joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140107150
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 0xffffffec
mov rcx, qword [rcx + 0xb8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x13
jb 0x140107289
call fcn.1400ba1e0
call fcn.1400882c0
test eax, eax
jne 0x140107281
mov rcx, qword [rbx + 0xb8]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov edx, 0xbd1
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0x30], 0
je 0x140107281
mov rcx, qword [0x140492fd8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1401071d9
xor edx, edx
lea rcx, str.Progman
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [0x140492fd8], rax
jmp 0x1401071e0
mov rax, qword [0x140492fd8]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140107281
mov rcx, qword [0x140492fd8]
lea r8, str.SHELLDLL_DefView
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140107281
mov rcx, qword [0x140492fd0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140107251
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea rcx, [0x140136490]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x38]
mov qword [0x140492fd0], rcx
jmp 0x140107258
mov rcx, qword [0x140492fd0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140107289
mov rcx, qword [0x140492fd0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1037
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0x16
jae 0x140107289
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14010cb40
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x31], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp + 7], xmm0
xor r14d, r14d
mov word [rbp - 9], r14w
lea r9, str.quick.cache
lea r8, [0x140402ad8]
lea rdx, str._scache_s
lea rcx, [rbp + 0x17]
call fcn.1401349c0
mov rbx, rax
lea rax, [rbp - 9]
cmp rax, rbx
je 0x14010cbda
lea rcx, [rbp - 9]
call fcn.14007ec70
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 9], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 7], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
lea rcx, [rbp + 0x17]
call fcn.14007ec70
lea r8, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae r8, qword [rbp - 9]
lea rdx, [rbp - 0x29]
call fcn.1400a2410
nop
lea rcx, [rbp - 9]
call fcn.14007ec70
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14010cca2
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.14019e1f0
nop
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rcx, qword [rbp - 0x29]
lea r8, str.FindWindow
lea rdx, [rbp - 0x59]
call fcn.140096310
test al, al
je 0x14010cc98
lea rcx, [rbp - 0x59]
call fcn.1401a1180
test al, al
je 0x14010cc98
mov ebx, dword [rdi + 0x88]
lea rdx, str.mfolder
lea rcx, [rbp - 0x59]
call fcn.14019ec70
mov r9d, ebx
mov r8d, ebx
lea rdx, [rdi + 0xe68]
mov rcx, rax
call fcn.1400de840
test al, al
jne 0x14010cc98
lea rcx, [rdi + 0xe68]
call fcn.1400dc2f0
nop
lea rcx, [rbp - 0x59]
call fcn.14019e6b0
nop
lea rcx, [rbp - 0x29]
call fcn.14007ec70
cmp qword [rdi + 0xe68], 0
jne 0x14010ccbd
mov rcx, rdi
call fcn.14010ce80
lea rdx, [rdi + 0x8e0]
test rdi, rdi
cmove rdx, r14
lea rcx, [rdi + 0xa00]
call fcn.140097030
mov al, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010e750
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rdx, rdx
je 0x14010e7a1
mov rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x14010e765
test rax, rax
je 0x14010e7a1
mov r8d, 2
lea rdx, [0x1403fe454]
mov rcx, rbx
call fcn.1402e4d88
test eax, eax
je 0x14010e7a1
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14010f2c0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov rsi, rcx
mov rdi, 0xffffffffffffffff
test rdx, rdx
je 0x14010f32c
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14010f2f3
test rax, rax
je 0x14010f32c
mov r8d, 2
lea rdx, [0x1403fe454]
mov rcx, rbx
call fcn.1402e4d88
test eax, eax
je 0x14010f32c
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14010f48e
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsi - 0x8e0]
call fcn.14010d200
nop
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x14010f458
mov edx, dword [rax + 0x68]
mov r8, qword [rsi + 0x598]
mov rcx, r8
mov rax, qword [r8 + 8]
cmp byte [rax + 0x19], 0
jne 0x14010f385
cmp dword [rax + 0x20], edx
jae 0x14010f36f
mov rax, qword [rax + 0x10]
jmp 0x14010f375
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14010f364
cmp rcx, r8
je 0x14010f385
cmp edx, dword [rcx + 0x20]
jae 0x14010f388
mov rcx, r8
cmp rcx, r8
je 0x14010f3ac
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x14010f39e
lock inc dword [rbx + 8]
mov rbx, qword [rcx + 0x30]
mov rax, qword [rcx + 0x28]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rbx
jmp 0x14010f3b8
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov rbx, qword [rbp - 0x38]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14010f3d1
lock inc dword [rcx + 8]
mov rbx, qword [rbp - 0x38]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
test rbx, rbx
je 0x14010f3ef
lock inc dword [rbx + 8]
mov rbx, qword [rbp - 0x38]
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x10], xmm0
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rsi - 0x8e0]
call fcn.140115830
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbed
lea rcx, [rsi - 0x8e0]
call fcn.14012b100
nop
test rbx, rbx
je 0x14010f458
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14010f458
mov rbx, qword [rbp - 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14010f458
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14010f48e
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010f48e
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14010f48e
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14010f770
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x14010f922
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14010f7a5
test rax, rax
je 0x14010f922
mov r8d, 2
lea rdx, [0x1403fe454]
mov rcx, rbx
call fcn.1402e4d88
test eax, eax
je 0x14010f922
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14010f922
lea rcx, [rsi - 0x8e0]
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.14010d200
nop
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x14010f8d6
mov edx, dword [rax + 0x68]
mov r8, qword [rsi + 0x598]
mov rcx, r8
mov rax, qword [r8 + 8]
cmp byte [rax + 0x19], 0
jne 0x14010f841
cmp dword [rax + 0x20], edx
jae 0x14010f82b
mov rax, qword [rax + 0x10]
jmp 0x14010f831
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14010f820
cmp rcx, r8
je 0x14010f841
cmp edx, dword [rcx + 0x20]
jae 0x14010f844
mov rcx, r8
cmp rcx, r8
je 0x14010f86a
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x14010f85a
lock inc dword [rbx + 8]
mov rbx, qword [rcx + 0x30]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
jmp 0x14010f875
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor ebx, ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14010f88c
lock inc dword [rcx + 8]
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call fcn.1400d16e0
nop
test rbx, rbx
je 0x14010f8d6
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14010f8d6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14010f8d6
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14010f90f
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010f90f
mov rbx, qword [rsp + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14010f90f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsi]
mov rdx, rbx
mov rcx, rsi
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
jmp qword [rax + reloc.OLEAUT32.dll_VariantClear]
Function at 0x140111900
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rbp, rcx
mov edx, r8d
lea rcx, [rsp + 0x28]
call fcn.1400d5910
nop
mov esi, 0xffffffff
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x1401119f0
mov rbx, qword [rdi + 0xa30]
test rbx, rbx
je 0x140111959
lock inc dword [rbx + 8]
mov rbx, qword [rdi + 0xa30]
mov rdi, qword [rdi + 0xa28]
add rdi, 0xb8
cmp qword [rdi + 0x18], 8
jb 0x140111971
mov rdi, qword [rdi]
test rbx, rbx
je 0x1401119a0
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1401119a0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1401119a0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
test rdi, rdi
je 0x1401119f0
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1401119f0
mov rcx, rdi
call fcn.1400851b0
lea rdx, [rbp + 0x8f8]
xor ecx, ecx
test al, al
lea rax, [rbp + 0x8d8]
lea r8, str.enum_desktop
jne 0x1401119d8
mov r8, rdi
test rbp, rbp
cmove rax, rcx
mov qword [rdx + 0x90], rax
lea rcx, [rdx + 8]
call fcn.14009c070
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140111a22
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140111a22
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140111a22
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140118b50
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
xor edi, edi
lea rax, vtable.xbp.0
mov qword [rcx], rax
mov rbx, rcx
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
add rcx, 0x50
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov qword [rbx + 0x60], rdi
mov word [rbx + 0x68], di
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x30], rdi
cmp qword [rbx + 8], rdi
je 0x140118bce
cmp qword [rbx + 0x18], rdi
je 0x140118c6f
cmp qword [rbx + 0x20], rdi
je 0x140118c6f
cmp qword [rbx + 0x28], rdi
je 0x140118c6f
mov dil, 1
jmp 0x140118c6f
lea rcx, str.uxtheme.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 8], rax
test rax, rax
je 0x140118c6f
lea rdx, str.BeginBufferedPaint
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.BufferedPaintSetAlpha
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.EndBufferedPaint
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.BufferedPaintUnInit
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 8]
lea rdx, str.BufferedPaintInit
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x18], 0
mov qword [rbx + 0x38], rax
je 0x140118c6f
cmp qword [rbx + 0x20], 0
je 0x140118c6f
cmp qword [rbx + 0x28], 0
mov eax, 1
movzx edi, dil
cmovne edi, eax
xor edx, edx
mov byte [rbx + 0x68], dil
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call fcn.1402dd440
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call fcn.140135c30
cmp dword [rsp + 0x24], 6
ja 0x140118ca7
jne 0x140118cd1
cmp dword [rsp + 0x28], 1
jb 0x140118cd1
lea rcx, str.dwmapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140118cd1
lea rdx, str.DwmIsCompositionEnabled
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x140118ce4
call rax
test eax, eax
setns al
mov byte [rbx + 0x69], al
mov rax, rbx
mov rbx, qword [rsp + 0x150]
add rsp, 0x140
pop rdi
ret
Function at 0x14011a4c0
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov rcx, qword [rcx + 0xd8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
xor r15d, r15d
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r15w
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x28]
call fcn.14008e380
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
mov r8d, ebx
mov rcx, qword [rsi + 0xd8]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov r10, qword [rbp - 0x18]
test r10, r10
je 0x14011a610
mov edi, r15d
lea r9, [rbp - 0x28]
mov r8, qword [rbp - 0x28]
mov r11, qword [rbp - 0x10]
cmp r11, 8
cmovae r9, r8
mov rbx, r10
test r10, r10
je 0x14011a5df
lea rax, [r10 - 1]
lea rax, [r9 + rax*2]
lea r14d, [r15 + 0x1d]
nop
movzx ecx, word [rax]
cmp cx, 0x20
je 0x14011a58f
cmp r14w, cx
jb 0x14011a59b
sub rax, 2
sub rbx, 1
je 0x14011a5df
jmp 0x14011a580
test rbx, rbx
je 0x14011a5df
lea rdx, [r9 + rdi*2]
movzx eax, word [rdx]
cmp ax, 0x20
je 0x14011a5b3
cmp r14w, ax
jb 0x14011a5bd
inc rdi
cmp rdi, rbx
jae 0x14011a5df
jmp 0x14011a5a0
cmp rdi, rbx
jae 0x14011a5df
mov r8, rbx
sub r8, rdi
add r8, r8
mov rcx, r9
call fcn.1402dcfd0
mov r11, qword [rbp - 0x10]
mov r10, qword [rbp - 0x18]
mov r8, qword [rbp - 0x28]
sub rbx, rdi
cmp rbx, r10
ja 0x14011a5fe
lea rax, [rbp - 0x28]
cmp r11, 8
cmovae rax, r8
mov qword [rbp - 0x18], rbx
mov word [rax + rbx*2], r15w
jmp 0x14011a610
xor r8d, r8d
sub rbx, r10
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140088be0
mov rcx, qword [rsi + 0x50]
lea r9, [rbp - 0x28]
mov r8, qword [rsi + 0x60]
mov edx, dword [rsi + 0x58]
test rcx, rcx
je 0x14011a636
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14011a649
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
mov ecx, dword [rsi + 0x70]
call fcn.140125f60
nop
lea rcx, [rbp - 0x28]
call fcn.14007ec70
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140126b40
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
xor eax, eax
mov dword [rsp + 0x60], 1
mov r9d, 0x20019
mov qword [rsp + 0x30], rax
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov dword [rsp + 0x38], eax
mov rdx, 0xffffffff80000001
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
call fcn.1400a5930
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140126bc3
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.ListviewShadow
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp qword [rsp + 0x30], 0
je 0x140126bce
mov rcx, qword [rsp + 0x30]
jmp 0x140126bc8
test rcx, rcx
je 0x140126bce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x60]
neg eax
sbb eax, eax
and eax, 2
add rsp, 0x58
ret

Function at 0x140128060
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov ebx, r8d
mov eax, edx
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebp, eax
shl ebp, 0x10
test ebx, ebx
je 0x1401280a7
bts ebp, 0x18
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 7
mov word [rdi], r14w
mov dword [rsp + 0x20], 1
mov esi, SHGetSetSettings
mov ebx, esi
nop word [rax + rax]
add esi, esi
add rbx, rbx
mov rax, qword [rdi + 0x10]
cmp rbx, rax
ja 0x1401280f6
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401280eb
mov rax, qword [rdi]
mov qword [rdi + 0x10], rbx
mov word [rax + rbx*2], r14w
jmp 0x140128107
xor r8d, r8d
mov rdx, rbx
sub rdx, rax
mov rcx, rdi
call fcn.140088be0
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140128114
mov rdx, qword [rdi]
lea r8d, [rsi + 1]
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
cmp eax, esi
je 0x1401280d0
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140134860
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, vtable.nbase::Thread.0
mov rbx, rcx
mov qword [rcx], rax
mov edi, edx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401348b5
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
test eax, eax
je 0x1401348a6
test rcx, rcx
je 0x1401348b5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [rbx + 8], eax
mov qword [rbx + 0x10], rax
test dil, 1
je 0x1401348c8
mov edx, 0x20
mov rcx, rbx
call fcn.1401aed44
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140135bd0
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, VarUI4FromDisp
call fcn.1402dd440
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
setae al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x158
ret
Function at 0x140135fa0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x140135fef
call rax
jmp 0x140135ff5
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, qword [rsp + 0x20]
cmp ax, 9
je 0x14013600d
cmp ax, 6
je 0x14013600d
xor al, al
add rsp, 0x58
ret
mov al, 1
add rsp, 0x58
ret
Function at 0x1401368d0
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x188]
sub rsp, 0x270
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
movdqa xmm6, xmmword [0x140415690]
movdqu xmmword [rsp + 0x60], xmm6
xor r14d, r14d
mov word [rsp + 0x50], r14w
test rdx, rdx
jne 0x140136953
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm6
movdqa xmm0, xmm6
movdqu xmmword [rsp + 0x60], xmm6
mov word [rsp + 0x50], r14w
jmp 0x140136a99
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x80]
call fcn.1402dd440
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp - 0x50]
call fcn.1402dd440
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rsp + 0x70], r14w
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x140136995
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.14007ece0
nop
lea r8, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae r8, qword [rsp + 0x70]
add r8, 6
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x70], r14w
cmp rcx, r8
je 0x1401369fc
sub r8, rcx
sar r8, 1
mov rdx, rcx
lea rcx, [rbp - 0x70]
call fcn.14007ece0
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rcx, qword [rbp - 0x70]
mov dword [rsp + 0x38], 0xc8
lea rax, [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8d, 0xc8
lea rdx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140136a64
lea rax, [rbp - 0x50]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140136a43
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.14007ece0
movdqu xmm6, xmmword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm6
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
lea rcx, [rbp - 0x70]
call fcn.14007ec70
nop
lea rcx, [rsp + 0x70]
call fcn.14007ec70
nop
lea rcx, [rsp + 0x50]
call fcn.14007ec70
mov rax, rdi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret