joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002a560
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x10
mov rdi, rsp
mov ecx, 4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x20]
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18002a5ce
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18002a5ce
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18002a5ce
xor eax, eax
jmp 0x18002a615
mov dword [rsp], 1
jmp 0x18002a5df
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x18002a610
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18002a60e
xor eax, eax
jmp 0x18002a615
jmp 0x18002a5d7
mov eax, 1
add rsp, 0x10
pop rdi
ret
Function at 0x41f0e8
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x120
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, rcx
and dword [rax + 8], 0
and dword [rax + 0xc], 0
lea r9, [rax + 8]
xor r8d, r8d
mov edx, 0x434
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, dword [rsp + 0x134]
mov r8d, dword [rsp + 0x130]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.0041f024
nop
mov r9d, 2
xor r8d, r8d
lea rdx, [0x00794f6c]
lea rcx, [rsp + 0x80]
call fcn.004202f0
mov edi, 0x100
cmp rax, 0xffffffffffffffff
jne 0x41f232
lea r8, [rsp + 0x130]
lea rdx, [0x00794f6c]
lea rcx, [rsp + 0x28]
call fcn.004023b4
nop
lea r8, [rsp + 0x130]
lea rdx, [0x00795b3c]
lea rcx, [rsp + 0xd0]
call fcn.004023b4
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x80]
call fcn.0058ca38
nop
lea rax, [rsp + 0xd0]
mov rcx, qword [rsp + 0x118]
cmp rcx, rax
je 0x41f1fe
test rcx, rcx
je 0x41f1fe
mov rax, qword [rsp + 0xd0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x41f1f8
call fcn.006a4944
jmp 0x41f1fe
call fcn.006a3610
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x41f232
test rcx, rcx
je 0x41f232
mov rax, qword [rsp + 0x28]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x41f22d
call fcn.006a4944
jmp 0x41f232
call fcn.006a3610
lea rcx, [rbx + 0x7f0]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x28]
call fcn.00417460
mov rbx, rax
mov rcx, qword [0x008669d0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41f268
mov rcx, rbx
call fcn.0055cb24
nop
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x41f29d
test rcx, rcx
je 0x41f29d
mov rax, qword [rsp + 0x28]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x41f297
call fcn.006a4944
jmp 0x41f29d
call fcn.006a3610
nop
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xc8]
cmp rcx, rax
je 0x41f2d9
test rcx, rcx
je 0x41f2d9
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rdi
jbe 0x41f2d4
call fcn.006a4944
jmp 0x41f2d9
call fcn.006a3610
mov rbx, qword [rsp + 0x138]
add rsp, 0x120
pop rdi
ret
Function at 0x422d38
Capabilities:
Open clipboard

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
movzx edi, r8w
xor esi, esi
mov rax, qword [0x0085e788]
cmp rax, qword [0x0085e780]
je 0x422d7b
mov word [rax], si
mov rax, qword [0x0085e788]
mov qword [0x0085e780], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [rsp + 0x28]
cmp rbx, qword [rsp + 0x30]
je 0x422dba
movzx edi, di
mov rax, qword [rbx]
cmp rax, rsi
je 0x422da4
lea rcx, [rax + 0x10]
jmp 0x422da7
mov rcx, rsi
mov rdx, rdi
call fcn.0054b584
add rbx, 8
cmp rbx, qword [rsp + 0x30]
jne 0x422d96
lea rcx, [rsp + 0x28]
call fcn.00445244
mov r9d, 2
xor r8d, r8d
lea rdx, [0x00794f6c]
lea rbx, [0x0085e740]
mov rcx, rbx
call fcn.004202f0
mov r9, qword [0x0085e780]
sub r9, qword [0x0085e788]
sar r9, 1
add r9, 0xfffffffffffffffe
cmp rax, r9
jne 0x422e5e
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.00421328
nop
cmp rax, rbx
je 0x422e24
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
mov rcx, rbx
call fcn.00406d38
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x422e5e
cmp rcx, rsi
je 0x422e5e
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x422e59
call fcn.006a4944
jmp 0x422e5e
call fcn.006a3610
mov rax, qword [0x0085e780]
cmp qword [0x0085e788], rax
je 0x422e87
mov rcx, qword [0x008669d0]
call qword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, esi
je 0x422e87
mov rcx, rbx
call fcn.0055cb24
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x43c948
Capabilities:
Check os version

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov r8, qword [rdx + 8]
mov rsi, rdx
mov rbp, rcx
mov eax, dword [r8 + 0x28]
mov rbx, qword [r8]
mov edi, 1
mov dword [r11 + 8], eax
mov eax, dword [r8 + 0x34]
lea r8, [r11 + 8]
mov r9d, edi
xor edx, edx
mov rcx, rbx
mov dword [r11 + 0xc], eax
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov r11, qword [rsi + 8]
lea r9d, [rdi + 1]
lea r8, [rsp + 0x48]
xor edx, edx
movdqu xmm0, xmmword [r11 + 0x28]
movdqu xmmword [rsp + 0x48], xmm0
mov rcx, rbx
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea rcx, [rsp + 0x84]
xor edx, edx
mov r8d, 0x110
call fcn.006aba40
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43ca03
cmp dword [rsp + 0x84], 5
jae 0x43ca01
cmp dword [rsp + 0x84], 4
jne 0x43ca03
cmp dword [rsp + 0x88], 0x5a
jb 0x43ca03
xor edi, edi
neg dil
lea rcx, [rsp + 0x34]
sbb ebx, ebx
xor edx, edx
not ebx
lea r8d, [rdx + 0x10]
and ebx, 0x1000
or ebx, 0x40
call fcn.006aba40
mov rcx, qword [rbp + 8]
movdqu xmm0, xmmword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x52d
movdqu xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x30], reloc.WS2_32.dll_sendto
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43caa8
mov rcx, qword [rsi]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x60], rcx
mov ecx, dword [rsp + 0x1c0]
xor r8d, r8d
mov dword [rsp + 0x6c], ecx
mov ecx, dword [rsp + 0x1c4]
mov edx, 0x52f
mov dword [rsp + 0x70], ecx
mov rcx, rdi
mov dword [rsp + 0x58], 0x28
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x43cae5
mov rax, qword [rsi]
mov r9d, dword [rsp + 0x1c4]
mov r8d, dword [rsp + 0x1c0]
mov qword [rsp + 0x1c8], rax
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x1c8]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 8]
mov edx, ebx
mov qword [rsp + 0x20], rax
call fcn.00444a74
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x43ea68
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x140
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rdx
mov r12, rcx
xor ebx, ebx
mov dword [rsp + 0x178], ebx
lea rcx, [rdx + 0x10]
call fcn.005952a0
test eax, eax
jne 0x43eacd
lea r8, [0x007969b0]
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x68]
call fcn.00402658
mov ebx, 1
mov rcx, rax
call fcn.005952a0
cmp eax, ebx
jne 0x43eacd
mov dil, bl
jmp 0x43ead0
xor dil, dil
mov r14d, 0x100
test bl, 1
je 0x43eb0b
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x90]
cmp rcx, rax
je 0x43eb0b
test rcx, rcx
je 0x43eb0b
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
cmp rdx, r14
jbe 0x43eb06
call fcn.006a4944
jmp 0x43eb0b
call fcn.006a3610
test dil, dil
je 0x43ec2a
cmp byte [r12 + 0x259], 0
je 0x43eb2d
mov rcx, qword [0x00862ca0]
call fcn.0059b364
jmp 0x43eb31
lea rax, [rsi + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x180], rbx
test rbx, rbx
je 0x43eb4e
lock add dword [rbx + 8], 1
mov rbx, qword [rsp + 0x180]
lea r8, [0x007969b0]
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.00402658
nop
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.00401f00
nop
xor r9d, r9d
lea r8, [rsp + 0x180]
lea rdx, [0x0085e850]
mov rcx, rax
call fcn.00451f90
nop
lea rax, [rsp + 0x98]
mov rcx, qword [rsp + 0xe0]
cmp rcx, rax
je 0x43ebce
test rcx, rcx
je 0x43ebce
mov rax, qword [rsp + 0x98]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r14
jbe 0x43ebc8
call fcn.006a4944
jmp 0x43ebce
call fcn.006a3610
nop
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x43ebfc
test rcx, rcx
je 0x43ebfc
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, r14
jbe 0x43ebf6
call fcn.006a4944
jmp 0x43ebfc
call fcn.006a3610
nop
test rbx, rbx
je 0x43ec96
or eax, 0xffffffff
lock xadd dword [rbx + 8], eax
add eax, 0xffffffff
jne 0x43ec96
mov rcx, qword [rsp + 0x180]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x43ec96
lea rdx, [rsi + 0x10]
lea rcx, [rsp + 0xe8]
call fcn.00401f00
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r11, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
cmp rcx, r11
je 0x43ec96
test rcx, rcx
je 0x43ec96
mov rdx, qword [rsp + 0xe8]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r14
jbe 0x43ec91
call fcn.006a4944
jmp 0x43ec96
call fcn.006a3610
mov rbx, qword [rsp + 0x170]
add rsp, 0x140
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x4454c8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x50]
call fcn.006aba40
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x110
mov dword [rbx], 0x50
call fcn.006aba40
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x445523
cmp dword [rsp + 0x24], 5
jae 0x445529
cmp dword [rsp + 0x24], 4
jne 0x445523
cmp dword [rsp + 0x28], 0x5a
jae 0x445529
mov dword [rbx], 0x44
mov rax, rbx
add rsp, 0x140
pop rbx
ret
Function at 0x44595c
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov rbx, rcx
mov edx, 0x3fb
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov qword [rbx + 0x40], rax
call qword [sym.imp.USER32.dll_SetFocus]
mov rdx, qword [rbx + 0x98]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rcx, qword [rbx + 0x40]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov edx, 0xb1
call qword [sym.imp.USER32.dll_SendMessageW]
cmp byte [rbx + 0x140], 0
je 0x4459f3
mov rcx, qword [rbx + 0x40]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [rbx + 0x40]
mov edx, 0xfffffff0
or rax, 0x20
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
lea r8d, [r9 + 0x2a]
mov edx, 0xcc
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi]
mov edx, 0x3eb
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rbx + 0xe8]
mov rcx, rax
mov qword [rbx + 0x48], rax
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [rbx + 0x138]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [rbx + 0x141], 0
je 0x445a8e
mov rcx, qword [rdi]
mov ebx, 2
mov edx, ebx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi]
mov edx, ebx
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi]
lea edx, [rbx - 1]
call qword [sym.imp.USER32.dll_GetDlgItem]
and dword [rsp + 0x28], 0
lea r9d, [rbx + 0x49]
lea r8d, [rbx + 0x1a]
mov rcx, rax
mov edx, 0x113
mov dword [rsp + 0x20], 0x19
call qword [sym.imp.USER32.dll_MoveWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rdi
mov rdx, rax
call fcn.00401f18
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x44a438
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
and dword [rax + 0x18], 0
lea rdx, [rax - 0x218]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov r8d, eax
lea r9, [rsp + 0x2a8]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x28]
call fcn.0042100c
mov rdx, rax
mov rcx, rbx
call fcn.00402190
nop
mov dword [rsp + 0x2b0], 1
lea rax, [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
cmp rcx, rax
je 0x44a4d4
test rcx, rcx
je 0x44a4d4
mov rdx, qword [rsp + 0x28]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x44a4cf
call fcn.006a4944
jmp 0x44a4d4
call fcn.006a3610
mov rax, rbx
add rsp, 0x290
pop rbx
ret
Function at 0x4555d4
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rdi, rcx
mov rbx, qword [rcx + 0x5c8]
cmp rbx, qword [rcx + 0x5d0]
je 0x4556a3
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx]
call fcn.0045d6b0
nop
lea rcx, [rsp + 0x40]
call fcn.00595310
sub eax, 1
je 0x455634
cmp eax, 1
jne 0x455658
lea rcx, [rsp + 0x40]
call fcn.00566c1c
jmp 0x455658
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x88]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x455692
test rcx, rcx
je 0x455692
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x45568d
call fcn.006a4944
jmp 0x455692
call fcn.006a3610
add rbx, 8
cmp rbx, qword [rdi + 0x5d0]
jne 0x455603
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x4556b8
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rsi, rdx
mov rbx, rcx
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
mov rcx, qword [rcx + 0x4f8]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x455892
cmp dword [rsi], 0
jne 0x4557e4
mov r8, qword [rsi + 8]
add r8, 4
lea rdx, [rsp + 0x30]
mov rcx, qword [0x00862d18]
call fcn.005e108c
nop
mov edi, 0x100
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x58], rax
je 0x455797
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.00401f00
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rax + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r11, [rsp + 0x70]
mov rcx, qword [rsp + 0xb8]
cmp rcx, r11
je 0x4557a7
test rcx, rcx
je 0x4557a7
mov rax, qword [rsp + 0x70]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rdi
jbe 0x455790
call fcn.006a4944
jmp 0x4557a7
call fcn.006a3610
jmp 0x4557a7
lea rcx, [rbx + 0x108]
mov rdx, rsi
call fcn.0046aea0
nop
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x455892
test rcx, rcx
je 0x455892
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
cmp rdx, rdi
jbe 0x4557da
call fcn.006a4944
jmp 0x455892
call fcn.006a3610
jmp 0x455892
mov r9, rax
mov edx, 0x110a
mov r8d, 4
mov rcx, qword [rbx + 0x4f8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test rax, rax
je 0x455892
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x38]
call fcn.006aba40
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x113e
mov rcx, qword [rbx + 0x4f8]
call qword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb rax, rax
and rax, qword [rsp + 0x60]
cmp rax, qword [rsi + 8]
je 0x455877
mov r9, rdi
mov edx, 0x110a
mov r8d, 1
mov rcx, qword [rbx + 0x4f8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test rax, rax
jne 0x45580b
jmp 0x455892
mov r9, rdi
mov edx, 0x110b
mov r8d, 9
mov rcx, qword [rbx + 0x4f8]
call qword [sym.imp.USER32.dll_SendMessageW]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x46e378
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r13
sub rsp, 0x220
mov rbx, rcx
mov rsi, rdx
lea rcx, [0x0079876c]
mov rdx, rbx
sub rdx, rcx
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x46e3a3
lea rdx, [rsp + 0x20]
lea rcx, str._NT_SYMBOL_PATH
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
or r13, 0xffffffffffffffff
test eax, eax
je 0x46e403
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x00798b50]
mov rcx, r13
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x46e3f5
lea rdx, [rsp + 0x20]
lea rcx, str._NT_ALTERNATE_SYMBOL_PATH
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x46e453
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x00798b50]
mov rcx, r13
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x46e445
lea rdx, [rsp + 0x20]
lea rcx, str.SYSTEMROOT
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x46e4fb
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x00798b50]
mov rcx, r13
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x46e499
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x00798b50]
mov rcx, r13
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x20]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x46e4cd
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
mov rax, qword [str.System32]
mov qword [rdi - 1], rax
movzx eax, word [0x00798c70]
mov word [rdi + 7], ax
test rsi, rsi
je 0x46e534
cmp byte [rsi], 0
je 0x46e534
xor eax, eax
mov rdi, rbx
mov rcx, r13
repne scasb al, byte [rdi]
movzx eax, word [0x00798b50]
mov rcx, r13
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rsi + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x46e526
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
Function at 0x4779dc
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x50
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov rcx, qword [rdi + 0x10]
xor r12d, r12d
movsxd rdx, eax
lea ebx, [r12 + 0x14]
cmp rdx, rbx
mov qword [rdi + 0x48], rdx
lea rdx, [rsp + 0x20]
jb 0x477a51
lea r8d, [r12 + 0x11]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea r11d, [r12 + 0x2e]
mov word [rsp + 0x46], r12w
mov word [rsp + 0x40], r11w
mov word [rsp + 0x42], r11w
mov word [rsp + 0x44], r11w
mov qword [rdi + 0x48], reloc.WS2_32.dll_send
jmp 0x477a5a
mov r8d, ebx
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rsi, [rdi + 0x1e]
lea rdx, [rsp + 0x20]
mov rax, rsi
sub rdx, rsi
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x477a7f
add rax, 2
test r8d, r8d
jne 0x477a69
cmp ecx, r12d
jne 0x477a8b
xor al, al
jmp 0x477b3c
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rsi
call fcn.006a5d0c
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [0x00866998]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rbp, rax
mov eax, dword [rdi + 0x48]
cmp eax, 0xffffffff
jne 0x477acc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rdi + 0x50]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov rdx, qword [0x008669a0]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [rdi + 0x48]
cmp eax, 0xffffffff
jne 0x477b00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rdi + 0x58]
mov r8d, eax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
cmp rbx, r12
je 0x477b3a
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteDC]
mov al, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
Function at 0x479194
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r15, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
xor ebx, ebx
lea r13d, [rbx + 1]
mov r12d, ebx
test r14d, r13d
je 0x4793ba
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov word [rsp + 0x50], bx
lea r8d, [r12 + 0x41]
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.0047d368
lea r8, [0x00799024]
lea rdx, [0x00799020]
lea rcx, [rsp + 0x50]
call fcn.00406b9c
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 2
je 0x479287
sub eax, 1
je 0x479279
sub eax, 1
je 0x47926b
sub eax, 1
je 0x47925d
cmp eax, 1
jne 0x479294
test byte [rsi + 0x128], 0x20
je 0x479294
jmp 0x479380
test byte [rsi + 0x128], 0x10
je 0x479294
jmp 0x479380
test byte [rsi + 0x128], 4
je 0x479294
jmp 0x479380
test byte [rsi + 0x128], 2
je 0x479294
jmp 0x479380
test byte [rsi + 0x128], 1
jne 0x479380
mov ecx, 0xb0
call fcn.006a494c
mov rdi, rax
cmp rax, rbx
je 0x4792d7
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], bx
lea rax, [rdi + 0x50]
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], bx
mov qword [rdi + 0xa0], rbx
mov byte [rdi + 0xa8], bl
jmp 0x4792da
mov rdi, rbx
lea rax, [rsp + 0x50]
cmp rax, rdi
je 0x4792fc
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov rcx, rdi
call fcn.00406d38
lea rcx, [rdi + 0x50]
lea rax, [rsp + 0x50]
cmp rax, rcx
je 0x47931f
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
call fcn.00406d38
cmp byte [rsi + 0x13e], bl
je 0x479341
lea rcx, [rsi + 0x1c0]
lea rdx, [rsp + 0x50]
call fcn.004780fc
cmp al, bl
je 0x479341
mov bpl, 1
jmp 0x479344
mov bpl, bl
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.00478d80
mov ebx, eax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.00478c94
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
mov r9b, bpl
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call fcn.00478e6c
xor ebx, ebx
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x4793ba
cmp rcx, rbx
je 0x4793ba
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, 0x100
jbe 0x4793b5
call fcn.006a4944
jmp 0x4793ba
call fcn.006a3610
add r13d, r13d
inc r12d
cmp r12d, 0x20
jl 0x4791d4
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret