joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005ebc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov edx, 0xfffe
call fcn.1400ce300
mov r9, qword [rsp + 0x80]
lea r10, [0x140000000]
mov r8d, dword [0x140128af0]
mov ebp, 0x190
movsxd rdx, eax
mov r11d, 2
mov dword [rsp + 0x88], 0xffffffff
mov eax, r8d
lea rcx, [r9 + rdx*2]
mov qword [rsp + 0x98], rcx
nop dword [rax + rax]
xor r12b, r12b
mov r13, rcx
test ebp, ebp
jle 0x14005ee05
mov edx, ebp
mov esi, r11d
mov qword [rsp + 0x90], rdx
movsxd rcx, eax
nop
cmp eax, 0x190
lea rdi, [rcx - 0x190]
lea r14d, [rax - 0x190]
cmovl rdi, rcx
cmovl r14d, eax
cmp qword [r10 + rdi*8 + 0x129140], 0
je 0x14005edda
movzx r15d, r12b
lea eax, [rsi - 1]
xor r12b, r12b
cmp eax, ebp
jge 0x14005ed04
test r15b, r15b
jne 0x14005edda
mov r8d, dword [r10 + rdi*4 + 0x128b00]
lea eax, [r14 + 1]
xor edx, edx
lea rcx, [rdi + 1]
cmp eax, 0x190
cmovl rdx, rcx
mov ebx, dword [r10 + rdx*4 + 0x128b00]
sub ebx, r8d
cmp ebx, 0x7fffffff
jbe 0x14005ed23
mov r12b, 1
cmp esi, ebp
jne 0x14005ecdf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x128b00]
jmp 0x14005ed1b
lea rax, [rdi + 2]
mov rcx, 0xfffffffffffffe72
cmp rax, 0x190
cmovl rcx, r11
add rcx, rdi
mov ebx, dword [r10 + rcx*4 + 0x128b00]
sub ebx, r8d
jmp 0x14005ed23
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x128b00]
mov r9, qword [rsp + 0x80]
mov rcx, qword [r10 + rdi*8 + 0x129140]
movzx eax, word [rcx + 2]
cmp dword [rsp + 0x88], eax
je 0x14005ed82
mov ecx, eax
mov dword [rsp + 0x88], eax
mov edx, 0xfffe
lea r8, str.______s_r_n
mov rax, r13
sub rax, r9
mov r9, qword [0x140128ad0]
sar rax, 1
sub edx, eax
mov r9, qword [r9 + rcx*8]
mov rcx, r13
call fcn.1400ce300
movsxd rcx, eax
lea r13, [r13 + rcx*2]
lea rcx, [0x140000000]
mov rcx, qword [rcx + rdi*8 + 0x129140]
mov r8d, 0xc8
mov byte [rsp + 0x28], r15b
mov r9d, 0xfffe
mov dword [rsp + 0x20], ebx
mov rax, r13
mov rdx, r13
sub rax, qword [rsp + 0x80]
sar rax, 1
sub r9d, eax
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.14005ee60
mov rdx, qword [rsp + 0x90]
lea r10, [0x140000000]
mov r9, qword [rsp + 0x80]
mov r13, rax
mov r11d, 2
inc esi
lea eax, [r14 + 1]
sub rdx, 1
lea rcx, [rdi + 1]
mov qword [rsp + 0x90], rdx
jne 0x14005ec50
mov r8d, dword [0x140128af0]
mov rcx, qword [rsp + 0x98]
mov rax, r13
mov edx, 0xfffe
sub rax, r9
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x14005ee31
cmp ebp, 0x78
jl 0x14005ee31
sub ebp, 0x64
mov eax, r8d
sub eax, ebp
add eax, 0x190
jmp 0x14005ec30
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r13
call fcn.1400ce300
movsxd rcx, eax
lea rax, [rcx*2]
add rax, r13
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400608d0
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x140060a2b
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400ecec0
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x140060931
mov rbx, qword [rcx + 0x6d0]
test rbx, rbx
jne 0x140060931
mov ecx, dword [rcx + 0x288]
movzx eax, word [rdi + 0x28c]
jmp 0x140060939
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
mov r9, qword [0x140128ad0]
lea r8, str._s___d__:___Warning:__s_n
movsxd rcx, ecx
mov r15d, 0x2000
movzx eax, ax
mov edx, r15d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
mov r9, qword [r9 + rcx*8]
lea rcx, [rsp + 0x30]
call fcn.1400ce300
cmp word [rbp], 0
movsxd rcx, eax
je 0x140060995
sub r15d, ecx
lea rax, [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov edx, r15d
mov r9, rbp
lea r8, str._____Specifically:__s_n
call fcn.1400ce300
mov r15, qword [rsp + 0x4058]
lea rdx, [rsp + 0x30]
cmp esi, 3
jne 0x1400609bb
lea r9, [0x140109504]
xor r8d, r8d
mov rcx, rdi
call fcn.14005f7e0
jmp 0x140060a10
lea rcx, [0x140126960]
call fcn.14000d040
test al, al
jne 0x1400609d6
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x140060a10
test rbx, rbx
jne 0x1400609fc
mov rbx, qword [rdi + 0x6d0]
test rbx, rbx
jne 0x1400609fc
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.14005fed0
jmp 0x140060a10
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.14005fa50
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret
Function at 0x140065bf0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x140
movsxd rax, dword [rcx]
movzx r12d, r9b
mov edi, r8d
mov r15, rdx
mov r14, rcx
cmp eax, 6
ja case.0x140065c2d.1
lea r9, [0x140000000]
mov eax, dword [r9 + rax*4 + 0x65e4c]
add rax, r9
jmp rax
lea rax, str.Timeout
jmp 0x140065c60
lea rax, str.Match
jmp 0x140065c60
mov qword [rsp + 0x170], rsi
mov rsi, r15
test r15, r15
jne 0x140065c76
lea rax, str.EndKey
mov rsi, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x178]
add rsp, 0x140
pop r15
pop r14
pop r12
ret
test r12b, r12b
je 0x140065c8c
movups xmm0, xmmword [str.EndKey:]
lea rsi, [rdx + 0xe]
sub edi, 7
movups xmmword [rdx], xmm0
movzx eax, word [rcx + 0x6a]
mov qword [rsp + 0x168], rbp
test ax, ax
je 0x140065cab
xor ebp, ebp
mov word [rsi], ax
mov word [rsi + 2], bp
jmp 0x140065dfe
cmp byte [rcx + 0x6d], 0
mov qword [rsp + 0x160], rbx
je 0x140065d35
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x50], pe_nt_image_headers64
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140023830
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, byte [r14 + 0x66]
xor ebp, ebp
mov ebx, ebp
mov rdi, rax
cmp dword [0x1401278bc], ebx
setne bl
xor edx, edx
call fcn.140024e60
movzx ecx, byte [r14 + 0x66]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov r9, rsi
movzx edx, ax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
movsxd rcx, eax
mov word [rsi + rcx*2], bp
jmp 0x140065df6
xor ebp, ebp
movzx ecx, bp
mov word [rsi], bp
cmp byte [r14 + 0x6c], cl
je 0x140065d90
movzx edx, word [r14 + 0x68]
lea rax, [0x140124228]
mov ecx, ebp
lea r8, [0x1401242f8]
cmp word [rax], dx
je 0x140065d6a
inc ecx
add rax, 0x10
cmp rax, r8
jl 0x140065d58
jmp 0x140065d95
movsxd rdx, ecx
mov rcx, rsi
add rdx, rdx
movsxd rbx, edi
mov rdx, qword [r9 + rdx*8 + 0x124220]
lea r8, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rsi + rbx*2 - 2], bp
movzx ecx, word [rsi]
test cx, cx
jne 0x140065ddb
test r12b, r12b
je 0x140065da2
mov ecx, ebp
cmp byte [r14 + 0x6c], cl
jne 0x140065dbd
cmp byte [r14 + 0x6c], bpl
mov r8d, edi
movzx ecx, byte [r14 + 0x66]
mov rdx, rsi
sete r9b
call fcn.140023b40
movzx ecx, word [rsi]
test cx, cx
jne 0x140065ddb
movzx r9d, word [r14 + 0x68]
lea r8, str.sc_03X
mov edx, edi
mov rcx, rsi
call fcn.1400ce300
movzx ecx, word [rsi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x140065df6
cmp word [rsi + 2], bp
jne 0x140065df6
test r12b, r12b
je 0x140065df6
sub cx, 0x20
mov word [rsi], cx
mov rbx, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x168]
lea rax, str.EndKey
test r12b, r12b
cmovne rax, r15
jmp 0x140065c58
lea rax, [0x1401092f8]
jmp 0x140065c60
lea rax, str.NewInput
jmp 0x140065c60
lea rax, str.Stopped
jmp 0x140065c60
lea rax, [0x1400ef7e4]
jmp 0x140065c60
Function at 0x1400679b0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rsi, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
mov rbx, rcx
call fcn.140077860
mov rdi, rax
test rax, rax
je 0x140067aed
mov rdx, rsi
mov rcx, rax
call fcn.1400d5630
mov rsi, rax
test rax, rax
je 0x140067aed
mov qword [rsp + 0x40], rbp
xor edx, edx
mov rcx, rdi
xor bpl, bpl
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
je 0x140067a4f
cmp eax, dword [0x14012af90]
je 0x140067a4f
mov rcx, rdi
call fcn.1400d5bd0
test al, al
jne 0x140067a4f
mov ecx, dword [0x14012af90]
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bpl
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x140067abd
mov rcx, qword [0x140127a38]
lea rdx, [0x1400ef8c4]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d3350
mov rax, qword [0x140124200]
cmp dword [rax + 0x78], 0xffffffff
jle 0x140067abd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14012af90], eax
je 0x140067aa9
mov rax, qword [0x140124200]
mov ecx, dword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140067abd
mov rcx, qword [0x140124200]
mov edx, 1
mov ecx, dword [rcx + 0x78]
call fcn.140001a20
test bpl, bpl
mov rbp, qword [rsp + 0x40]
je 0x140067ad8
mov ecx, dword [0x14012af90]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.14005f650

Function at 0x140068550
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
call fcn.140077860
test rax, rax
je 0x140068596
lea rdx, str.msctls_statusbar321
mov rcx, rax
call fcn.1400d5630
mov rbx, rax
jmp 0x140068598
xor ebx, ebx
mov rcx, rdi
call fcn.14001de50
mov rcx, qword [0x140129dc0]
lea r9, [0x1400ef7e4]
mov r8d, eax
mov dword [rsp + 0x68], gethostbyname
mov rdx, rbx
mov dword [rsp + 0x60], 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d51d0
Function at 0x1400695a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov rbx, qword [0x140129dc0]
mov qword [rsp + 0x20], rax
call fcn.140077860
mov rsi, rax
mov ebp, 1
test rax, rax
je 0x1400695e5
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
jmp 0x1400695e7
mov edi, ebp
lea eax, [rdi - 1]
mov byte [rsp + 0x20], bpl
movsxd r8, eax
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.1400d3350
cmp eax, ebp
je 0x14006960a
xor eax, eax
jmp 0x140069724
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
test rsi, rsi
je 0x1400696b7
mov qword [rsp + 0x40], r14
call fcn.140001780
mov rdx, rax
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [rbx + 0x23], 0
movsxd r14, eax
jne 0x140069643
mov rsi, qword [rbx + 0x10]
jmp 0x140069646
mov rsi, rbx
lea rdi, [0x14012d5d0]
cmp byte [rsi + 0x23], bpl
jne 0x140069667
test byte [rsi + 0x21], 8
je 0x140069661
mov rcx, rsi
call fcn.140001620
add rsi, 0x10
jmp 0x14006966a
mov rsi, rdi
lea rax, [r14 + r14]
mov r14, qword [rsp + 0x40]
mov qword [rsi], rax
cmp byte [rbx + 0x23], 0
jne 0x140069682
mov rsi, qword [rbx + 0x10]
jmp 0x140069685
mov rsi, rbx
cmp byte [rsi + 0x23], bpl
jne 0x14006969d
test byte [rsi + 0x21], 8
je 0x140069699
mov rcx, rsi
call fcn.140001620
lea rdi, [rsi + 0x10]
cmp qword [rdi], 2
jae 0x1400696f4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.140001780
xor esi, esi
mov word [rax], si
jmp 0x1400696f4
call fcn.140001780
xor esi, esi
mov word [rax], si
cmp byte [rbx + 0x23], sil
jne 0x1400696cd
mov rdi, qword [rbx + 0x10]
jmp 0x1400696d0
mov rdi, rbx
cmp byte [rdi + 0x23], bpl
jne 0x1400696ea
test byte [rdi + 0x21], 8
je 0x1400696e4
mov rcx, rdi
call fcn.140001620
add rdi, 0x10
jmp 0x1400696f1
lea rdi, [0x14012d5d0]
mov qword [rdi], rsi
cmp byte [rbx + 0x23], 0
jne 0x1400696fe
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14006971e
cmp qword [0x14012bc60], 0
je 0x14006971e
lea rcx, [0x14012bc48]
call fcn.1400075e0
mov ebp, eax
jmp 0x140069722
and byte [rbx + 0x21], 0x86
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400697b0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11cf0
call fcn.1400ecec0
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1889], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x188c], eax
lea rcx, [0x1400ef7e4]
mov qword [rsp + 0x18a0], rax
cmp edx, 6
mov rdx, qword [0x140124200]
xorps xmm0, xmm0
mov dword [rsp + 0x18a8], eax
mov qword [rsp + 0x18b0], rax
mov qword [rsp + 0x18c8], rax
cmove rax, rbx
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x11d28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d20]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.1400d5e60
test eax, eax
je 0x140069861
lea rdx, [rsp + 0x30]
lea rcx, [0x1400d4e70]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x188c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001580
mov eax, 1
add rsp, 0x11cf0
pop rbx
ret

Function at 0x14006a7c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400ecec0
sub rsp, rax
mov rbx, qword [0x140129dc0]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x14006a8a2
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.1400d3350
test eax, eax
je 0x14006a8bf
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.140001780
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x14006a860
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.140001780
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14006a86a
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x14006a892
cmp qword [0x14012bc60], 0
je 0x14006a892
lea rcx, [0x14012bc48]
call fcn.1400075e0
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x14006a8bf
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x14006a8bf
test esi, esi
lea rax, [0x1400ef7e4]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.1400d3350
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x14006d830
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x250
mov rbp, r9
mov qword [rsp + 0x20], r8
mov r9, qword [0x14012bb90]
mov r15, r8
lea r8, str.__s_s
mov edx, 0x800
mov r14, rcx
call fcn.1400ce300
movsxd rbx, eax
lea edi, [rbx + 1]
cmp edi, 0x800
jg 0x14006d8bf
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006d8bf
movsxd rax, edi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
xor edi, edi
mov rcx, qword [rsp + 0x290]
mov word [r14 + rax*2], di
mov rax, qword [0x14012bb90]
mov qword [rcx], rax
mov al, 1
jmp 0x14006da5a
xor edi, edi
mov esi, edi
mov r9d, esi
lea rax, [rsp + 0x30]
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAutoHotkey
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006da3f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x278]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x40]
mov dword [rsp + 0x278], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14006da3f
mov eax, dword [rsp + 0x278]
test eax, eax
je 0x14006da3f
shr eax, 1
mov r8d, eax
dec eax
mov edx, eax
mov dword [rsp + 0x278], eax
cmp word [rsp + rax*2 + 0x40], di
jne 0x14006d988
test eax, eax
je 0x14006da46
dec edx
cmp word [rsp + rdx*2 + 0x40], di
jne 0x14006d9a6
mov dword [rsp + 0x278], edx
mov eax, edx
test edx, edx
jne 0x14006d970
jmp 0x14006d9a6
mov dword [rsp + 0x278], r8d
cmp r8d, 0x104
jae 0x14006da3f
mov word [rsp + r8*2 + 0x40], di
mov eax, r8d
test eax, eax
je 0x14006da46
test rbp, rbp
je 0x14006d9e1
lea rcx, [rsp + 0x40]
mov r9, rbp
sub r9, rcx
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [r9 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x14006d9d0
test eax, eax
je 0x14006da58
mov r9, rbp
mov qword [rsp + 0x20], r15
lea r8, str.__s_s
mov edx, 0x800
mov rcx, r14
call fcn.1400ce300
movsxd rbx, eax
lea esi, [rbx + 1]
cmp esi, 0x800
jg 0x14006da58
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006da58
movsxd rax, esi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
mov word [r14 + rax*2], di
mov rax, qword [rsp + 0x290]
mov qword [rax], rbp
mov al, 1
jmp 0x14006da5a
mov word [rsp + 0x40], di
mov eax, edi
test esi, esi
jne 0x14006d9ae
mov esi, 0x200
jmp 0x14006d8c3
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14006da80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2260
call fcn.1400ecec0
sub rsp, rax
lea rax, [rsp + 0x2290]
mov r8, rcx
lea rcx, [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
movzx esi, dl
lea rbx, [rsp + 0x1260]
lea rdi, [0x1400ef7e4]
call fcn.14006d830
test al, al
jne 0x14006dad4
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x2298], r15
xor r15d, r15d
test sil, sil
je 0x14006db96
mov rsi, qword [rsp + 0x2290]
lea rax, str.AutoHotkey.exe
mov r9, rsi
mov qword [rsp + 0x2280], rbp
lea r8, str.__s_s
mov qword [rsp + 0x2288], r14
mov edx, 0x800
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x260]
call fcn.1400ce300
movsxd rbp, eax
lea r14d, [rbp + 1]
cmp r14d, 0x800
jg 0x14006db6e
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14006db6e
movsxd rax, r14d
lea rbx, [rsp + 0x260]
mov ecx, SafeArrayAllocDescriptor
mov word [rsp + rbp*2 + 0x260], cx
mov word [rsp + rax*2 + 0x260], r15w
jmp 0x14006db7e
cmp rsi, qword [0x14012bb90]
jne 0x14006db86
mov rbx, qword [0x14012bb88]
lea rdi, [rsp + 0x1260]
mov rbp, qword [rsp + 0x2280]
mov r14, qword [rsp + 0x2288]
mov qword [rsp + 0x48], r15
lea rcx, [0x14012afc0]
mov byte [rsp + 0x40], r15b
xor r9d, r9d
mov byte [rsp + 0x38], r15b
mov r8, rdi
mov qword [rsp + 0x30], r15
mov rdx, rbx
mov qword [rsp + 0x28], r15
mov byte [rsp + 0x20], r15b
call fcn.1400612f0
mov r15, qword [rsp + 0x2298]
test eax, eax
setne al
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400728a0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
sub rsp, 0x250
mov rbp, qword [0x140129dc0]
xor ecx, ecx
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140024050
movzx r14d, al
test al, al
jne 0x14007293f
xor r8d, r8d
lea rdx, [rsp + 0x270]
mov rcx, rbx
call fcn.1400926c0
xor r9d, r9d
test eax, eax
jne 0x14007290a
lea rdx, [0x1400ef7e4]
jmp 0x1400729ad
mov edx, dword [rsp + 0x270]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x30]
xor edi, edi
mov ecx, eax
mov dword [rsp + 0x40], edi
call fcn.140092ab0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400d29e0
jmp 0x1400729c1
mov qword [rsp + 0x278], rsi
mov ebx, 2
movzx esi, word [rdi]
xor edi, edi
test esi, 0xffffff80
je 0x14007295d
mov eax, edi
jmp 0x140072967
mov edx, ebx
mov ecx, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
mov ecx, esi
and ecx, 0xffffffdf
test eax, eax
cmove ecx, esi
mov rsi, qword [rsp + 0x278]
cmp ecx, 0x50
je 0x140072986
cmp ecx, 0x54
cmovne ebx, edi
jmp 0x14007298b
mov ebx, 1
mov edx, ebx
movzx ecx, r14b
call fcn.140092a00
test al, al
lea rcx, [0x14010fc08]
lea rdx, [0x14010fc0c]
cmovne rdx, rcx
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
mov rcx, rbp
call fcn.1400d3350
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rdi
pop rbp
ret

Function at 0x1400729e0
Capabilities:
Get disk size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
xor r9d, r9d
mov byte [rsp + 0x20], 1
movzx esi, r8b
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov rcx, qword [0x140129dc0]
lea r8, [r9 - 1]
call fcn.1400d3350
test rbx, rbx
je 0x140072af3
cmp word [rbx], 0
je 0x140072af3
mov r8d, 0x103
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor edx, edx
lea rcx, [rsp + 0x40]
mov word [rsp + 0x246], dx
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x140072a53
lea rcx, [rax + rax]
cmp word [rsp + rcx + 0x3e], 0x5c
je 0x140072a7f
inc rax
cmp rax, 0x104
jae 0x140072af3
mov dword [rsp + rcx + 0x40], 0x5c
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x268]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140072af3
mov rbx, qword [rsp + 0x268]
lea rdx, [0x1400ef8c4]
mov rcx, qword [0x140127a38]
test sil, sil
mov byte [rsp + 0x20], 1
cmovne rbx, qword [rsp + 0x278]
xor r9d, r9d
shr rbx, 0x14
lea r8, [r9 - 1]
call fcn.1400d3350
mov rcx, qword [0x140129dc0]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, rbx
call fcn.140001580
mov eax, 1
jmp 0x140072afd
mov dl, 1
mov rcx, rdi
call fcn.14005f650
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140074a70
Capabilities:
Set current directory

Disassembly:
push rbx
sub rsp, 0x30
movzx eax, word [rcx]
mov rbx, rcx
test ax, ax
je 0x140074aa8
cmp word [rcx + 2], 0x3a
jne 0x140074aa8
cmp word [rcx + 4], 0
jne 0x140074aa8
mov word [rsp + 0x40], ax
lea rbx, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x42], 0x5c003a
mov word [rsp + 0x46], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x140074af0
cmp byte [0x14012bba0], al
je 0x140074b20
mov rax, qword [0x140124200]
lea rdx, [0x14010621c]
test byte [rax + 0x140], 1
je 0x140074b08
mov rcx, qword [0x14012b690]
lea r9, [0x1400ef7e4]
xor r8d, r8d
call fcn.14005f580
add rsp, 0x30
pop rbx
ret
cmp byte [0x14012bba0], 0
je 0x140074b20
mov rcx, rbx
call fcn.140074b30
lea rdx, [0x1400ef8c4]
mov rcx, qword [0x140127a38]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400d3350
add rsp, 0x30
pop rbx
ret

Function at 0x140074b30
Capabilities:
Get common file path

Disassembly:
push rbx
mov eax, 0x10020
call fcn.1400ecec0
sub rsp, rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140074b5d
lea rbx, [rsp + 0x20]
jmp 0x140074b62
test rbx, rbx
je 0x140074b71
mov rdx, rbx
lea rcx, vtable.CKuStringT_wchar_t__class_CKuStringUtilW_.0
call fcn.1400930d0
add rsp, 0x10020
pop rbx
ret

Function at 0x140074b80
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10028
call fcn.1400ecec0
sub rsp, rax
lea rdx, [rsp + 0x20]
mov ecx, 0x8000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140074bb4
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
add rsp, 0x10028
ret
xor eax, eax
add rsp, 0x10028
ret