joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482ec0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rbp, rsp
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x48], r8
mov byte [rbp + 0x57], r9b
mov qword [rbp + 0x78], 0
mov qword [rbp + 0xb8], rdx
mov rcx, qword [rbp + 0xb8]
call fcn.0040ab90
mov rcx, qword [rbp + 0xd0]
call fcn.0040ab90
nop
xor rax, rax
mov byte [rbp + 0x47], al
mov rcx, qword [rbp + 0x48]
call fcn.0040aa00
xor rbx, rbx
mov rax, qword [0x0052da28]
cmp byte [rax], 0
je 0x482f4a
call fcn.00410bf0
cmp byte [rax + 0x1b1], 0
je 0x482f36
mov ebx, pe_nt_image_headers64
jmp 0x482f4a
call fcn.00410bf0
cmp byte [rax + 0x1b0], 0
je 0x482f4a
mov ebx, 0x200
nop
mov rcx, qword [rbp + 0xb8]
call fcn.0040c300
mov rcx, qword [rbp + 0x58]
mov rdx, rax
xor r8, r8
mov r9d, ebx
or r9d, 0x20019
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4830a7
mov al, 1
mov byte [rbp + 0x47], al
mov dword [rbp + 0x6c], 0x800
mov ecx, dword [rbp + 0x6c]
call fcn.00405990
mov rdi, rax
xor rbx, rbx
mov dword [rbp + 0x6c], 0x800
movzx rax, byte [rbp + 0x57]
test al, al
je 0x482fe5
mov rcx, qword [rbp + 0x70]
mov edx, ebx
mov r8, rdi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
jmp 0x48301d
mov rcx, qword [rbp + 0x70]
mov edx, ebx
mov r8, rdi
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call sub.advapi32.dll_RegEnumValueW
mov esi, eax
test esi, esi
jne 0x48308d
cmp dword [rbp + 0x6c], 0
jbe 0x48308a
cmp qword [rbp + 0xd8], 0
je 0x48303b
mov rax, qword [rbp + 0xd8]
add dword [rax], 1
lea rcx, [rbp + 0x78]
mov rdx, rdi
mov r8d, dword [rbp + 0x6c]
call fcn.0040ace0
mov rax, qword [rbp + 0x48]
cmp qword [rax], 0
jne 0x483064
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x78]
call fcn.0040b050
jmp 0x48308a
mov rcx, qword [rbp + 0x48]
mov edx, 3
mov rax, qword [rbp + 0x48]
mov r8, qword [rax]
mov r9, qword [rbp + 0xd0]
mov rax, qword [rbp + 0x78]
mov qword [rsp + 0x20], rax
call fcn.0040c820
add ebx, 1
test esi, esi
je 0x482f9b
nop
mov rcx, rdi
call fcn.004059c0
mov rcx, qword [rbp + 0x70]
call sub.advapi32.dll_RegCloseKey_1
nop
lea rcx, [rbp + 0x78]
call fcn.0040aa00
lea rcx, [rbp + 0xb8]
call fcn.0040aa00
lea rcx, [rbp + 0xd0]
call fcn.0040aa00
movzx rax, byte [rbp + 0x47]
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x484000
Capabilities:
Check os version

Disassembly:
push rbp
sub rsp, 0x150
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov byte [rbp + 0x14f], 7
nop
mov dword [rbp + 0x30], 0x11c
lea rcx, [rbp + 0x30]
call sub.kernel32.dll_GetVersionExW
cmp dword [rbp + 0x40], 2
jne 0x4840cc
mov byte [rbp + 0x14f], 5
cmp dword [rbp + 0x34], 6
jb 0x48409e
mov byte [rbp + 0x14f], 0xa
cmp byte [rbp + 0x14a], 1
jne 0x484076
cmp dword [rbp + 0x38], 2
jb 0x484060
mov byte [rbp + 0x14f], 0xe
jmp 0x484112
cmp dword [rbp + 0x38], 1
jb 0x484112
mov byte [rbp + 0x14f], 0xd
jmp 0x484112
mov byte [rbp + 0x14f], 0xb
cmp dword [rbp + 0x38], 2
jb 0x48408f
mov byte [rbp + 0x14f], 0xf
jmp 0x484112
cmp dword [rbp + 0x38], 1
jb 0x484112
mov byte [rbp + 0x14f], 0xc
jmp 0x484112
cmp dword [rbp + 0x34], 5
jb 0x484112
mov byte [rbp + 0x14f], 6
cmp dword [rbp + 0x38], 1
jb 0x484112
cmp byte [rbp + 0x14a], 1
jne 0x4840c3
mov byte [rbp + 0x14f], 7
jmp 0x484112
mov byte [rbp + 0x14f], 9
jmp 0x484112
cmp dword [rbp + 0x40], 1
jne 0x484101
mov byte [rbp + 0x14f], 1
cmp dword [rbp + 0x34], 4
jne 0x4840ec
cmp dword [rbp + 0x38], 0xa
jne 0x4840ec
mov byte [rbp + 0x14f], 2
cmp dword [rbp + 0x34], 4
jne 0x484112
cmp dword [rbp + 0x38], 0x5a
jne 0x484112
mov byte [rbp + 0x14f], 3
jmp 0x484112
mov byte [rbp + 0x14f], 1
jmp 0x484112
movzx rax, byte [rbp + 0x14f]
lea rsp, [rbp + 0x150]
pop rbp
ret
Function at 0x484fe0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x78], rdx
mov rcx, qword [rbp + 0x78]
call fcn.0040ab90
nop
mov rcx, qword [rbp + 0x38]
call fcn.0040aa00
lea rcx, [0x004851f4]
mov rdx, qword [rbp + 0x78]
call fcn.0040caa0
test eax, eax
jne 0x4850f0
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c540
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
xor rcx, rcx
mov rdx, rbx
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c540
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
xor rcx, rcx
mov rdx, rsi
xor r8, r8
mov r9d, ebx
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_SearchPathW
test eax, eax
je 0x4850de
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rax
call fcn.0040b260
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c540
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b050
jmp 0x485191
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b050
jmp 0x485191
lea rcx, [rbp + 0x48]
mov edx, 1
call fcn.0040c540
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rbx, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
add ebx, 1
lea rcx, [rbp + 0x48]
mov edx, ebx
call fcn.0040c540
mov rcx, qword [rbp + 0x78]
call fcn.0040c300
mov rsi, rax
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rsi
mov rdx, rax
mov r8d, ebx
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x485184
mov rcx, qword [rbp + 0x48]
call fcn.0040c300
mov rcx, rax
call fcn.0040b260
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.0040c540
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x48]
call fcn.0040b050
jmp 0x485191
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x78]
call fcn.0040b050
nop
lea rcx, [rbp + 0x48]
call fcn.0040aa00
lea rcx, [rbp + 0x78]
call fcn.0040aa00
mov rax, qword [rbp + 0x38]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x485a30
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x250
mov rbp, rsp
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], rbp
mov qword [rbp + 0x260], rcx
nop
mov rcx, qword [rbp + 0x260]
call fcn.0040aa00
nop
mov ecx, 0xff
lea rdx, [rbp + 0x50]
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x485b2a
mov rcx, qword [rbp + 0x260]
lea rdx, [rbp + 0x50]
call fcn.0040c380
lea rcx, [rbp + 0x30]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.00487080
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x30]
call fcn.0040b050
lea rcx, [rbp + 0x28]
mov rax, qword [rbp + 0x260]
mov rdx, qword [rax]
call fcn.004858a0
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x28]
call fcn.0040b050
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov dword [rbp + 0x44], 0
cmp qword [rbp + 0x48], 0
je 0x485af7
mov rax, qword [rbp + 0x48]
mov eax, dword [rax - 4]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x260]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x44]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x485b2a
mov rcx, qword [rbp + 0x260]
lea rdx, [0x00485b94]
call fcn.0040c620
jmp 0x485b2a
nop
lea rcx, [rbp + 0x28]
mov edx, 2
call fcn.0040aae0
mov rax, qword [rbp + 0x260]
lea rsp, [rbp + 0x250]
pop rbp
ret
Function at 0x485ba0
Capabilities:
Get common file path

Disassembly:
push rbp
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xa0], rcx
nop
nop
call fcn.00484140
cmp al, 0xa
jb 0x485cb5
lea rcx, [rbp + 0x88]
mov edx, 0x104
call fcn.0040c540
nop
mov rcx, qword [rbp + 0x88]
call fcn.0040c300
xor rcx, rcx
mov edx, 0x1a
xor r8, r8
xor r9, r9
mov qword [rsp + 0x20], rax
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x485ca5
mov rcx, qword [rbp + 0x88]
call fcn.0040c300
mov rcx, qword [rbp + 0xa0]
mov rdx, rax
call fcn.00428860
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x80], rax
mov dword [rbp + 0x7c], 0
cmp qword [rbp + 0x80], 0
je 0x485c6b
mov rax, qword [rbp + 0x80]
mov eax, dword [rax - 4]
mov dword [rbp + 0x7c], eax
cmp dword [rbp + 0x7c], 0
jle 0x485c94
lea rcx, [rbp + 0x40]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.004317f0
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x40]
call fcn.0040b050
xor rcx, rcx
mov rdx, qword [rbp + 0x48]
call fcn.00485dc0
jmp 0x485d8a
nop
lea rcx, [rbp + 0x88]
xor rdx, rdx
call fcn.0040c540
mov rax, qword [0x0052dd00]
mov rcx, qword [rax]
lea rdx, [0x00485e4c]
lea r8, [0x00485edc]
mov r9, qword [rbp + 0xa0]
call fcn.004824f0
test al, al
je 0x485d89
lea rcx, [rbp + 0x38]
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
call fcn.004858a0
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0x38]
call fcn.0040b050
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x6c], 0
cmp qword [rbp + 0x70], 0
je 0x485d2a
mov rax, qword [rbp + 0x70]
mov eax, dword [rax - 4]
mov dword [rbp + 0x6c], eax
cmp dword [rbp + 0x6c], 0
jle 0x485d89
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x5c], 0
cmp qword [rbp + 0x60], 0
je 0x485d56
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp + 0xa0]
mov rax, qword [rax]
movsxd rcx, dword [rbp + 0x5c]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x485d89
mov rcx, qword [rbp + 0xa0]
lea rdx, [0x00485ef8]
call fcn.0040c620
jmp 0x485d89
nop
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x88]
call fcn.0040aa00
mov rax, qword [rbp + 0xa0]
lea rsp, [rbp + 0x90]
pop rbp
ret
Function at 0x486740
Capabilities:
Create directory

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov byte [rbp + 0x26], dl
mov byte [rbp + 0x27], r8b
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
nop
mov al, 1
mov byte [rbp + 0x25], al
mov qword [rbp + 0x58], 0
movzx rax, byte [rbp + 0x26]
test al, al
je 0x4867a3
call fcn.00484e80
mov qword [rbp + 0x58], rax
xor rax, rax
mov rcx, qword [rbp + 0x28]
test rcx, rcx
je 0x4867b6
mov rax, qword [rbp + 0x28]
mov eax, dword [rax - 4]
test eax, eax
jne 0x4867c5
xor rax, rax
mov byte [rbp + 0x25], al
jmp 0x48691b
movzx rax, byte [rbp + 0x27]
test al, al
je 0x4868fd
lea rcx, [rbp + 0x50]
mov rdx, qword [rbp + 0x28]
call fcn.0040b0d0
lea rcx, [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
call fcn.00431850
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x48]
call fcn.0040b0d0
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.00428020
xor rax, rax
cmp qword [rbp + 0x60], 0
je 0x486817
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
cmp eax, 2
jne 0x48684e
lea rcx, [rbp + 0x38]
mov rdx, qword [rbp + 0x60]
mov r8d, 2
mov r9d, 1
call fcn.0040c900
mov rcx, qword [rbp + 0x38]
lea rdx, [0x004869c8]
call fcn.0040c8f0
test eax, eax
sete al
jmp 0x486851
xor rax, rax
test al, al
je 0x486859
mov al, 1
jmp 0x486864
mov rcx, qword [rbp + 0x60]
mov dl, 1
call fcn.00427970
test al, al
je 0x48686c
mov al, 1
jmp 0x48687e
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
call fcn.0040c8f0
test eax, eax
sete al
test al, al
jne 0x48691b
cmp qword [rbp + 0x68], 0
jne 0x4868ac
mov rcx, qword [rbp + 0x60]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
jmp 0x48691a
mov rcx, qword [rbp + 0x68]
call fcn.0040c300
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.0040c380
mov rcx, qword [rbp + 0x30]
movzx rdx, byte [rbp + 0x26]
movzx r8, byte [rbp + 0x27]
call fcn.00486740
test al, al
je 0x4868f1
mov rcx, qword [rbp + 0x60]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4868f6
xor rax, rax
jmp 0x4868f8
mov al, 1
mov byte [rbp + 0x25], al
jmp 0x48691a
mov rcx, qword [rbp + 0x28]
call fcn.0040c300
mov rcx, rax
lea rdx, [rbp + 0x58]
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
setne al
mov byte [rbp + 0x25], al
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x48]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x60]
mov edx, 2
call fcn.0040aae0
movzx rax, byte [rbp + 0x25]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x4869d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4869ee
test eax, 0x10
jne 0x4869f3
xor rax, rax
jmp 0x4869f5
mov al, 1
add rsp, 0x28
ret
Function at 0x486f60
Capabilities:
Copy file

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov r13d, r9d
xor r14, r14
mov rcx, rbx
call fcn.00487050
test al, al
je 0x486fdc
mov rcx, rsi
call fcn.00487050
test al, al
je 0x486fa3
test r13b, r13b
je 0x486fdc
mov rcx, rsi
call fcn.00486ff0
test al, al
je 0x486fdc
mov rcx, rbx
call fcn.0040c300
mov rbx, rax
mov rcx, rsi
call fcn.0040c300
mov rcx, rbx
mov rdx, rax
xor r8, r8
call sub.kernel32.dll_CopyFileW
test eax, eax
setne r14b
test r14b, r14b
je 0x486fdc
test dil, dil
je 0x486fdc
mov rcx, rsi
call fcn.00486e60
mov eax, r14d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x486ff0
Capabilities:
Set file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor rsi, rsi
mov rcx, rbx
call fcn.00487050
test al, al
je 0x487041
mov rcx, rbx
call fcn.00427d70
mov esi, eax
test sil, sil
jne 0x487041
mov rcx, rbx
call fcn.00486e60
mov rcx, rbx
call fcn.0040c300
mov rcx, rax
mov edx, 0x80
call sub.kernel32.dll_SetFileAttributesW
mov rcx, rbx
call fcn.00427d70
mov esi, eax
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x487050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48706e
test eax, 0x10
je 0x487073
xor rax, rax
jmp 0x487075
mov al, 1
add rsp, 0x28
ret

Function at 0x488510
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x80]
call fcn.0040ab90
nop
nop
cmp byte [0x00538899], 2
jne 0x48862d
cmp qword [rbp + 0x80], 0
je 0x48862d
lea rcx, [rbp + 0x80]
lea rdx, [0x004886f0]
call fcn.0040c620
cmp qword [0x005203b8], 0
je 0x48864b
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x80]
xor r8, r8
call fcn.0040bd40
lea rcx, [rbp + 0x60]
call fcn.0040b350
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x5c], 0
cmp qword [rbp + 0x60], 0
je 0x4885bd
mov rax, qword [rbp + 0x60]
mov eax, dword [rax - 4]
mov dword [rbp + 0x5c], eax
mov rcx, qword [0x005203b8]
mov rdx, qword [rbp + 0x50]
mov r8d, dword [rbp + 0x5c]
lea r9, [rbp + 0x6c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile_1
cmp dword [rbp + 0x6c], 0
jne 0x48864b
call sub.kernel32.dll_GetCurrentThreadId_1
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00426c20
lea rcx, [rbp + 0x40]
mov edx, 3
mov r8, qword [rbp + 0x38]
lea r9, [0x00488704]
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.0040c820
mov rcx, qword [rbp + 0x40]
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_OutputDebugStringW
jmp 0x48864b
mov rcx, qword [rbp + 0x80]
call fcn.0040c300
mov rcx, rax
call sub.kernel32.dll_OutputDebugStringW
jmp 0x48864b
nop
lea rcx, [rbp + 0x38]
mov edx, 2
call fcn.0040aae0
lea rcx, [rbp + 0x60]
call fcn.0040aa50
lea rcx, [rbp + 0x80]
call fcn.0040aa00
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x48d9f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor rbx, rbx
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48da0b
or ebx, 4
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48da1e
or ebx, 8
mov ecx, 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48da31
or ebx, 0x20
mov ecx, 0x5b
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48da44
or ebx, 0x40
mov ecx, 0x5c
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x48da57
or ebx, 0x40
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x494ca0
Capabilities:
Capture screenshot

Disassembly:
push rbp
sub rsp, 0xe0
mov rbp, rsp
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xf8], rdx
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x60]
call sub.user32.dll_GetClientRect
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0xb8], rax
cmp qword [rbp + 0xb8], 0
jne 0x494d2e
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x70]
call sub.user32.dll_BeginPaint
mov qword [rbp + 0xb8], rax
jmp 0x494d4d
mov rcx, qword [rbp + 0xf8]
call sub.user32.dll_WindowFromDC
test rax, rax
jne 0x494d4d
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0
jne 0x494dcb
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x189], 0
jne 0x494dcb
xor rcx, rcx
call sub.user32.dll_GetDC
mov qword [rbp + 0xc0], rax
mov rcx, qword [rbp + 0xc0]
mov edx, dword [rbp + 0x68]
mov r8d, dword [rbp + 0x6c]
call sub.gdi32.dll_CreateCompatibleBitmap
mov qword [rbp + 0xd8], rax
xor rcx, rcx
mov rdx, qword [rbp + 0xc0]
call sub.user32.dll_ReleaseDC
xor rcx, rcx
call sub.gdi32.dll_CreateCompatibleDC
mov qword [rbp + 0xd0], rax
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
call sub.gdi32.dll_SelectObject
mov qword [rbp + 0xc8], rax
jmp 0x494df1
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x189], 0
je 0x494df1
mov rax, qword [rbp + 0xf0]
mov rax, qword [rax + 0x189]
mov qword [rbp + 0xd0], rax
nop
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rbp + 0xd0]
mov qword [rax + 0x189], rcx
mov rcx, qword [rbp + 0xf0]
mov edx, 0x14
mov r8, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xd0]
call fcn.004989a0
cmp qword [0x00538900], 0
je 0x494e45
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xf0]
call qword [0x00538900]
mov rcx, qword [rbp + 0xf0]
mov edx, 0xf
mov r8, qword [rbp + 0xd0]
xor r9, r9
call fcn.004989a0
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x677], 0
je 0x494e88
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x677]
xor rdx, rdx
call fcn.0048e9f0
mov rcx, qword [rbp + 0xb8]
xor rdx, rdx
call sub.gdi32.dll_SelectClipRgn
mov rax, qword [rbp + 0xb8]
cmp rax, qword [rbp + 0xd0]
je 0x494ee8
mov rcx, qword [rbp + 0xb8]
xor rdx, rdx
xor r8, r8
mov r9d, dword [rbp + 0x68]
mov eax, dword [rbp + 0x6c]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 0xcc0020
call sub.gdi32.dll_BitBlt
cmp qword [rbp + 0xf8], 0
jne 0x494f09
mov rax, qword [rbp + 0xf0]
mov rcx, qword [rax + 0x61b]
lea rdx, [rbp + 0x70]
call sub.user32.dll_EndPaint
nop
cmp qword [rbp + 0xd8], 0
je 0x494f53
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xc8]
call sub.gdi32.dll_SelectObject
mov rcx, qword [rbp + 0xd0]
call sub.gdi32.dll_DeleteDC
mov rcx, qword [rbp + 0xd8]
call sub.gdi32.dll_DeleteObject
mov rax, qword [rbp + 0xf0]
mov qword [rax + 0x189], 0
jmp 0x494f7f
mov rax, qword [rbp + 0xd0]
cmp rax, qword [rbp + 0xf8]
jne 0x494f7f
mov rax, qword [rbp + 0xf0]
mov qword [rax + 0x189], 0
jmp 0x494f7f
lea rsp, [rbp + 0xe0]
pop rbp
ret
Function at 0x495f50
Capabilities:
Get graphical window text

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
cmp qword [rbx + 0x61b], 0
je 0x495fc8
cmp byte [rbx + 0x661], 0
jne 0x495fc8
mov rcx, qword [rbx + 0x61b]
call sub.user32.dll_GetWindowTextLengthW
test eax, eax
jne 0x495f87
xor rdi, rdi
jmp 0x495fae
mov r13d, eax
add r13d, 1
add r13d, r13d
movsxd rcx, r13d
call fcn.00405990
mov rdi, rax
mov rcx, qword [rbx + 0x61b]
mov rdx, rdi
mov r8d, r13d
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
mov rdx, rdi
call fcn.0040c380
test rdi, rdi
je 0x495fd7
mov rcx, rdi
call fcn.004059c0
jmp 0x495fd7
mov rcx, rsi
mov rdx, qword [rbx + 0x649]
call fcn.0040c380
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x49ce10
Capabilities:
Check os version

Disassembly:
sub rsp, 0x148
mov dword [rsp + 0x24], 0x11c
lea rcx, [rsp + 0x24]
call sub.kernel32.dll_GetVersionExW
cmp dword [rsp + 0x34], 2
jne 0x49ce51
mov al, 4
cmp dword [rsp + 0x28], 6
jne 0x49ce3d
mov al, 7
jmp 0x49ce8d
cmp dword [rsp + 0x28], 5
jb 0x49ce8d
mov al, 5
cmp dword [rsp + 0x2c], 1
jb 0x49ce8d
mov al, 6
jmp 0x49ce8d
cmp dword [rsp + 0x34], 1
jne 0x49ce8a
mov al, 1
cmp dword [rsp + 0x28], 4
ja 0x49ce6f
cmp dword [rsp + 0x28], 4
jne 0x49ce71
cmp dword [rsp + 0x2c], 0xa
jb 0x49ce71
mov al, 2
cmp dword [rsp + 0x28], 4
ja 0x49ce86
cmp dword [rsp + 0x28], 4
jne 0x49ce8d
cmp dword [rsp + 0x2c], 0x5a
jb 0x49ce8d
mov al, 3
jmp 0x49ce8d
xor rax, rax
add rsp, 0x148
ret
Function at 0x4a5960
Capabilities:
Get file version info

Disassembly:
push rbp
sub rsp, 0x30
mov rbp, rsp
mov qword [rbp + 0x28], rbp
mov qword [rbp + 0x40], rcx
mov rax, qword [rbp + 0x40]
mov byte [rax + 0x10], 0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c300
mov rcx, rax
mov rdx, qword [rbp + 0x40]
add rdx, 0x20
call sub.version.dll_GetFileVersionInfoSizeW
mov rcx, qword [rbp + 0x40]
mov dword [rcx + 0x14], eax
mov rax, qword [rbp + 0x40]
cmp dword [rax + 0x14], 0
jbe 0x4a5a1c
nop
mov rax, qword [rbp + 0x40]
mov ecx, dword [rax + 0x14]
call fcn.00405990
mov rcx, qword [rbp + 0x40]
mov qword [rcx + 0x18], rax
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 0x18]
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x14]
xor r8, r8
call fcn.00406de0
mov rax, qword [rbp + 0x40]
mov rcx, qword [rax + 8]
call fcn.0040c300
mov rcx, rax
mov rax, qword [rbp + 0x40]
mov edx, dword [rax + 0x20]
mov rax, qword [rbp + 0x40]
mov r8d, dword [rax + 0x14]
mov rax, qword [rbp + 0x40]
mov r9, qword [rax + 0x18]
call sub.version.dll_GetFileVersionInfoW
mov rcx, qword [rbp + 0x40]
test eax, eax
setne al
mov byte [rcx + 0x10], al
jmp 0x4a5a1c
lea rsp, [rbp + 0x30]
pop rbp
ret