joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415cf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov eax, r8d
mov rbp, rdx
mov qword [rsp + 0x40], rsi
shr eax, 4
add ax, 1
mov ebx, r8d
mov rsi, rcx
movzx edx, ax
mov r8d, 6
mov rcx, rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
mov r12, rax
je 0x415e64
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x415e64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
mov rdi, rax
je 0x415e64
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rdi
and ebx, 0xf
jbe 0x415d96
nop
cmp rdi, r11
jae 0x415e64
add ebx, 0xffffffff
movzx eax, word [rdi]
lea rdi, [rdi + rax*2 + 2]
jne 0x415d80
cmp rdi, r11
jae 0x415e64
movzx eax, word [rdi]
test ax, ax
je 0x415e64
movzx ebx, ax
mov rax, qword [rsi]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or ecx, eax
jge 0x415dcc
mov edx, ebx
mov rcx, rsi
call fcn.0040dbb0
movzx ecx, word [rdi]
lea r8, [rdi + 2]
cmp ecx, 0xffffffff
jne 0x415dec
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
and ecx, ecx
movsxd r9, ecx
mov rcx, qword [rsi]
lea rdi, [rbx + rbx]
mov rdx, rdi
add r9, r9
call fcn.00490ae0
test eax, eax
je 0x415e3a
cmp eax, 0xc
je 0x415e2f
cmp eax, 0x16
je 0x415e24
cmp eax, 0x22
je 0x415e24
cmp eax, 0x50
je 0x415e3a
mov ecx, 0x80004005
call fcn.00407f10
int3
mov ecx, 0x80070057
call fcn.00407f10
int3
mov ecx, 0x8007000e
call fcn.00407f10
int3
test ebx, ebx
js 0x415e59
mov rcx, qword [rsi]
cmp ebx, dword [rcx - 0xc]
jg 0x415e59
mov dword [rcx - 0x10], ebx
mov rcx, qword [rsi]
mov eax, 1
mov word [rdi + rcx], 0
jmp 0x415e66
mov ecx, 0x80070057
call fcn.00407f10
int3
xor eax, eax
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x421f40
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov rbp, r8
mov rsi, rdx
mov r12, rcx
test rdx, rdx
je 0x4220a3
test r8, r8
je 0x42209f
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42209b
xor eax, eax
mov rbx, 0xffffffffffffffff
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [r12 + 0x38]
call fcn.00415b80
xor eax, eax
mov rcx, rbx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbp
lea rcx, [r12 + 0x30]
call fcn.00415b80
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rsi, rax
lea rcx, [0x00507908]
mov rdx, qword [0x00507908]
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
test rsi, rsi
je 0x422047
test rsi, 0xffffffffffff0000
jne 0x422033
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.00407f30
test rax, rax
je 0x42205e
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.00415cf0
mov rdi, qword [rsp + 0x20]
jmp 0x42205e
xor eax, eax
mov rcx, rbx
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x422049
xor ecx, ecx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.00415b80
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 0x10], 0
je 0x422074
lea rcx, [r12 + 0x40]
lea rdx, [rsp + 0x20]
call fcn.00421e00
nop
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x422094
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x4220a5
mov eax, 1
jmp 0x4220a5
xor eax, eax
jmp 0x4220a5
xor eax, eax
jmp 0x4220a5
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x422ed0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
cmp dword [0x0050b480], 0
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov esi, edx
mov rbx, rcx
mov edi, r8d
je 0x422f01
mov ecx, 0x30
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x422f6f
mov ecx, 0x18
call fcn.004910b0
test rax, rax
mov r9, rax
je 0x422f22
xor eax, eax
mov qword [r9], rax
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rax
jmp 0x422f25
xor r9d, r9d
mov rax, qword [0x0050b478]
xor ecx, ecx
mov qword [r9], rcx
mov qword [r9 + 8], rax
mov dword [r9], esi
mov dword [r9 + 4], edi
mov qword [r9 + 0x10], rbx
cmp qword [rbx + 0x70], rcx
jne 0x422f6f
cmp dword [0x0050b480], ecx
jne 0x422f6f
lea rax, [rsp + 0x30]
lea r8, [0x00422ba0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x70], rax
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x48
ret
Function at 0x427090
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov edi, r8d
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, 1
mov ecx, eax
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test rbx, rbx
je 0x4270f8
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test edi, edi
je 0x4270f8
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov edx, esi
mov ecx, eax
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
jmp qword [sym.imp.USER32.dll_AttachThreadInput]
Function at 0x4279c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rdi, rcx
add rcx, 0x28
mov ebp, r8d
movzx ebx, dx
mov qword [r11 - 0x28], r12
call fcn.00427540
mov r8d, r9d
lea rdx, [rsp + 0x30]
lea rcx, [r8 + r8*2]
mov r8d, 0x104
mov r12d, eax
add rcx, rcx
mov ecx, dword [rdi + rcx*8 + 0x108]
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
lea rcx, [rdi + 0x28]
movzx edx, bx
call fcn.00427540
test eax, eax
jle 0x427a4b
test ebp, ebp
je 0x427a44
add dword [rdi + 0x30f0], 1
jmp 0x427a4b
add dword [rdi + 0x30f0], 0xffffffff
test r12d, r12d
mov r12, qword [rsp + 0x250]
je 0x427bf0
cmp ebp, 1
jne 0x427b33
lea rsi, [0x004d483c]
mov eax, 0x7b
xor ebx, ebx
nop
nop
nop
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427a80
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x427aee
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427ac0
lea rsi, str._DN
mov eax, 0x5f
nop
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427b00
jmp 0x427c3e
lea rsi, [0x004d483c]
mov eax, 0x7b
xor ebx, ebx
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427b41
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x427bae
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427b80
lea rsi, str._UP
mov eax, 0x5f
nop
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427bc0
jmp 0x427c3e
cmp ebp, 1
jne 0x427c3e
movzx eax, word [rsp + 0x30]
lea rsi, [rsp + 0x30]
test eax, eax
je 0x427c3e
xor ebx, ebx
nop
nop
nop
mov rdx, qword [rdi + 0x30f8]
mov rcx, qword [rdi + 0x3100]
movsxd r9, eax
mov r8d, 0x102
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CallWindowProcW]
movzx eax, word [rsi + 2]
add rsi, 2
test eax, eax
jne 0x427c10
mov rdi, qword [rsp + 0x258]
mov rsi, qword [rsp + 0x260]
mov rbp, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x278
ret
Function at 0x42db00
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x438
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x420], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x42dc3e
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x42dc3e
lea rdx, str.Netscape
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
je 0x42db77
mov eax, 1
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x438
ret
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x42db5a
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x42db5a
lea rdx, str.Opera
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x42db5a
lea rdx, str.Google_Chrome
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x42db5a
call fcn.0048a330
test rax, rax
je 0x42dc3e
lea rdx, [rsp + 0x20]
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x42dc3e
lea rdx, str.Internet_Explorer
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x42db5a
lea rdx, str.Mozilla
lea rcx, [rsp + 0x20]
call fcn.00491bd0
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x438
ret
xor eax, eax
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x438
ret
Function at 0x4312e0
Capabilities:
Get graphical window text

Disassembly:
mov r11, rsp
sub rsp, 0x278
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov qword [r11 - 8], rbx
mov rbx, qword [0x0050bfe0]
mov qword [r11 - 0x10], rsi
test rbx, rbx
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15d, r9d
mov r12d, r8d
movsxd r13, edx
mov r14, rcx
je 0x431349
mov rcx, qword [rbx]
mov rdx, r13
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test eax, eax
jne 0x43139b
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x431330
xor eax, eax
mov r15, qword [rsp + 0x240]
mov r14, qword [rsp + 0x248]
mov r13, qword [rsp + 0x250]
mov r12, qword [rsp + 0x258]
mov rdi, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
mov rbx, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x278
ret
mov rsi, qword [rbx]
test rsi, rsi
je 0x431349
lea rcx, str.OmgBJMainWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
xor ebx, ebx
test rax, rax
mov rdi, rax
jne 0x4313ff
lea rcx, str.WinDVDClass
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4313fc
lea rdx, [0x004d53a0]
lea rcx, [rsp + 0x20]
call fcn.00491bd0
test rax, rax
jne 0x4313ff
mov rdi, rbx
cmp dword [rsp + 0x2a0], ebx
je 0x431466
mov ecx, r12d
sub ecx, 0x1f
je 0x431436
sub ecx, 1
je 0x43142f
sub ecx, 1
je 0x431428
cmp ecx, 1
jne 0x431349
lea ebx, [rcx + 3]
jmp 0x431443
mov ebx, 6
jmp 0x431443
mov ebx, 8
jmp 0x431443
cmp dword [rsi + 0x794], 2
sete bl
add ebx, 2
test rdi, rdi
mov dword [rsi + 0x794], ebx
mov dword [rsi + 0x748], 2
je 0x431475
mov r8d, r12d
mov rdx, rdi
mov rcx, r14
call fcn.0042ddb0
test rdi, rdi
je 0x431475
mov eax, 1
jmp 0x43134b
mov r9d, dword [rsp + 0x2a0]
mov r8d, r15d
mov edx, r13d
mov rcx, r14
call fcn.0042de40
jmp 0x43134b
Function at 0x432930
Capabilities:
Find taskbar

Disassembly:
mov rax, rsp
sub rsp, 0x148
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 8], rdi
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, rcx
mov qword [rsp + 0x20], rcx
mov dword [rcx + 8], 2
lea rax, [0x004d5cc8]
mov qword [rcx], rax
mov edi, 0x200
mov eax, SafeArrayAllocDescriptor
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.0048efe0
test rax, rax
je 0x4329cb
lea edx, [rdi - 1]
lea rcx, [rax + 8]
xor ebx, ebx
nop
mov dword [rcx - 8], ebx
mov dword [rcx - 4], ebx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
mov dword [rcx + 0x10], ebx
add rcx, 0x20
sub edx, 1
jns 0x4329b0
jmp 0x4329d0
xor ebx, ebx
mov rax, rbx
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x58], ebx
mov dword [rbp + 0x5c], edi
lea rax, [0x004d5ba8]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [rbp + 0xa4], 1
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
mov dword [rbp + 0xa0], ebx
lea rax, [0x004d5c78]
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rbp + 0xf8]
call fcn.00424d90
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x432a91
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbp + 0x18], rax
mov r8d, 0x80
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rsp + 0x30]
lea rdi, str.Button
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
je 0x432a95
mov qword [rbp + 0x18], rbx
jmp 0x432a95
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x10], rbx
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x70], eax
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rbp + 0x74], eax
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, eax
mov eax, dword [rbp + 0x70]
lea ecx, [rdx + rax - 1]
mov dword [rbp + 0x78], ecx
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [rbp + 0x74]
lea edx, [rax + rcx - 1]
mov dword [rbp + 0x7c], edx
mov dword [rbp + 0x54], ebx
mov dword [rbp + 0x4c], 0x4b
mov dword [rbp + 0x48], 0x1f4
mov dword [rbp + 0x50], ebx
mov dword [rbp + 0x3c], ebx
mov dword [rbp + 0x40], ebx
mov dword [rbp + 0x44], ebx
mov dword [rbp + 0x68], ebx
mov dword [rbp + 0x6c], ebx
mov dword [rbp + 0x80], ebx
mov dword [rbp + 0x38], ebx
mov rax, rbp
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x158]
mov rbp, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x140]
add rsp, 0x148
ret
Function at 0x434a60
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
sub rsp, 0x128
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.004348d0
nop
mov edx, dword [rsi + 0x58]
test edx, edx
jne 0x434b08
lea rcx, [rsp + 0x60]
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x5c]
nop
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x434af0
jmp 0x434bcf
mov r9, qword [rsi + 8]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.004686c0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x434b3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x5c]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.00429000
cmp qword [rax + 0x20], 8
jb 0x434b5d
mov rdx, qword [rax + 8]
jmp 0x434b61
lea rdx, [rax + 8]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x434b77
add rbx, 2
test eax, eax
jne 0x434b64
test ecx, ecx
setne bl
cmp qword [rsp + 0x50], 8
jb 0x434b8e
mov rcx, qword [rsp + 0x38]
call fcn.00490170
test bl, bl
je 0x434bc5
mov dword [rsi + 0x58], 0
lea rcx, [rsp + 0x60]
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
cmp r8, 8
cmovae rcx, r9
movzx eax, word [rcx]
mov word [rdi], ax
add rcx, 2
add rdi, 2
test ax, ax
jne 0x434bb0
jmp 0x434bcf
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x60]
cmp r8, 8
jb 0x434bdd
mov rcx, r9
call fcn.00490170
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
add rsp, 0x128
ret
Function at 0x434fe0
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
xor ebx, ebx
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov ecx, dword [rcx + 0x310c]
test ecx, ecx
mov ebp, edx
mov eax, ebx
jne 0x43501a
cmp dword [rdi + 0x3108], ebx
jne 0x43501a
cmp dword [rdi + 0x3104], ebx
je 0x4350f0
test ecx, ecx
mov qword [rsp + 0x60], rsi
je 0x43505c
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x12]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x435039
mov esi, eax
shl esi, 0x10
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28]
mov r8d, esi
mov r9d, ebp
mov dx, 0x12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.004271d0
cmp dword [rdi + 0x3108], ebx
je 0x43509d
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x43507a
mov esi, eax
shl esi, 0x10
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28]
mov r8d, esi
mov r9d, ebp
mov dx, 0x11
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call fcn.004271d0
cmp dword [rdi + 0x3104], ebx
je 0x4350e4
xor edx, edx
mov esi, ebx
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x4350bb
mov esi, eax
shl esi, 0x10
mov edx, dword [rdi + 0x3104]
mov dword [rsp + 0x30], 1
lea rcx, [rdi + 0x28]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edx
mov r8d, esi
mov dx, 0x10
mov r9d, ebp
call fcn.004271d0
mov rsi, qword [rsp + 0x60]
test eax, eax
setne bl
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x4354e0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
sub rsp, 0x128
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rsi, rcx
mov edx, 0x414
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x40
lea rdx, [rsp + 0x80]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call fcn.004348d0
nop
mov edx, dword [rsi + 0x58]
test edx, edx
jne 0x435588
lea rcx, [rsp + 0x60]
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsi + 0x5c]
nop
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x435570
jmp 0x43564f
mov r9, qword [rsi + 8]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.004686c0
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4355bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdi, [rsi + 0x5c]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.00429000
cmp qword [rax + 0x20], 8
jb 0x4355dd
mov rdx, qword [rax + 8]
jmp 0x4355e1
lea rdx, [rax + 8]
sub rdx, rbx
movzx ecx, word [rbx]
movzx eax, word [rbx + rdx]
sub ecx, eax
jne 0x4355f7
add rbx, 2
test eax, eax
jne 0x4355e4
test ecx, ecx
setne bl
cmp qword [rsp + 0x50], 8
jb 0x43560e
mov rcx, qword [rsp + 0x38]
call fcn.00490170
test bl, bl
je 0x435645
mov dword [rsi + 0x58], 0
lea rcx, [rsp + 0x60]
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x78]
cmp r8, 8
cmovae rcx, r9
movzx eax, word [rcx]
mov word [rdi], ax
add rcx, 2
add rdi, 2
test ax, ax
jne 0x435630
jmp 0x43564f
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x60]
cmp r8, 8
jb 0x43565d
mov rcx, r9
call fcn.00490170
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
add rsp, 0x128
ret
Function at 0x441d00
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x40], r12
xor r12d, r12d
cmp dword [rcx + 0x1e0], r12d
mov esi, r9d
mov rbp, r8
mov edi, edx
mov rbx, rcx
je 0x441da9
test edx, edx
jne 0x441da9
mov rdx, rcx
mov rcx, qword [0x0050b468]
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x1e0], r12d
mov dword [rbx + 0x1e4], r12d
mov dword [rbx + 0x244], r12d
mov qword [0x0050b008], r12
cmp dword [rbx + 0x1ec], r12d
je 0x441d98
mov rcx, qword [rbx + 0x10]
call fcn.0040d4b0
test al, 0x40
jne 0x441da9
mov rcx, qword [rbx + 0x10]
call fcn.0040d4b0
test al, 0x40
jne 0x441da9
mov rax, qword [rbx]
lea edx, [rdi + 1]
mov rcx, rbx
call qword [rax + 0xa0]
jmp 0x441da9
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0xa0]
mov eax, dword [rbx + 0x24]
test al, 0x40
je 0x441db2
neg edi
mov edx, dword [rbx + 0x2c]
shr edx, 3
and edx, 1
test al, al
jns 0x441dc9
test edx, edx
mov eax, r12d
sete al
mov edx, eax
mov rcx, qword [rbx + 0x38]
mov r8d, dword [rbx + 0x40]
mov dword [rsp + 0x38], esi
mov rax, qword [rcx]
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], edx
mov r9d, edi
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call qword [rax + 0x48]
cmp dword [rbx + 0x1e0], r12d
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov edi, eax
je 0x441ed3
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x441e3c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x441e3c
mov ecx, SafeArrayAllocDescriptor
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x441ed3
mov ecx, SafeArrayAllocDescriptor
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x441e56
mov dword [0x0050b3c8], 1
cmp dword [rbx + 0x1e0], r12d
je 0x441ebf
mov rcx, qword [0x0050b468]
mov rdx, rbx
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rbx + 0x1e0], r12d
mov dword [rbx + 0x1e4], r12d
mov dword [rbx + 0x244], r12d
mov qword [0x0050b008], r12
cmp dword [rbx + 0x1ec], r12d
je 0x441eae
mov rcx, qword [rbx + 0x10]
call fcn.0040d4b0
test al, 0x40
jne 0x441ebf
mov rcx, qword [rbx + 0x10]
call fcn.0040d4b0
test al, 0x40
jne 0x441ebf
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax + 0xa0]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
test edi, edi
je 0x441eae
cmp edi, 1
jle 0x441ebf
cmp edi, 3
jle 0x441e56
cmp edi, 4
je 0x441eae
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret