joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400052d0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [0x140107f18], 0
mov rdi, r8
mov rsi, rdx
je 0x1400052f7
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test rsi, rsi
je 0x14000535b
mov eax, 0xffffffff
cmp r8, rax
jne 0x14000531c
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140005310
mov edi, eax
test rdi, rdi
je 0x14000535b
lea rdx, [rdi + 1]
lea rcx, [0x140107f00]
call fcn.140005380
test rax, rax
je 0x1400052ea
mov qword [rsp + 0x30], rbx
mov r8, rdi
mov rbx, qword [0x140107f18]
mov rdx, rsi
mov rcx, rbx
call fcn.1400b3da4
xor eax, eax
mov word [rbx + rdi*2], ax
mov rbx, qword [rsp + 0x30]
lea rcx, [0x140107f00]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140005440

Function at 0x1400056c0
Capabilities:
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xor ecx, ecx
mov rbx, r8
mov edi, edx
test r8, r8
je 0x1400056dc
mov dword [r8], ecx
lea eax, [rdx - 0xc000]
cmp eax, 0x3fff
ja 0x1400057bb
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardFormatNameW]
mov r8d, reloc.OLEAUT32.dll_VariantChangeType
lea rdx, str.Link_Source
lea rcx, [rsp + 0x20]
call fcn.1400aba40
test eax, eax
je 0x1400057a8
lea rdx, str.ObjectLink
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.OwnerLink
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.Native
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.Embed_Source
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x1400057a8
lea rdx, str.MSDEVColumnSelect
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
je 0x14000579d
lea rdx, str.MSDEVLineSelect
lea rcx, [rsp + 0x20]
call fcn.1400ab8c0
test eax, eax
jne 0x1400057c0
test rbx, rbx
je 0x1400057a8
mov dword [rbx], 1
xor eax, eax
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
mov word [rsp + 0x20], cx
mov ecx, edi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, qword [rsp + 0x240]
add rsp, 0x230
pop rdi
ret
Function at 0x1400057e0
Capabilities:
Check for time delay via gettickcount
Open clipboard

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x2c], 0
mov rbx, rcx
je 0x1400057fa
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x140104d70]
mov edi, eax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140005874
xor esi, esi
nop
mov ecx, dword [0x140100a64]
cmp ecx, 0xffffffff
je 0x140005844
test ecx, ecx
je 0x140005890
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edx, dword [0x140100a64]
add edx, edi
sub edx, eax
cmp edx, 5
jle 0x140005890
mov edx, 1
mov dword [0x140100a50], esi
mov ecx, 0x8000012f
call fcn.1400016f0
mov rcx, qword [0x140104d70]
mov dword [0x140100a50], 1
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140005820
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov dword [rbx + 0x2c], 1
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x14000c3b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x1040
call fcn.1400bfa50
sub rsp, rax
cmp byte [0x140108b1c], 0
mov rbx, rdx
mov rbp, rcx
jne 0x14000c53d
cmp dword [0x140105d0c], 0
jne 0x14000c3eb
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140105d0c], eax
inc dword [0x140108b18]
mov qword [rsp + 0x1050], rsi
mov qword [rsp + 0x1058], rdi
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov r9d, dword [0x140108b18]
mov ecx, eax
sub ecx, dword [0x140105d0c]
cmp r9d, dword [0x140102404]
mov edx, dword [0x140102400]
mov dword [0x140105d08], eax
jbe 0x14000c4a6
cmp ecx, edx
jae 0x14000c4a6
mov dword [rsp + 0x20], ecx
lea r8, str._u_hotkeys_have_been_received_in_the_last__ums._n_nDo_you_want_to_continue__n_see_MaxHotkeysPerInterval_in_the_help_file_
lea rcx, [rsp + 0x40]
mov edx, 0x800
mov esi, 1
call fcn.14008b9a0
call fcn.14000b1a0
xor edi, edi
mov byte [0x140108b1c], sil
xor r8d, r8d
mov dword [0x140100a50], edi
lea edx, [rsi + 3]
mov qword [rsp + 0x20], rdi
lea rcx, [rsp + 0x40]
xorps xmm3, xmm3
call fcn.140091370
cmp eax, 7
jne 0x14000c491
xor r8d, r8d
lea edx, [rsi + 4]
lea rcx, [0x1401072b0]
call fcn.14001b180
mov eax, dword [0x140105d08]
mov dword [0x140100a50], esi
mov byte [0x140108b1c], dil
jmp 0x14000c4ae
xor edi, edi
mov esi, edi
cmp ecx, edx
jbe 0x14000c4be
mov dword [0x140108b18], edi
mov dword [0x140105d0c], eax
test esi, esi
jne 0x14000c52d
movzx eax, byte [rbp + 0xf]
lea r8, [0x1400cefc0]
mov byte [0x140107e2e], al
xor r9d, r9d
inc byte [rbx + 0x22]
mov rcx, qword [rbx]
mov dword [rsp + 0x30], edi
mov rdx, rcx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
call fcn.140082b00
dec byte [rbx + 0x22]
test eax, eax
jne 0x14000c4f9
mov byte [rbx + 0x27], al
jmp 0x14000c52d
cmp byte [rbx + 0x27], 0
je 0x14000c52d
mov byte [rbx + 0x27], 0
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [rbx + 0x18]
cmp eax, 0x3e8
ja 0x14000c52d
movzx r8d, word [rbp + 4]
xor r9d, r9d
mov rcx, qword [0x140104d70]
mov edx, 0x312
call qword [sym.imp.USER32.dll_PostMessageW]
mov rsi, qword [rsp + 0x1050]
mov rdi, qword [rsp + 0x1058]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1040
pop rbp
ret
Function at 0x140012720
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov word [rax + 0x10], dx
push rsi
push rdi
sub rsp, 0x98
mov qword [rax + 0x18], rbx
movzx edi, r9b
mov qword [rax - 0x18], rbp
movzx ebx, dx
mov qword [rax - 0x20], r12
movzx ebp, cl
mov qword [rax - 0x28], r13
movzx r13d, r8b
mov qword [rax - 0x38], r15
or r13b, r9b
mov byte [rsp + 0xb0], r9b
lea eax, [rbp - 1]
cmp al, 5
ja 0x140012769
cmp cl, 3
jne 0x140012770
lea eax, [rbp + 0x66]
cmp al, 5
ja 0x140012775
mov r15b, 1
jmp 0x140012778
xor r15b, r15b
mov eax, dword [rsp + 0xd0]
mov rsi, qword [rsp + 0xe8]
movzx r12d, byte [rsp + 0xe0]
test eax, eax
jle 0x140012905
mov edi, dword [rsp + 0xd8]
mov qword [rsp + 0x78], r14
mov r14d, eax
cmp dword [0x140105d10], 0
jne 0x140012817
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x140100a58]
sub eax, dword [0x140107e7c]
cmp eax, dword [rcx + 0x118]
jbe 0x14001281e
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x14001280b
mov edx, 1
mov dword [0x140100a50], 0
or ecx, 0xffffffff
call fcn.1400016f0
mov dword [0x140100a50], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140107e7c], eax
mov rcx, qword [0x140100a58]
test r12b, r12b
jne 0x140012882
movzx eax, byte [rcx + 0x136]
test al, al
je 0x14001283a
movzx eax, al
mov ebx, 0xffc3d44d
sub ebx, eax
jmp 0x14001283f
mov ebx, 0xffc3d44f
cmp dword [0x140105d10], 0
je 0x140012851
movzx eax, byte [0x14010811c]
jmp 0x140012858
xor ecx, ecx
call fcn.140015910
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov r8, rsi
mov byte [rsp + 0x20], 1
movzx edx, al
movzx ecx, r13b
call fcn.1400150e0
mov rcx, qword [0x140100a58]
movzx ebx, word [rsp + 0xb8]
test r15b, r15b
je 0x1400128c5
test rsi, rsi
jne 0x1400128c5
movzx eax, byte [rcx + 0x12f]
lea r9d, [rsi + 1]
movzx ecx, byte [rsp + 0x100]
mov r8d, dword [rsp + 0xf8]
mov edx, dword [rsp + 0xf0]
mov byte [rsp + 0x30], cl
movzx ecx, bpl
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call fcn.1400140a0
jmp 0x1400128ee
movzx eax, byte [rcx + 0x136]
mov r9, rsi
mov ecx, 0xffc3d44d
movzx r8d, bx
sub ecx, eax
movzx edx, bpl
mov dword [rsp + 0x28], ecx
mov ecx, edi
mov byte [rsp + 0x20], 1
call fcn.140012ea0
sub r14, 1
jne 0x1400127a7
movzx edi, byte [rsp + 0xb0]
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
test r12b, r12b
mov r12, qword [rsp + 0x88]
mov r13, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xc0]
jne 0x140012972
cmp dword [0x140105d10], 0
je 0x140012941
movzx eax, byte [0x14010811c]
jmp 0x140012948
xor ecx, ecx
call fcn.140015910
not dil
and dil, al
and dil, 0xcc
je 0x140012972
mov dword [rsp + 0x28], 0xffc3d44d
mov r9b, 1
mov r8, rsi
mov byte [rsp + 0x20], 0
movzx edx, dil
xor ecx, ecx
call fcn.1400150e0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x140012980
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x80
cmp dword [0x140105d10], 2
movzx r14d, r8b
mov ebx, edx
movzx esi, cx
sete bpl
test bpl, bpl
je 0x1400129db
movzx ecx, cx
lea rdx, [rsp + 0x30]
test ecx, 0xffffff80
je 0x1400129c8
mov eax, gethostbyname
lea rdx, [rsp + 0x32]
mov word [rsp + 0x30], ax
mov r8d, 0xa
call fcn.1400ab7b8
movzx esi, word [rsp + 0xa8]
test ebx, ebx
jle 0x140012b5c
mov qword [rsp + 0xa0], rdi
mov rdi, rbx
mov qword [rsp + 0xb0], r15
xor r15d, r15d
nop dword [rax]
cmp dword [0x140105d10], r15d
jne 0x140012a6a
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov rcx, qword [0x140100a58]
sub eax, dword [0x140107e7c]
cmp eax, dword [rcx + 0x118]
jbe 0x140012a6a
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140012a5e
mov edx, 1
mov dword [0x140100a50], r15d
or ecx, 0xffffffff
call fcn.1400016f0
mov dword [0x140100a50], 1
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140107e7c], eax
test bpl, bpl
je 0x140012b16
cmp dword [0x140105d10], r15d
je 0x140012a85
movzx eax, byte [0x14010811c]
jmp 0x140012a8c
xor ecx, ecx
call fcn.140015910
movzx ecx, al
mov dword [rsp + 0x28], 0xffc3d44f
and cl, 0xc4
mov byte [rsp + 0x20], 1
or cl, 4
xor r9d, r9d
xor r8d, r8d
movzx edx, al
call fcn.1400150e0
movzx eax, word [rsp + 0x30]
lea rbx, [rsp + 0x30]
cmp ax, 0x30
jb 0x140012af6
cmp ax, 0x39
ja 0x140012af6
movzx edx, byte [rbx]
xor r8d, r8d
add dl, 0x30
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 2]
call fcn.140012ea0
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x30
jae 0x140012ac0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 1]
call fcn.140012ea0
jmp 0x140012b22
movzx edx, r14b
movzx ecx, si
call fcn.140010ec0
cmp dword [0x140105d10], 2
mov rax, qword [0x140100a58]
jne 0x140012b3a
mov ecx, dword [rax + 0x80]
jmp 0x140012b3d
mov ecx, dword [rax + 0x7c]
call fcn.140014c40
sub rdi, 1
jne 0x140012a00
mov r15, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
Function at 0x140014e50
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140104d88]
test r10, r10
je 0x140014f87
movsxd rax, dword [0x140104de4]
imul r9, rax, 0xd4
mov eax, 0x69
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov byte [r9 + r10 + 6], cl
mov byte [r9 + r10], dl
mov word [r9 + r10 + 2], r8w
mov word [r9 + r10 + 4], ax
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, eax
mov dword [0x140104de0], eax
sub ecx, dword [0x140108098]
xorps xmm0, xmm0
mov dword [0x140108098], eax
cvtsi2ss xmm0, rcx
movsxd rcx, dword [0x140104de4]
imul rdx, rcx, 0xd4
divss xmm0, dword [0x1400edc68]
mov rcx, qword [0x140104d88]
movss dword [rdx + rcx + 8], xmm0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edi, edi
mov rbx, rax
test rax, rax
je 0x140014f41
cmp rax, qword [0x140104dd8]
je 0x140014f25
movsxd rcx, dword [0x140104de4]
lea r8d, [rdi + 0x64]
imul rdx, rcx, 0xd4
mov rcx, qword [0x140104d88]
add rcx, 0xc
add rdx, rcx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [0x140104de4]
jmp 0x140014f65
movsxd rdx, dword [0x140104de4]
mov rax, qword [0x140104d88]
imul rcx, rdx, 0xd4
mov word [rcx + rax + 0xc], di
jmp 0x140014f65
movsxd rdx, dword [0x140104de4]
movabs r8, 0x41002f004e
mov rax, qword [0x140104d88]
imul rcx, rdx, 0xd4
mov qword [rcx + rax + 0xc], r8
inc edx
mov qword [0x140104dd8], rbx
cmp edx, dword [0x140100a60]
mov rbx, qword [rsp + 0x30]
cmovge edx, edi
mov rdi, qword [rsp + 0x20]
mov dword [0x140104de4], edx
add rsp, 0x28
ret

Function at 0x140014f90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movzx edi, cl
mov esi, edx
mov ecx, edi
mov ebp, edi
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 1
lea r8d, [rsi - 1]
neg al
sbb ebx, ebx
add ebx, 2
cmp r8d, 1
ja 0x1400150bd
cmp ebx, esi
je 0x1400150bd
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140015004
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
movzx edx, dil
lea ecx, [r8 + 1]
call fcn.140012ea0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
movzx edx, dil
lea ecx, [r8 + 2]
call fcn.140012ea0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140107290]
sete bpl
test bpl, bpl
je 0x140015065
mov edx, 1
mov dword [0x140100a50], 0
or ecx, 0xffffffff
call fcn.1400016f0
mov dword [0x140100a50], 1
cmp dil, 0x14
jne 0x1400150bd
cmp esi, 2
jne 0x1400150bd
lea ecx, [rsi + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400150bd
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, esi
call fcn.140012ea0
test bpl, bpl
je 0x1400150bd
lea edx, [rsi - 1]
mov dword [0x140100a50], 0
or ecx, 0xffffffff
call fcn.1400016f0
mov dword [0x140100a50], 1
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140015f70
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x2c0
xor edx, edx
mov rbp, rcx
xor edi, edi
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rsi, rax
test rax, rax
je 0x14001610c
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetControlKeyboard_Layouts_]
lea rcx, [rsp + 0x94]
movaps xmm1, xmmword [0x1400e3370]
mov eax, dword [0x1400e33c0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [0x1400e3380]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm1, xmmword [0x1400e3390]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400e33a0]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x1400e33b0]
mov dword [rsp + 0x90], eax
movzx eax, word [0x1400e33c4]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
mov word [rsp + 0x94], ax
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
test eax, eax
je 0x1400160fc
lea rax, [rsp + 0x2f0]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400160fc
mov rcx, qword [rsp + 0x2f0]
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x28], rax
lea rdx, str.Layout_File
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x2e0], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x2e8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x2f0]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x2e0]
jne 0x1400160fc
mov ecx, dword [rsp + 0x2e8]
test ecx, ecx
je 0x1400160fc
shr ecx, 1
dec ecx
cmp word [rsp + rcx*2 + 0xb0], di
jne 0x1400160d5
test ecx, ecx
je 0x1400160fc
lea edx, [rcx - 1]
cmp word [rsp + rdx*2 + 0xb0], di
jne 0x1400160e7
mov ecx, edx
test edx, edx
jne 0x1400160c0
jmp 0x1400160fc
inc ecx
cmp ecx, 0x104
jae 0x1400160fc
mov word [rsp + rcx*2 + 0xb0], di
test ecx, ecx
je 0x1400160fc
lea rcx, [rsp + 0xb0]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov rdi, rax
cmp rbp, rsi
je 0x14001610c
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov rax, rdi
add rsp, 0x2c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017350
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x140105dc0], 0
lea rbx, [0x140108130]
jne 0x1400173af
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x140108130], eax
mov edx, 1
lea r8, [0x140108134]
nop
mov ecx, dword [r8 - 4]
lea r8, [r8 + 4]
shr ecx, 0x1e
xor ecx, dword [r8 - 8]
imul eax, ecx, 0x6c078965
add eax, edx
inc edx
mov dword [r8 - 4], eax
cmp edx, 0x270
jl 0x140017380
mov dword [0x140105dc0], 1
mov dword [0x140102420], 0x270
mov r8d, 0xe3
mov qword [0x140108af0], rbx
nop word [rax + rax]
mov eax, dword [rbx + 4]
mov ecx, eax
xor ecx, dword [rbx]
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx + 0x634]
mov dword [rbx], ecx
add rbx, 4
sub r8d, 1
jne 0x1400173d0
mov r8d, 0x18c
nop word [rax + rax]
mov eax, dword [rbx + 4]
lea rdx, [rbx + 4]
mov ecx, eax
and al, 1
xor ecx, dword [rbx]
and ecx, 0x7ffffffe
xor ecx, dword [rbx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rbx - 0x38c]
mov dword [rbx], ecx
lea rbx, [rdx]
sub r8d, 1
jne 0x140017410
mov eax, dword [0x140108130]
mov ecx, dword [rdx]
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
xor ecx, dword [rdx]
shr ecx, 1
neg al
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [rdx - 0x38c]
mov dword [rdx], ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14001baf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rdi, r8
mov qword [rsp + 0x30], 0
mov rsi, rdx
mov dword [rsp + 0x38], 0
mov rbp, rcx
mov byte [rsp + 0x3c], 0
mov r8d, 0xa
lea rdx, str._AUTOHOTKEY_SCRIPT_
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x14001bb5b
lea r8d, [rax + 0xa]
xor ecx, ecx
lea rdx, str._AHK_WITH_ICON_
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14001bbc5
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SizeofResource]
mov dword [rsp + 0x38], eax
test eax, eax
je 0x14001bbc5
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_LoadResource]
test rax, rax
je 0x14001bbc5
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LockResource]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001bbc5
mov r9d, 0xfde9
lea rdx, [rsp + 0x30]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rcx, rsi
call fcn.140089340
mov rax, qword [rbp + 0xb80]
inc dword [0x140107140]
mov qword [0x140107148], rax
mov eax, 3
jmp 0x14001bbe4
xorps xmm3, xmm3
mov qword [rsp + 0x20], 0
mov r8, rdi
lea rcx, str.Could_not_extract_script_from_EXE.
xor edx, edx
call fcn.140091370
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140035ad0
Capabilities:
Check http status code

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x140100a58]
mov rbx, rcx
mov qword [0x140107950], rcx
cmp byte [rax + 0x139], 0
je 0x140035b37
movsxd rax, dword [0x140105dd8]
mov qword [rsp + 0x30], rdi
lea rdi, [0x140000000]
mov qword [rdi + rax*8 + 0x106420], rcx
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
movsxd rdx, dword [0x140105dd8]
mov dword [rdi + rdx*4 + 0x105de0], eax
inc edx
mov rdi, qword [rsp + 0x30]
xor eax, eax
cmp edx, 0x190
cmovge edx, eax
mov dword [0x140105dd8], edx
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rbx
call fcn.14006c300
cmp eax, 1
jne 0x140035b5a
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400333a0
add rsp, 0x20
pop rbx
ret
Function at 0x1400383e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov qword [rsp + 0x70], rcx
mov edx, 0xfffe
mov r14, rcx
call fcn.14008b9a0
mov r8d, dword [0x140105dd8]
lea r9, [0x140000000]
movsxd rdx, eax
mov ebp, 0x190
mov edi, r8d
lea rax, [r14 + rdx*2]
mov qword [rsp + 0x80], rax
xor r15b, r15b
mov r13, rax
test ebp, ebp
jle 0x14003855c
movsxd rbx, edi
mov esi, 2
mov r12d, ebp
nop dword [rax + rax]
cmp edi, 0x190
jl 0x140038465
sub edi, 0x190
sub rbx, 0x190
cmp qword [r9 + rbx*8 + 0x106420], 0
je 0x14003853f
movzx r14d, r15b
lea eax, [rsi - 1]
xor r15b, r15b
cmp eax, ebp
jge 0x140038591
test r14b, r14b
jne 0x14003853f
mov edx, dword [r9 + rbx*4 + 0x105de0]
lea rax, [rbx + 1]
xor ecx, ecx
cmp edi, 0x18f
cmovl rcx, rax
mov eax, dword [r9 + rcx*4 + 0x105de0]
sub eax, edx
cmp eax, 0x7fffffff
jbe 0x1400384f1
mov r15b, 1
cmp esi, ebp
jne 0x1400384d5
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x105de0]
jmp 0x1400384f8
lea rax, [rbx + 2]
cmp rax, 0x190
jl 0x1400384e7
add rax, 0xfffffffffffffe70
mov eax, dword [r9 + rax*4 + 0x105de0]
sub eax, edx
lea rcx, [0x140000000]
mov rcx, qword [rcx + rbx*8 + 0x106420]
mov r9d, 0xfffe
mov r8, r13
mov byte [rsp + 0x28], r14b
sub r8, qword [rsp + 0x70]
mov rdx, r13
sar r8, 1
sub r9d, r8d
mov dword [rsp + 0x20], eax
mov r8d, 0xc8
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.140038720
mov r13, rax
lea r9, [0x140000000]
inc esi
inc edi
inc rbx
sub r12, 1
jne 0x140038450
mov r8d, dword [0x140105dd8]
mov r14, qword [rsp + 0x70]
mov rax, r13
mov edx, 0xfffe
sub rax, r14
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x1400385aa
cmp ebp, 0x78
jl 0x1400385aa
mov rax, qword [rsp + 0x80]
sub ebp, 0x64
mov edi, r8d
sub edi, ebp
add edi, 0x190
jmp 0x140038432
call qword [sym.imp.KERNEL32.DLL_GetTickCount]
lea rcx, [0x140000000]
sub eax, dword [rcx + rbx*4 + 0x105de0]
jmp 0x1400384f8
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r13
call fcn.14008b9a0
mov rbx, qword [rsp + 0x78]
movsxd rcx, eax
lea rax, [rcx*2]
add rax, r13
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003a040
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x14003a18b
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400bfa50
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x14003a0a1
mov rbx, qword [rcx + 0x6a0]
test rbx, rbx
jne 0x14003a0a1
mov ecx, dword [rcx + 0x2c8]
movzx eax, word [rdi + 0x2cc]
jmp 0x14003a0a9
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
movsxd r9, ecx
lea r8, str._s___d__:___Warning:__s_n
lea rcx, [0x140107148]
movzx eax, ax
mov r15d, 0x2000
mov qword [rsp + 0x28], r14
mov edx, r15d
mov dword [rsp + 0x20], eax
mov r9, qword [rcx + r9*8]
lea rcx, [rsp + 0x30]
call fcn.14008b9a0
cmp word [rbp], 0
movsxd rcx, eax
je 0x14003a105
sub r15d, ecx
lea rax, [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov edx, r15d
mov r9, rbp
lea r8, str._____Specifically:__s_n
call fcn.14008b9a0
mov r15, qword [rsp + 0x4058]
cmp esi, 3
jne 0x14003a12b
lea r9, [0x1400e4e50]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140039060
jmp 0x14003a170
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringW]
cmp esi, 2
jne 0x14003a170
test rbx, rbx
jne 0x14003a15c
mov rbx, qword [rdi + 0x6a0]
test rbx, rbx
jne 0x14003a15c
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.1400395f0
jmp 0x14003a170
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.1400392a0
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret