joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4931a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r14
xor esi, esi
test r8d, r8d
mov qword [rsp + 0x48], r15
mov r14d, ecx
mov r12, rdx
je 0x4933f5
movsxd rax, ecx
lea r15, [0x004e5d20]
mov bpl, al
mov r13, rax
sar r13, 5
and ebp, 0x1f
mov rcx, qword [r15 + r13*8]
imul rbp, rbp, 0x38
movzx eax, byte [rcx + rbp + 8]
test al, 2
jne 0x4933f5
test al, 0x48
je 0x493234
movzx eax, byte [rcx + rbp + 9]
cmp al, 0xa
je 0x493234
mov byte [rdx], al
mov rax, qword [r15 + r13*8]
lea rdx, [rdx + 1]
mov esi, 1
add r8d, 0xffffffff
mov byte [rax + rbp + 9], 0xa
mov rcx, qword [r15 + r13*8]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx + rbp]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x493299
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x49327f
call fcn.00489440
mov dword [rax], 9
call fcn.00489470
mov dword [rax], 5
mov eax, 0xffffffff
jmp 0x4933f7
cmp eax, 0x6d
je 0x4933f5
mov ecx, eax
call fcn.004894a0
mov eax, 0xffffffff
jmp 0x4933f7
mov ecx, dword [rsp + 0x34]
mov rax, qword [r15 + r13*8]
add esi, ecx
test byte [rax + rbp + 8], 0x80
je 0x4933f1
test ecx, ecx
je 0x4932c0
cmp byte [r12], 0xa
jne 0x4932c0
or byte [rax + rbp + 8], 4
jmp 0x4932c5
and byte [rax + rbp + 8], 0xfb
movsxd rax, esi
mov rbx, r12
mov rdi, r12
lea rsi, [rax + r12]
cmp r12, rsi
jae 0x4933df
nop
nop
movzx eax, byte [rdi]
cmp al, 0x1a
je 0x4933c4
cmp al, 0xd
je 0x4932fc
mov byte [rbx], al
inc rbx
inc rdi
jmp 0x4933b9
lea rax, [rsi - 1]
cmp rdi, rax
jae 0x493323
cmp byte [rdi + 1], 0xa
lea rax, [rdi + 1]
jne 0x49331b
add rdi, 2
mov byte [rbx], 0xa
jmp 0x4933b6
mov rdi, rax
jmp 0x4933b3
mov rcx, qword [r15 + r13*8]
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + rbp]
mov r8d, 1
inc rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49335b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4933b3
cmp dword [rsp + 0x34], 0
je 0x4933b3
mov rax, qword [r15 + r13*8]
test byte [rax + rbp + 8], 0x48
je 0x493388
movzx ecx, byte [rsp + 0x30]
cmp cl, 0xa
jne 0x49337b
mov byte [rbx], cl
jmp 0x4933b6
mov byte [rbx], 0xd
mov rax, qword [r15 + r13*8]
mov byte [rax + rbp + 9], cl
jmp 0x4933b6
cmp rbx, r12
jne 0x493399
cmp byte [rsp + 0x30], 0xa
jne 0x493399
mov byte [rbx], 0xa
jmp 0x4933b6
mov r8d, 1
mov edx, 0xffffffff
mov ecx, r14d
call fcn.004938d0
cmp byte [rsp + 0x30], 0xa
je 0x4933b9
mov byte [rbx], 0xd
inc rbx
cmp rdi, rsi
jb 0x4932e0
jmp 0x4933df
mov rax, qword [r15 + r13*8]
test byte [rax + rbp + 8], 0x40
jne 0x4933d6
or byte [rax + rbp + 8], 2
jmp 0x4933df
movzx eax, byte [rdi]
inc rbx
mov byte [rbx - 1], al
mov rdi, qword [rsp + 0x68]
mov esi, ebx
mov rbx, qword [rsp + 0x80]
sub esi, r12d
mov eax, esi
jmp 0x4933f7
xor eax, eax
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x88
ret
Function at 0x493530
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x4a8
mov rax, qword [0x004e0438]
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x488], rdi
mov qword [rsp + 0x480], r12
mov qword [rsp + 0x478], r13
xor esi, esi
mov qword [rsp + 0x470], r14
xor r13d, r13d
test r8d, r8d
mov qword [rsp + 0x468], r15
mov r12d, r8d
mov rbp, rdx
mov qword [rsp + 0x450], rax
jne 0x49359d
xor eax, eax
jmp 0x49377d
movsxd rax, ecx
lea r9, [0x004e5d20]
mov r15b, al
mov rdx, rax
sar rdx, 5
and r15d, 0x1f
mov rax, qword [r9 + rdx*8]
mov qword [rsp + 0x38], rdx
imul r15, r15, 0x38
test byte [r15 + rax + 8], 0x20
je 0x4935e3
mov r8d, 2
xor edx, edx
call fcn.00497050
mov rdx, qword [rsp + 0x38]
lea r9, [0x004e5d20]
mov rcx, qword [r9 + rdx*8]
test byte [r15 + rcx + 8], 0x80
je 0x4936de
xor r14d, r14d
test r12d, r12d
mov rdi, rbp
je 0x49372c
lea rbx, [rsp + 0x40]
xor ecx, ecx
nop
nop
mov eax, edi
sub eax, ebp
cmp eax, r12d
jae 0x49363f
movzx eax, byte [rdi]
inc rdi
cmp al, 0xa
jne 0x49362e
mov byte [rbx], 0xd
inc rbx
inc esi
inc rcx
inc rcx
mov byte [rbx], al
inc rbx
cmp rcx, 0x400
jl 0x493610
mov rcx, qword [r9 + rdx*8]
lea rax, [rsp + 0x40]
mov r8d, ebx
mov rcx, qword [r15 + rcx]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
sub r8d, eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4936d3
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
add r13d, eax
cdqe
sub rbx, rcx
cmp rax, rbx
jl 0x49369a
mov rdx, qword [rsp + 0x38]
mov eax, edi
lea r9, [0x004e5d20]
sub eax, ebp
cmp eax, r12d
jb 0x493602
mov rbx, qword [rsp + 0x4a0]
test r13d, r13d
jne 0x49375f
test r14d, r14d
je 0x493720
cmp r14d, 5
jne 0x493711
call fcn.00489440
mov dword [rax], 9
call fcn.00489470
mov dword [rax], r14d
mov eax, 0xffffffff
jmp 0x493765
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x49369a
mov rcx, qword [r15 + rcx]
lea r9, [rsp + 0x30]
mov r8d, r12d
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x493706
mov r13d, dword [rsp + 0x30]
xor r14d, r14d
jmp 0x4936a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
jmp 0x4936ab
mov ecx, r14d
call fcn.004894a0
mov eax, 0xffffffff
jmp 0x493765
mov rdx, qword [rsp + 0x38]
lea r9, [0x004e5d20]
mov rax, qword [r9 + rdx*8]
test byte [r15 + rax + 8], 0x40
je 0x493742
cmp byte [rbp], 0x1a
jne 0x493742
xor eax, eax
jmp 0x493765
call fcn.00489440
mov dword [rax], 0x1c
call fcn.00489470
mov dword [rax], 0
mov eax, 0xffffffff
jmp 0x493765
sub r13d, esi
mov eax, r13d
mov r15, qword [rsp + 0x468]
mov r14, qword [rsp + 0x470]
mov rdi, qword [rsp + 0x488]
mov r13, qword [rsp + 0x478]
mov r12, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x498]
mov rcx, qword [rsp + 0x450]
call fcn.004997b0
add rsp, 0x4a8
ret
Function at 0x4951b0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x38
mov rax, qword [0x004e0438]
lea r8, [rsp + 0x20]
mov r9d, 6
mov edx, 0x1004
mov byte [rsp + 0x26], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x4951f3
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x28]
call fcn.004997b0
add rsp, 0x38
ret
lea rcx, [rsp + 0x20]
call fcn.004879a0
mov rcx, qword [rsp + 0x28]
call fcn.004997b0
add rsp, 0x38
ret

Function at 0x495900
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rsi
xor esi, esi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
cmp qword [0x004e5c80], rsi
mov ebx, r8d
mov rbp, rdx
mov r12, rcx
jne 0x4959dd
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rdi, rax
je 0x4959d6
lea rdx, [0x004bcd58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x004e5c80], rax
je 0x4959d6
lea rdx, [0x004bcd48]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x004bcd30]
mov rcx, rdi
mov qword [0x004e5c88], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x004e544c], 2
mov qword [0x004e5c90], rax
jne 0x4959dd
lea rdx, str.GetUserObjectInformationA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov qword [0x004e5ca0], rax
je 0x4959dd
lea rdx, str.GetProcessWindowStation
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x004e5c98], rax
jmp 0x4959e4
xor eax, eax
jmp 0x495a6f
mov rax, qword [0x004e5c98]
test rax, rax
je 0x495a33
call rax
test rax, rax
je 0x495a1e
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x38]
mov r9d, InitCommonControls
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov edx, 1
call qword [0x004e5ca0]
test eax, eax
je 0x495a1e
test byte [rsp + 0x40], 1
jne 0x495a33
cmp dword [0x004e5458], 4
jb 0x495a2d
bts ebx, 0x15
jmp 0x495a5d
bts ebx, 0x12
jmp 0x495a5d
mov rax, qword [0x004e5c88]
test rax, rax
je 0x495a5d
call rax
test rax, rax
mov rsi, rax
je 0x495a5d
mov rdx, qword [0x004e5c90]
test rdx, rdx
je 0x495a5d
mov rcx, rax
call rdx
mov rsi, rax
mov r9d, ebx
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [0x004e5c80]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4965c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4965ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004894a0
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
test al, 1
je 0x496614
test bl, 2
je 0x496614
call fcn.00489440
mov dword [rax], InitCommonControls
call fcn.00489470
mov dword [rax], 5
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x4974f0
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov ebp, edx
mov qword [rsp + 0x30], r12
mov r8d, 1
xor edx, edx
mov qword [rsp + 0x28], r13
mov esi, ecx
xor edi, edi
mov qword [rsp + 0x20], r14
call fcn.004938d0
cmp eax, 0xffffffff
mov r13d, eax
je 0x497664
mov r8d, 2
xor edx, edx
mov ecx, esi
call fcn.004938d0
cmp eax, 0xffffffff
je 0x497664
mov ebx, ebp
sub ebx, eax
test ebx, ebx
jle 0x497603
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r14d, 0x1000
mov edx, 8
mov rcx, rax
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbp, rax
jne 0x497594
call fcn.00489440
mov edi, 0xffffffff
mov dword [rax], InitCommonControls
jmp 0x497649
mov edx, 0x8000
mov ecx, esi
call fcn.00498a70
mov r12d, eax
mov r8d, ebx
cmp ebx, r14d
mov rdx, rbp
cmovge r8d, r14d
mov ecx, esi
call fcn.00493530
cmp eax, 0xffffffff
je 0x4975c4
sub ebx, eax
test ebx, ebx
jg 0x4975a3
jmp 0x4975de
call fcn.00489470
cmp dword [rax], 5
jne 0x4975d9
call fcn.00489440
mov dword [rax], InitCommonControls
mov edi, 0xffffffff
mov edx, r12d
mov ecx, esi
call fcn.00498a70
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rsp + 0x30]
jmp 0x497649
jns 0x497649
xor r8d, r8d
mov edx, ebp
mov ecx, esi
call fcn.004938d0
mov ecx, esi
call fcn.00489760
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb edi, edi
neg edi
dec edi
cmp edi, 0xffffffff
jne 0x497649
call fcn.00489440
mov dword [rax], InitCommonControls
call fcn.00489470
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
xor r8d, r8d
mov edx, r13d
mov ecx, esi
call fcn.004938d0
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov eax, edi
jmp 0x497669
mov eax, 0xffffffff
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x58
ret
Function at 0x49bec8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
cmp qword [rcx + 0x80], 0
mov rdi, qword [rcx + 0x90]
mov rbp, qword [rcx + 0x88]
mov rsi, rcx
je 0x49bf19
call fcn.004a7b2c
mov rdx, qword [rsi + 0x80]
mov r8d, 5
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rbp, rbp
je 0x49bf2a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rdi, rdi
mov ebx, 1
je 0x49bf67
cmp word [rdi + 2], 0xffff
mov ecx, dword [rdi]
jne 0x49bf4b
mov ecx, dword [rdi + 0xc]
movzx edx, word [rdi + 0x12]
movzx eax, word [rdi + 0x14]
jmp 0x49bf53
mov dx, word [rdi + 0xa]
mov ax, word [rdi + 0xc]
test ecx, 0x1801
jne 0x49bf65
test dx, dx
jne 0x49bf65
test ax, ax
je 0x49bf67
xor ebx, ebx
cmp qword [rsi + 0x80], 0
je 0x49bf7a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x49c4d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rbx, rcx
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov r14, qword [rcx + 0x90]
mov r12, qword [rcx + 0x88]
mov qword [rsp + 0x48], r12
call fcn.004a7b2c
mov r15, qword [rax + 0x18]
cmp qword [rbx + 0x80], 0
je 0x49c550
call fcn.004a7b2c
mov r15, qword [rax + 0x18]
mov r8d, 5
mov rdx, qword [rbx + 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r12, rax
mov qword [rsp + 0x48], rax
test r12, r12
je 0x49c561
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test r14, r14
jne 0x49c572
mov rax, 0xffffffffffffffff
jmp 0x49c6a9
mov rcx, rbx
call fcn.0049c484
mov rsi, rax
mov qword [rsp + 0x50], rax
call fcn.0049de40
xor r13d, r13d
mov dword [rsp + 0x40], r13d
test rsi, rsi
je 0x49c5b7
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x49c5b7
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_EnableWindow]
mov r13d, 1
mov dword [rsp + 0x40], r13d
mov rcx, rbx
call fcn.0049ee74
mov rcx, rsi
call fcn.0049c99c
mov r9, r15
mov r8, rax
mov rdx, r14
mov rcx, rbx
call fcn.0049c190
test eax, eax
je 0x49c638
test byte [rbx + 0x48], 0x10
je 0x49c608
mov r14d, 4
mov rcx, rbx
call fcn.004a0768
bt eax, 8
mov eax, 5
cmovb r14d, eax
mov edx, r14d
mov rcx, rbx
call fcn.0049cfc0
cmp qword [rbx + 0x38], 0
je 0x49c638
mov dword [rsp + 0x30], 0x97
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.004a08d8
nop
jmp 0x49c651
test r13d, r13d
je 0x49c664
mov edx, 1
mov rcx, rsi
call qword [sym.imp.USER32.dll_EnableWindow]
test rsi, rsi
je 0x49c67e
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [rbx + 0x38]
jne 0x49c67e
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xb0]
mov rcx, rbx
call fcn.0049bc98
cmp qword [rbx + 0x80], 0
je 0x49c6a5
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeResource]
movsxd rax, dword [rbx + 0x58]
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret

Function at 0x49caa4
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x28
mov r12, rcx
mov rcx, qword [rcx + 0x38]
mov rdi, r8
call fcn.004a5898
test rax, rax
mov rsi, rax
je 0x49cb2c
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rdi, rdi
mov r13d, 1
movzx ebp, ax
mov rbx, 0xffffffffffffffff
je 0x49cb21
cmp dword [rdi], 0x38
jb 0x49cb21
mov rax, qword [r12 + 0x38]
or dword [rdi + 4], r13d
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x30], rbx
call qword [sym.imp.USER32.dll_SendMessageA]
bt rax, 0xd
jb 0x49cb21
or dword [rdi + 4], 0x80000002
cmp rbp, rbx
cmovne ebx, r13d
mov eax, ebx
jmp 0x49cb31
mov eax, 0xffffffff
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x49d7e8
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov edi, ecx
call fcn.004a7b18
mov rbx, rax
mov rax, qword [rax + 0x128]
test rax, rax
je 0x49d81e
mov rcx, qword [rax + 0x38]
test rcx, rcx
je 0x49d81e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
mov rbx, qword [rbx + 0x188]
je 0x49d84f
test rbx, rbx
je 0x49d84f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x49d84f
mov rax, qword [rbx]
mov edx, 0xffffffff
mov rcx, rbx
call qword [rax + 0x1b8]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x4a0424
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x4a047d
call fcn.004a7b2c
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x4a047d
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x4a049f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.0049e680
test rdi, rdi
mov esi, eax
je 0x4a049d
test rbx, rbx
je 0x4a049d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4a10d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [rcx + 8], 0x100
jne 0x4a112a
cmp qword [rcx + 0x10], 0x70
jne 0x4a112a
mov eax, dword [rcx + 0x18]
shr rax, 0x10
bt ax, 0xe
jb 0x4a112a
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x4a112a
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x4a112a
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, bx
jl 0x4a112a
mov ebx, 1
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x4a19bc
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rbx, rcx
mov ebp, r8d
mov edi, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x38
xor edx, edx
mov rsi, r9
call fcn.00499630
call fcn.004a7b18
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x40], edi
test rcx, rcx
mov qword [rsp + 0x58], rax
je 0x4a1aef
test rax, rax
je 0x4a1ae4
lea rax, [rbx + 0x58]
mov ecx, edi
lea r9, [rsp + 0x30]
or ecx, 4
mov qword [rsp + 0x28], rax
lea r8, [0x004a1788]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov edx, ebp
call fcn.00489070
test rax, rax
mov qword [rbx + 0x50], rax
je 0x4a1afd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x50]
mov esi, 0xffffffff
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, 4
je 0x4a1aa6
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [rsp + 0x60], 0
je 0x4a1ad2
mov rcx, qword [rbx + 0x50]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
mov qword [rbx + 0x50], 0
jmp 0x4a1af7
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, 1
jmp 0x4a1aff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x4a1afd
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x4a1b08
Capabilities:
Resume thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x30
mov r12d, r9d
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ecx, 0xc0
call fcn.0049bb48
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x4a1b68
mov rcx, rax
call fcn.004a099c
lea r11, [0x004ba7a8]
mov qword [rbx], r11
mov qword [rbx + 0x98], rsi
mov qword [rbx + 0x90], rdi
mov rcx, rbx
call fcn.004a6f3c
jmp 0x4a1b6a
xor ebx, ebx
mov edx, dword [rsp + 0x80]
or edx, 4
mov r9, qword [rsp + 0x88]
mov r8d, r12d
mov rcx, rbx
call fcn.004a19bc
test eax, eax
jne 0x4a1b9b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xf0]
xor eax, eax
jmp 0x4a1bbe
mov edx, ebp
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test byte [rsp + 0x80], 4
jne 0x4a1bbb
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, rbx
add rsp, 0x30
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x4a2ad0
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x004e0438]
mov qword [rsp + 0x1b0], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x60], 0xfffffffffffffffe
lea r9, [rsp + 0x50]
mov r8, rcx
mov edx, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
xor ebx, ebx
cmp eax, ebx
jne 0x4a2b2d
mov r8d, 0x104
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
xor eax, eax
jmp 0x4a2bd7
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.004a27d4
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, ebx
jne 0x4a2b7c
jmp 0x4a2bcb
mov eax, dword [rsp + 0x40]
test al, 2
jne 0x4a2b91
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [rsp + 0x40]
test al, 4
jne 0x4a2bc6
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x4a2bc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x9c]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
mov ebx, 1
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
call fcn.004997b0
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret

Function at 0x4a3ce4
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov r8d, 0x128
mov rcx, rbx
xor edx, edx
call fcn.00499630
mov rdx, qword [rdi + 0x18]
lea rcx, [rbx + 0x1e]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_lstrcpynA]
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x4a3de3
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor esi, esi
cmp eax, esi
je 0x4a3d52
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [rbx + 0x18], eax
jne 0x4a3d59
xor eax, eax
jmp 0x4a3de8
mov rcx, qword [rdi + 0x18]
cmp dword [rcx - 8], esi
jne 0x4a3d68
mov byte [rbx + 0x1c], sil
jmp 0x4a3d7a
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
movzx ecx, al
cmp eax, 0xffffffff
cmove ecx, esi
mov byte [rbx + 0x1c], cl
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
mov r8d, 0xffffffff
call fcn.0049a4a0
lea rdx, [rsp + 0x28]
mov r8d, 0xffffffff
mov rcx, qword [rax]
mov qword [rbx], rcx
lea rcx, [rsp + 0x38]
call fcn.0049a4a0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov rax, qword [rax]
mov r8d, 0xffffffff
mov qword [rbx + 0x10], rax
call fcn.0049a4a0
mov rax, qword [rax]
mov qword [rbx + 8], rax
cmp qword [rbx], rsi
jne 0x4a3dd5
mov qword [rbx], rax
cmp qword [rbx + 0x10], rsi
jne 0x4a3de3
mov rax, qword [rbx + 8]
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret