joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400afcc0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400afcda
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x1400afce4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x1400afde6
test al, 8
jne 0x1400afdc8
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp ax, 0x20
je 0x1400afd34
cmp ax, 9
je 0x1400afd34
cmp cx, 0x20
je 0x1400afd34
cmp cx, 9
je 0x1400afd34
cmp ax, 0x30
je 0x1400afd34
cmp ax, 0x2b
jne 0x1400afdc8
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.1400b0830
test eax, eax
je 0x1400afe0d
cmp byte [rdi + 0x23], 0
mov rbx, qword [rbx]
jne 0x1400afd59
mov rdi, qword [rdi + 0x10]
movzx eax, byte [rdi + 0x21]
test al, 2
je 0x1400afd6f
mov rcx, qword [rdi]
and al, 0x3d
mov byte [rdi + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
movzx eax, byte [rdi + 0x21]
and al, 0x9b
mov qword [rdi], rbx
or al, 0x10
mov byte [rdi + 0x21], al
jge 0x1400afd9b
mov rcx, rdi
call fcn.140001550
and byte [rdi + 0x21], 0x8f
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp dword [0x140134250], 0
je 0x1400afe43
test al, 8
je 0x1400afe43
mov rcx, rdi
call fcn.140001550
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400014b0
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 0x20
je 0x1400afe53
mov rcx, rdi
test al, 8
jne 0x1400afe38
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400b0830
test eax, eax
jne 0x1400afe1a
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx]
mov r8b, 0x20
mov rcx, rdi
call fcn.1400014b0
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx]
mov r8b, 0x28
call fcn.1400014b0
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test al, 1
je 0x1400afe6c
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400b0560
test al, 2
je 0x1400afe91
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400b0cf0
cmp byte [rbx + 0x23], 0
jne 0x1400afe9d
mov rax, qword [rbx + 0x10]
jmp 0x1400afea0
mov rax, rbx
test byte [rax + 0x21], 4
je 0x1400afeae
mov rdx, rbx
call fcn.1400520f0
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400b0830
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400afee0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x1400affb6
sub r8d, 1
je 0x1400affb1
sub r8d, 2
je 0x1400aff9f
sub r8d, 1
je 0x1400aff3f
cmp r8d, 1
jne 0x1400aff80
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + reloc.WSOCK32.dll_htonl]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400b0cf0
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x1400aff80
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x1400affb6
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rdx, rax
lea r8, [r9 - 1]
call fcn.1400b0830
test eax, eax
jne 0x1400aff74
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.WSOCK32.dll_recv
mov rcx, rdi
jmp 0x1400affb9
mov rdx, qword [rbx]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400afcc0
mov r8b, 0x28
jmp 0x1400affb9
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.1400014b0
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400affe0
Capabilities:
Read clipboard data

Disassembly:
movzx eax, byte [rcx + 0x23]
cmp al, 2
jne 0x1400affee
mov eax, 1
ret
test al, al
jne 0x1400afff6
mov rcx, qword [rcx + 0x10]
xor r8d, r8d
xor edx, edx
jmp fcn.1400b0000
Function at 0x1400b0560
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400b0580
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x1400b0576
cmp byte [rdx + 0x23], 0
jne 0x1400b058a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001550
cmp byte [rbx + 0x23], 1
jne 0x1400b05f7
cmp rbx, rdi
je 0x1400b05e7
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.1400b0830
test eax, eax
jne 0x1400b05ce
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400cfd20
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400b0610
Function at 0x1400b0610
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x1401372a8]
call fcn.140007380
test eax, eax
jne 0x1400b064d
lea r8, [0x1400fb87c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x140136640]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.1400515e0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x1400b0712
mov r15d, dword [rsi]
test r15d, r15d
je 0x1400b0712
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x1400b0712
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x1400b0712
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x1400b07d0
test rdi, rdi
je 0x1400b06f9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400b0771
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400cfd20
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x1400b0680
cmp dword [0x1401372d4], r12d
je 0x1400b074c
cmp qword [0x1401372b8], r12
je 0x1400b0738
mov rcx, qword [0x1401372a8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x1401372b8], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1401372d4], r12d
mov qword [0x1401372a8], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x1401372d4], r12d
je 0x1400b07b4
cmp qword [0x1401372b8], r12
je 0x1400b07a0
mov rcx, qword [0x1401372a8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x1401372b8], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1401372d4], r12d
mov qword [0x1401372a8], r12
lea r8, [0x1400fb87c]
lea rdx, [0x1400fbdb8]
lea rcx, [0x140136640]
call fcn.1400515e0
jmp 0x1400b0751
cmp dword [0x1401372d4], r12d
je 0x1400b080a
cmp qword [0x1401372b8], r12
je 0x1400b07f6
mov rcx, qword [0x1401372a8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x1401372b8], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x1401372d4], r12d
mov qword [0x1401372a8], r12
lea r8, [0x1400fb87c]
lea rdx, str.Out_of_memory.
lea rcx, [0x140136640]
call fcn.1400515e0
jmp 0x1400b0751
Function at 0x1400b0dc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x30
mov rsi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x1400b0ff0
mov qword [rsp + 0x50], rdi
sub ecx, 1
je 0x1400b0e57
sub ecx, 1
je 0x1400b0e26
cmp ecx, 1
je 0x1400b0e0a
mov rdx, qword [rsi + 0x28]
mov rcx, rbx
call qword [rsi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
test rbx, rbx
je 0x1400b0e14
xor edi, edi
mov word [rdx], di
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
call fcn.140006cb0
xor edi, edi
mov edx, 0xffffffff
cmp rax, rdx
mov ecx, edi
cmovne rcx, rax
test rbx, rbx
je 0x1400b0e44
mov word [rbx + rcx*2], di
mov rdi, qword [rsp + 0x50]
mov rax, rcx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rcx, rsi
call fcn.140001550
cmp dword [0x140134fb4], 0
jne 0x1400b0f58
cmp qword [rsi + 0x10], 0
jne 0x1400b0f58
cmp qword [0x140138d38], rsi
jne 0x1400b0e85
test rbx, rbx
jne 0x1400b0f04
mov rcx, qword [rsi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400b0eff
xor edi, edi
mov qword [0x140138d38], rdi
test rbx, rbx
je 0x1400b0eed
mov edx, dword [0x140134fec]
test edx, edx
je 0x1400b0ecf
mov r9, qword [rsi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x140136640]
mov qword [rsp + 0x20], rdi
call fcn.140051f90
mov rcx, qword [rsi + 0x28]
mov rdx, rbx
call fcn.1400ae4e0
mov rdi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdi, qword [rsp + 0x50]
dec eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
test rbx, rbx
je 0x1400b0f3f
cmp byte [rsi + 0x23], 0
jne 0x1400b0f10
mov rax, qword [rsi + 0x10]
jmp 0x1400b0f13
mov rax, rsi
test byte [rax + 0x21], 4
je 0x1400b0f21
mov rdx, rsi
call fcn.1400520f0
xor edi, edi
mov word [rbx], di
xor eax, eax
mov qword [0x140138d38], rdi
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x140138d38], rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov r8, qword [rsi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x1400b0feb
test r8, r8
jne 0x1400b0fa4
xor edi, edi
mov eax, edi
cmp byte [rsi + 0x23], al
cmovne rax, rsi
test byte [rax + 0x21], 4
je 0x1400b0f8a
mov rdx, rsi
call fcn.1400520f0
mov word [rbx], di
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
mov rdx, qword [rsi + 8]
cmp rbx, rdx
je 0x1400b0feb
cmp r8, 0x186a0
jae 0x1400b0fdd
movzx eax, word [rdx]
test ax, ax
je 0x1400b0fd3
nop
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x1400b0fc0
xor edi, edi
mov rax, rbp
mov word [rbx], di
jmp 0x1400b0f8f
mov rcx, rbx
call fcn.1400cfd20
xor edi, edi
mov word [rbx + rbp*2], di
mov rax, rbp
jmp 0x1400b0f8f
mov rcx, qword [rsi + 0x10]
call fcn.1400b0dc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret
Function at 0x1400b1e10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400b1e30
call fcn.1400829f0
jmp 0x1400b1e40
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x1400b1e9c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x80000539
mov esi, eax
call fcn.140001940
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b1e9c
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 4
jle 0x1400b1e9c
mov edx, 1
mov ecx, 0x80000539
call fcn.140001940
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b1e71
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b3980
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x1400b3a63
mov eax, dword [rbx]
test eax, eax
je 0x1400b3a63
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400b39bf
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400b39dd
mov r8d, 0x7fff
lea rdx, [rbx + 0x189c]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400b39dd
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x1400b39f6
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x1400b3a34
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400b3a34
movzx r9d, byte [rbx + 0x1850]
lea rdx, [rbx + 0x11a9c]
mov ecx, dword [rsp + 0x30]
call fcn.14007e350
test eax, eax
jne 0x1400b3a34
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x1400b3a63
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400b42d0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400eb380
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400b438a
xor r9d, r9d
mov byte [rsp + 0x18a0], dl
lea rcx, [0x1400fb87c]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov byte [rsp + 0x1871], r9b
lea rcx, [0x1400b5380]
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
movdqa xmmword [rsp + 0x1880], xmm0
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x1400b438a
mov rax, qword [0x14012fc08]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b438a
mov edx, 1
call fcn.140001940
mov eax, 1
add rsp, 0x11cd8
ret
Function at 0x1400b43a0
Capabilities:
Check for time delay via gettickcount
Enumerate gui resources
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx ebp, dl
mov rbx, rcx
je 0x1400b44ea
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14012fc08]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.1400b4cb0
cmp byte [rbx], 0
je 0x1400b43ea
test rax, rax
jne 0x1400b43f3
jmp 0x1400b44ac
test rax, rax
jne 0x1400b44ac
test rdi, rdi
je 0x1400b4485
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x80000539
mov esi, eax
call fcn.140001940
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b4467
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 4
jle 0x1400b4467
mov edx, 1
mov ecx, 0x80000539
call fcn.140001940
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400b4438
mov rax, qword [0x14012fc08]
mov rsi, qword [rsp + 0x30]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b4485
mov edx, 1
call fcn.140001940
cmp byte [rbx], 0
je 0x1400b44cf
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, rdi
je 0x1400b44ac
mov r8, qword [0x14012fc08]
mov rdx, rax
mov rcx, rbx
call fcn.1400b4cb0
test rax, rax
jne 0x1400b44ea
cmp byte [rbx], 0
je 0x1400b44cf
xor r8d, r8d
movzx edx, bpl
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400b4500
movzx edx, bpl
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400b4780
mov rbx, qword [rsp + 0x38]
mov eax, 1
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b4500
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
mov eax, 0x11cd0
call fcn.1400eb380
sub rsp, rax
xor ebx, ebx
mov r15, r8
movzx esi, dl
mov r14, rcx
test r8, r8
je 0x1400b452a
mov qword [r8], rbx
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rdi
cmp qword [rcx + 0x10], rbx
je 0x1400b474c
cmp qword [0x140136600], r14
mov byte [rcx], 1
je 0x1400b455d
mov qword [0x140136600], r14
mov dword [0x140136610], ebx
cmp qword [0x140136608], rbx
jne 0x1400b4580
mov ecx, 0xfa0
call fcn.1400a96d0
mov qword [0x140136608], rax
test rax, rax
je 0x1400b46e6
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14012fc08]
mov rcx, r14
mov rdx, rax
mov rdi, rax
call fcn.1400b4cb0
mov rbp, rax
test rax, rax
jne 0x1400b45ad
mov ecx, ebx
mov dword [0x140136610], ebx
jmp 0x1400b45b3
mov ecx, dword [0x140136610]
mov dword [rsp + 0x1874], ebx
mov qword [rsp + 0x1878], rbx
mov qword [rsp + 0x1880], rbx
mov qword [rsp + 0x1898], rbx
mov qword [rsp + 0x18a8], rbx
mov qword [rsp + 0x18b0], rbx
test sil, sil
je 0x1400b45f3
mov byte [rsp + 0x1871], bl
test rbp, rbp
je 0x1400b45fb
mov byte [rsp + 0x1871], 1
mov r8, qword [0x140136608]
lea rax, [0x1400fb87c]
mov qword [rsp + 0x1038], rax
test ecx, ecx
mov qword [rsp + 0x1048], rax
mov qword [rsp + 0x1050], rax
setg sil
mov rax, qword [0x14012fc08]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x1888], r8
mov dword [rsp + 0x1890], ecx
mov qword [rsp + 0x1040], rbx
mov qword [rsp + 0x1068], r14
mov dword [rsp + 0x20], reloc.WSOCK32.dll_recv
nop word [rax + rax]
test rbp, rbp
je 0x1400b4696
mov edx, ebx
test ecx, ecx
jle 0x1400b467f
mov rax, r8
nop
cmp qword [rax], rdi
je 0x1400b4696
inc edx
add rax, 8
cmp edx, ecx
jl 0x1400b4670
cmp ecx, 0x1f4
jge 0x1400b4696
movsxd rax, ecx
inc ecx
mov dword [0x140136610], ecx
mov qword [r8 + rax*8], rdi
mov dword [rsp + 0x1890], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400b24c0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x1878]
test rcx, rcx
jne 0x1400b46ea
test sil, sil
je 0x1400b46d5
mov r8, qword [0x140136608]
mov ecx, ebx
mov dword [0x140136610], ebx
xor sil, sil
jmp 0x1400b4660
test r15, r15
je 0x1400b46e6
mov rax, qword [r14 + 0x20]
test rax, rax
je 0x1400b46e6
mov qword [r15], rax
xor eax, eax
jmp 0x1400b4751
call fcn.1400b19f0
movsxd rcx, dword [0x140136610]
mov rdx, qword [rsp + 0x1878]
mov r8, qword [0x140136608]
test ecx, ecx
jle 0x1400b471f
mov rax, r8
nop dword [rax]
cmp qword [rax], rdx
je 0x1400b4733
inc ebx
add rax, 8
cmp ebx, ecx
jl 0x1400b4710
cmp ecx, 0x1f4
jge 0x1400b4733
mov qword [r8 + rcx*8], rdx
inc ecx
mov dword [0x140136610], ecx
mov rcx, qword [0x14012fc08]
mov ecx, dword [rcx + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b474c
mov edx, 1
call fcn.140001940
mov eax, 1
mov rdi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11cd0
pop r15
pop r14
pop rsi
ret
Function at 0x1400ca704
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ca74e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ca74e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ca74e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ca74e
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ca74e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ca750
xor al, al
add rsp, 0x28
ret

Function at 0x1400dd1ec
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400dd057
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dd057
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dd057
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dd057
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dd057
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dd057
cmp dword [rcx + 0xf8], 0
je 0x1400dd057
mov ecx, ebx
call fcn.1400dd108
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400dcee4
nop
cmp dword [rbp + 0x20], 0
je 0x1400dd0a5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400dd0b0
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400dcfe8
Function at 0x1400e34f4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400e350a
mov al, 1
jmp 0x1400e356a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400e351b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400e3568
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400e5dc8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400e3568
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400e3568
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400e3568
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400e356a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400e4fa0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400e5027
mov rsi, rbx
cmp word [rax], bp
je 0x1400e4fe6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400e4fd0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400e4fcc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400dff04
mov rdi, rax
test rax, rax
je 0x1400e5014
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400cfd20
mov rbp, rdi
xor ecx, ecx
call fcn.1400dff64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret