx, rax
mov dword [rsp + 0x28], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
mov rdi, rax
call sub.mfc140u.dll_CPane::SetBorders
mov qword [rsp + 0x40], rsi
lea r8d, [rsi + 8]
mov dword [rsp + 0x38], 0x20
xor r9d, r9d
mov dword [rsp + 0x30], 0x20
mov rdx, rdi
mov dword [rsp + 0x28], esi
mov rcx, rbx
mov dword [rsp + 0x20], esi
call sub.mfc140u.dll_CPane::SetBorders
cmp dword [rbx + 0xec], esi
jge 0x140152649
mov rcx, qword [rbx + 0x40]
lea r8d, [rsi + 9]
mov r9, rdi
mov edx, 0x110b
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, rdi
mov edx, 0xffffffff
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
jmp fcn.140152370
Function at 0x140153e50
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
lea rcx, [rsp + 0x68]
call fcn.14016aa70
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rcx, rax
lea rdx, [rsp + 0x58]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x140153f37
mov edx, 0xffffffff
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140153f37
mov ebx, dword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edx, eax
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov r9, rsi
mov r8d, ebp
mov edx, ebx
mov rcx, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x140153f2d
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
lea rdx, [0x1402c5770]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x140153f2d
cmp dword [rsp + 0x60], 0
jbe 0x140153f2d
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + 0x12]
mov dword [rdi], eax
movzx eax, word [rcx + 0x10]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0x16]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0x14]
mov dword [rdi + 0xc], eax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401573d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov eax, dword [rdx + 8]
mov rbx, rdx
sub eax, 0x20a
mov rsi, rcx
test eax, 0xfffffffb
jne 0x140157460
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x140157460
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rdi, rax
cmp qword [rbx], rax
je 0x140157442
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], 0
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x38], eax
jne 0x140157442
mov qword [rbx], rdi
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
mov rdi, qword [rsp + 0x30]
jae 0x140157460
mov dword [rbx + 8], CHandleMap::CHandleMap
mov rdx, rbx
mov rcx, rsi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp method.CNoDbFrameWnd.virtual_552
Function at 0x140157780
Capabilities:
Reference sql statements

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rsi, rcx
mov dl, 1
lea rcx, [0x1403c45e8]
call fcn.140150360
call fcn.14016bc70
test eax, eax
je 0x140157918
mov rdx, qword [0x1403c45e8]
test rdx, rdx
je 0x140157918
xor r8d, r8d
lea rcx, [rsp + 0x80]
call fcn.14015a060
nop
lea rdx, [0x1402ac320]
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
nop
test eax, eax
je 0x14015790a
lea rcx, [0x1403c4350]
call fcn.14010ca00
mov r8, qword [rsp + 0x80]
lea rdx, str.SELECT_lID_FROM_Main_WHERE_bIsGroup__1_AND_mText___s_COLLATE_NOCASE
lea rcx, [rsp + 0x88]
call fcn.14015b330
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
mov r8, rax
lea rdx, [rsp + 0x38]
lea rcx, [0x1403c44c8]
call fcn.140143da0
nop
lea rcx, [rsp + 0x38]
call fcn.1401437b0
test al, al
jne 0x1401578e3
xor r8d, r8d
lea rdx, [0x1402bee18]
lea rcx, [rsp + 0x38]
call fcn.140144630
mov ebx, eax
mov r9d, 1
mov r8d, r9d
mov edx, eax
lea rcx, [0x1403c4350]
call fcn.14010a500
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rdx, str.C:UsersScottBrAppDataLocalTempDitto_BuildMainFrm.cpp
lea rcx, [rsp + 0x90]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rdi, rax
mov r9d, ebx
mov r8, qword [rsp + 0x80]
lea rdx, str.Opening_Ditto_to_Group_based_on_found_group_name__name:__s__GroupId:__d
lea rcx, [rsp + 0x98]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, CEnumArray::CEnumArray
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x98]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1401578f0
lea rcx, [0x1403c4350]
call fcn.14010ca00
nop
lea rcx, [rsp + 0x38]
call fcn.140143000
nop
lea rcx, [rsp + 0x88]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x80]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsi + 0x1d8]
mov dword [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
mov rdx, rsi
call fcn.1401915d0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret