joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40efd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [0x0089d0a8], 0
je 0x40f06e
cmp word [0x0089d3b8], 0xd7b2
jne 0x40f003
cmp dword [0x0089d3c0], 0
jbe 0x40f003
lea rcx, [0x0089d3b0]
call qword [0x0089d3d8]
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rcx, rax
lea rdx, [0x0083fba8]
mov r8d, 0x25
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
mov ecx, 0xfffffff5
call sub.kernel32.dll_GetStdHandle
mov rbx, rax
lea rcx, [0x0040f0a4]
call fcn.00410370
mov rcx, rbx
mov rdx, rax
mov r8d, 2
lea r9, [rsp + 0x3c]
mov qword [rsp + 0x20], 0
call sub.kernel32.dll_WriteFile
jmp 0x40f090
cmp byte [0x0083e052], 0
jne 0x40f090
xor rcx, rcx
lea rdx, [0x0083fba8]
lea r8, str.Error
xor r9, r9
call sub.user32.dll_MessageBoxA
add rsp, 0x40
pop rbx
ret

Function at 0x40f370
Capabilities:
Create thread

Disassembly:
push r13
push rdi
push rsi
push rbx
sub rsp, 0x48
mov qword [rsp + 0x38], rcx
mov ebx, edx
mov rsi, r8
mov rdi, r9
cmp qword [0x0083e058], 0
je 0x40f3a1
mov rcx, rsi
mov rdx, rdi
call qword [0x0083e058]
mov r13, rax
jmp 0x40f3b7
mov ecx, 0x10
call fcn.00408dd0
mov r13, rax
mov qword [r13], rsi
mov qword [r13 + 8], rdi
mov byte [0x0089d0a9], 1
mov rcx, qword [rsp + 0x38]
mov edx, ebx
lea r8, [0x0040f300]
mov r9, r13
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread
mov rbx, rax
test rbx, rbx
jne 0x40f3fc
mov rcx, r13
call fcn.00408e00
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop r13
ret
Function at 0x4137c0
Capabilities:
Get geographical location

Disassembly:
push rbp
sub rsp, 0x1d0
mov rbp, rsp
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], rdx
mov word [rbp + 0x4e], r8w
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
nop
mov rcx, qword [rbp + 0x40]
call fcn.0040f580
movzx rax, word [rbp + 0x4e]
cmp word [0x008402e0], ax
ja 0x4138a8
movzx rax, word [rbp + 0x4e]
cmp ax, word [0x008406e0]
mov word [rbp + 0x4e], ax
ja 0x4138a8
mov ecx, 0x40
xor r8, r8
cmp ecx, r8d
jb 0x4138a7
mov eax, ecx
add eax, r8d
mov r9d, 2
xor edx, edx
div r9d
lea rdx, [0x008402e0]
mov r9d, eax
add r9, r9
movzx r10, word [rbp + 0x4e]
cmp word [rdx + r9*8], r10w
jbe 0x413861
mov ecx, eax
sub ecx, 1
jmp 0x4138a2
lea rdx, [0x008402e0]
mov r8d, eax
add r8, r8
movzx r9, word [rbp + 0x4e]
cmp word [rdx + r8*8], r9w
jae 0x413883
mov r8d, eax
add r8d, 1
jmp 0x4138a2
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x40]
lea r8, [0x008402e8]
mov eax, eax
add rax, rax
mov r8, qword [r8 + rax*8]
call fcn.00413650
jmp 0x4138a7
cmp ecx, r8d
jae 0x413830
nop
mov rax, qword [rbp + 0x40]
cmp qword [rax], 0
jne 0x41398a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x41398a
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x59
lea r8, [rbp + 0x126]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
movzx rcx, word [rbp + 0x4e]
movzx ecx, cx
mov edx, 0x5a
lea r8, [rbp + 0x7c]
mov r9d, 0x55
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x68]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00410a30
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x7c]
mov r8d, 0x55
call fcn.00410a30
lea rcx, [rbp + 0x58]
lea rdx, [rbp + 0x126]
mov r8d, 0x55
call fcn.00410a30
mov rcx, qword [rbp + 0x40]
mov edx, 5
mov r8, qword [rbp + 0x68]
lea r9, [0x004139e4]
mov rax, qword [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rax, [0x004139f4]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.00410eb0
nop
lea rcx, [rbp + 0x58]
mov edx, 3
call fcn.0040f660
mov rax, qword [rbp + 0x40]
lea rsp, [rbp + 0x1d0]
pop rbp
ret
Function at 0x413c00
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x36], dx
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
nop
lea rcx, [0x008a1e70]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
cmp word [0x008a1e98], ax
jne 0x413c6b
mov rcx, qword [rbp + 0x28]
lea rdx, [0x008a1e9a]
mov r8d, 0x55
call fcn.00410a30
lea rcx, [0x008a1e70]
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x413d76
lea rcx, [0x008a1e70]
call sub.kernel32.dll_LeaveCriticalSection
mov rcx, qword [rbp + 0x28]
call fcn.0040f580
movzx rcx, word [rbp + 0x36]
movzx ecx, cx
mov edx, 2
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x413d30
cmp byte [0x008a1e68], 0
je 0x413cc4
mov rcx, rbp
lea rdx, [rbp + 0x48]
movzx r8, word [rbp + 0x36]
call fcn.00413a90
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x48]
call fcn.0040fbd0
jmp 0x413d30
mov rcx, rbp
lea rdx, [rbp + 0x40]
movzx r8, word [rbp + 0x36]
call fcn.004137c0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040fbd0
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx rcx, word [rbp + 0x36]
cmp cx, ax
mov word [rbp + 0x36], cx
je 0x413d30
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
je 0x413d0f
mov rcx, qword [rbp + 0x28]
lea rdx, [0x00413dc4]
call fcn.00410ca0
call sub.kernel32.dll_GetSystemDefaultUILanguage
mov rcx, rbp
lea rdx, [rbp + 0x38]
mov r8d, eax
call fcn.004137c0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x38]
call fcn.00410ca0
lea rcx, [0x008a1e70]
call sub.kernel32.dll_EnterCriticalSection
movzx rax, word [rbp + 0x36]
mov word [0x008a1e98], ax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rax]
call fcn.00410930
lea rcx, [0x008a1e9a]
mov edx, 0xaa
mov r8, rax
call fcn.00413570
lea rcx, [0x008a1e70]
call sub.kernel32.dll_LeaveCriticalSection
nop
lea rcx, [rbp + 0x38]
mov edx, 3
call fcn.0040f660
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4147a0
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x20], rdx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x70], r8
mov rcx, qword [rbp + 0x70]
call fcn.0040f710
nop
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx ecx, ax
mov edx, 3
lea r8, [rbp + 0x48]
mov r9d, 4
call sub.kernel32.dll_GetLocaleInfoW
lea rcx, [rbp + 0x38]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00410a30
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x38]
call fcn.00410d90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.004145c0
test al, al
jne 0x41486e
mov word [rbp + 0x4c], 0
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x48]
mov r8d, 4
call fcn.00410a30
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x70]
mov r8, qword [rbp + 0x30]
call fcn.00410d90
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax]
call fcn.004145c0
test al, al
jne 0x41486e
mov rcx, qword [rbp + 0x20]
call fcn.0040f580
nop
lea rcx, [rbp + 0x30]
mov edx, 2
call fcn.0040f660
lea rcx, [rbp + 0x70]
call fcn.0040f580
mov rax, qword [rbp + 0x20]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x4148e0
Capabilities:
Identify system language via api

Disassembly:
push rbp
sub rsp, 0x70
mov rbp, rsp
mov qword [rbp + 0x28], rcx
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x88], rdx
mov qword [rbp + 0x90], r8
mov rcx, qword [rbp + 0x88]
call fcn.0040f710
mov rcx, qword [rbp + 0x90]
call fcn.0040f710
nop
mov rcx, qword [rbp + 0x28]
call fcn.0040f580
cmp qword [rbp + 0x90], 0
je 0x414aa6
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
call fcn.0040fc50
xor rax, rax
cmp qword [rbp + 0x90], 0
je 0x414991
mov rax, qword [rbp + 0x90]
mov eax, dword [rax - 4]
cmp eax, 1
jl 0x4149cb
mov rcx, qword [rbp + 0x90]
movsxd rdx, eax
cmp word [rcx + rdx*2 - 2], 0x2e
jne 0x4149c4
lea rcx, [rbp + 0x60]
mov rdx, qword [rbp + 0x90]
mov r8d, 1
mov r9d, eax
call fcn.00410fa0
jmp 0x4149cb
sub eax, 1
test eax, eax
jne 0x414996
nop
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x88]
call fcn.004144b0
cmp qword [rbp + 0x68], 0
je 0x414a09
mov rcx, rbp
lea rdx, [rbp + 0x58]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x68]
call fcn.00414660
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x58]
call fcn.0040fbd0
jmp 0x414aa5
call sub.kernel32.dll_GetUserDefaultUILanguage
lea rcx, [rbp + 0x48]
mov edx, eax
call fcn.00413c00
mov rcx, rbp
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x48]
call fcn.00414660
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x50]
call fcn.0040fbd0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x414a7e
cmp byte [0x008a1e68], 0
jne 0x414a7e
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea rcx, [rbp + 0x38]
mov edx, eax
call fcn.00413c00
mov rcx, rbp
lea rdx, [rbp + 0x40]
mov r8, qword [rbp + 0x60]
mov r9, qword [rbp + 0x38]
call fcn.00414660
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x40]
call fcn.0040fbd0
mov rax, qword [rbp + 0x28]
cmp qword [rax], 0
jne 0x414aa5
mov rcx, rbp
lea rdx, [rbp + 0x30]
mov r8, qword [rbp + 0x60]
call fcn.004147a0
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
call fcn.0040fbd0
nop
lea rcx, [rbp + 0x30]
mov edx, 8
call fcn.0040f660
lea rcx, [rbp + 0x88]
mov edx, 2
call fcn.0040f660
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x70]
pop rbp
ret

Function at 0x417210
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
call fcn.00417200
mov ebx, eax
test ebx, ebx
je 0x41725b
cmp dword [0x00841118], 0xffffffff
jne 0x417234
mov ecx, 0xe2
call fcn.0040f280
mov ecx, ebx
call fcn.004171e0
test rax, rax
jne 0x41724d
mov ecx, 0xe2
call fcn.0040f280
jmp 0x41725b
mov ecx, dword [0x00841118]
mov rdx, rax
call sub.kernel32.dll_TlsSetValue
add rsp, 0x20
pop rbx
ret
Function at 0x417270
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x008a1f44], 0
je 0x4172ab
mov ecx, dword [0x00841118]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4172be
call fcn.00417210
mov ecx, dword [0x00841118]
call sub.kernel32.dll_TlsGetValue
test rax, rax
jne 0x4172be
mov rax, qword [0x008a1f78]
jmp 0x4172be
mov rax, qword gs:[0x58]
mov ecx, dword [0x00841118]
mov rax, qword [rax + rcx*8]
add rsp, 0x28
ret

Function at 0x527ce0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rsi, rcx
lea rdi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
cmp qword [0x008a6e68], 0
jne 0x527d95
xor rcx, rcx
mov edx, 0x1000
mov r8d, 0x1000
mov r9d, 0x40
call sub.kernel32.dll_VirtualAlloc_1
mov rbx, rax
mov rax, qword [0x008a6e60]
mov qword [rbx], rax
lea rcx, [0x008594a4]
lea rdx, [rbx + 8]
mov r8d, 8
call fcn.004091a0
lea rax, [0x00527ca0]
mov qword [rbx + 0x10], rax
lea rsi, [rbx + 0x18]
mov byte [rsi], 0xe8
mov rcx, rsi
lea rdx, [rbx + 8]
call fcn.00527cd0
mov dword [rsi + 1], eax
mov rax, qword [0x008a6e68]
mov qword [rsi + 5], rax
mov qword [0x008a6e68], rsi
add rsi, 0x15
mov rax, rbx
neg rax
lea rax, [rsi + rax]
cmp rax, 0xfed
jl 0x527d53
mov qword [0x008a6e60], rbx
mov rax, qword [0x008a6e68]
mov rsi, qword [0x008a6e68]
mov rcx, qword [rsi + 5]
mov qword [0x008a6e68], rcx
lea rdi, [rsi + 5]
lea rsi, [rbp + 0x20]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x5955f0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
xor rax, rax
xor rcx, rcx
sub edx, 1
cmp ecx, edx
jg 0x595632
add edx, 1
mov r9d, eax
and r9w, 0xf800
movzx r9d, r9w
shr r9d, 0xb
shl eax, 5
or r9w, ax
mov eax, r9d
movzx r9w, byte [r8]
xor ax, r9w
add r8, 1
add ecx, 1
cmp ecx, edx
jne 0x595603
nop
ret
Function at 0x6c6430
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6c6662
mov rcx, qword [0x004d8968]
mov dl, 1
call fcn.0050ab60
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040f580
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6c663a
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005e4020
test al, al
je 0x6c6624
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006c66f4]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00434ff0
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6c6624
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006c6762]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6c6617
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00410a30
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6c6617
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.00410a30
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6c64d8
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.0050aa10
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040f580
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6c79f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x008a74e8]
cmp byte [rax + 0x159], 0
jne 0x6c7a93
cmp qword [0x008a7520], 0
jne 0x6c7a36
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x0087cc70]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x008a7520], rax
cmp qword [0x008a7518], 0
jne 0x6c7a58
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x008a7518], rax
cmp qword [0x008a7528], 0
jne 0x6c7a93
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x0087cc68]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x008a7528], rax
add rsp, 0x48
ret

Function at 0x6c8ce0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6c8dc6
cmp dword [rbx + 0x128], 0
jne 0x6c8dbc
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006c8bc0]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6c8dbc
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6c8d6a
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6c8dbb
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.00503120
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6c8d7b
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6c9110
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x008a74e8]
cmp qword [rax + 0x2d0], 0
je 0x6c92ea
test sil, sil
jne 0x6c9209
cmp dword [rbx + 0x138], 0
jne 0x6c91fa
mov rcx, rbx
call fcn.006cd850
lea rcx, [0x006c8fb0]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6c91bc
mov rax, qword [0x008a74e8]
cmp byte [rax + 0x193], 0
je 0x6c91bc
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6c9195
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c91bb
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c919d
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c91f9
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00503120
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c91cd
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6c92ea
cmp dword [rbx + 0x138], 0
jle 0x6c92ea
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6c92ea
cmp qword [rbx + 0xa8], 0
je 0x6c9289
mov rax, qword [0x008a74e8]
cmp byte [rax + 0x193], 0
je 0x6c9289
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6c925f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6c9288
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c9267
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6c92c6
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.00503120
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6c929a
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x006b3048]
call fcn.00412a10
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6cdc50
Capabilities:
Hide graphical window from taskbar

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov esi, edx
cmp sil, byte [rbx + 0x193]
je 0x6cde21
mov byte [rbx + 0x193], sil
cmp qword [rbx + 0xa8], 0
je 0x6cdd82
mov rcx, qword [rbx + 0xa8]
call fcn.005da360
test al, al
je 0x6cdd82
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 0x10
jne 0x6cdd82
mov rax, qword [rbx + 0xa8]
movzx rax, word [rax + 0x34]
test ax, 2
jne 0x6cdd82
test sil, sil
je 0x6cdcff
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
xor r8, r8
call fcn.006b7800
mov rcx, qword [rbx + 0xa8]
call fcn.005d9d60
mov rcx, rax
mov dl, 1
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006b7800
jmp 0x6cdd6a
call sub.user32.dll_GetForegroundWindow
mov rdi, rax
mov rcx, qword [rbx + 0xa8]
call fcn.005d9d60
cmp rdi, rax
sete dil
mov rcx, qword [rbx + 0xa8]
call fcn.005d9d60
mov rcx, rax
xor rdx, rdx
mov rax, qword [rbx + 0xa8]
movzx r8, byte [rax + 0xa9]
call fcn.006b7800
mov rcx, qword [rbx + 0x2d0]
mov dl, 1
mov r8b, 1
call fcn.006b7800
test dil, dil
je 0x6cdd6a
mov rcx, qword [rbx + 0xa8]
call fcn.005d9d60
mov rcx, rax
call sub.user32.dll_SetForegroundWindow
mov rcx, qword [rbx + 0xa8]
mov edx, 0xb033
xor r8, r8
xor r9, r9
call fcn.005cd770
test sil, sil
je 0x6cddcc
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
or rax, 0x80
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rcx, qword [rbx + 0x2d0]
xor rdx, rdx
call sub.user32.dll_SetWindowTextW
jmp 0x6cde21
mov rax, qword [rbx + 0x2d0]
mov rsi, qword [rbx + 0x2d0]
mov rcx, rax
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
and rax, 0xffffffffffffff7f
mov rcx, rsi
mov edx, 0xffffffec
mov r8, rax
call sub.user32.dll_SetWindowLongPtrW
mov rsi, qword [rbx + 0x2d0]
mov rax, qword [rbx + 0x118]
mov rcx, rax
call fcn.00410930
mov rcx, rsi
mov rdx, rax
call sub.user32.dll_SetWindowTextW
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140001920
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov qword [rsp + 0x30], 0
xor edx, edx
mov ecx, 6
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x14000195b
xor al, al
jmp 0x140001a49
mov rax, qword [rsp + 0x498]
mov dword [rax], 0
mov dword [rsp + 0x40], 0x238
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x234
rep stosb byte [rdi], al
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001a3c
mov rdx, qword [rsp + 0x490]
lea rcx, [rsp + 0x6c]
call fcn.14001f2d0
test eax, eax
jne 0x140001a25
lea rax, [rsp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x1f4
rep stosb byte [rdi], al
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov ecx, dword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400019fd
jmp 0x140001a25
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x498]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140001a49
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001999
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x480
pop rdi
ret

Function at 0x140002aa0
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x480
mov qword [rsp + 0x38], 0
cmp dword [rsp + 0x490], 0
je 0x140002acc
mov eax, dword [rsp + 0x490]
mov dword [rsp + 0x24], eax
jmp 0x140002ad8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x30], eax
xor edx, edx
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x140002b9c
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rsp + 0x40], 0x438
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140002b30
mov byte [rsp + 0x20], 1
jmp 0x140002b35
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x22], al
jmp 0x140002b68
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x140002b5a
mov byte [rsp + 0x21], 1
jmp 0x140002b5f
mov byte [rsp + 0x21], 0
movzx eax, byte [rsp + 0x21]
mov byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x22]
test eax, eax
je 0x140002b91
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x68], eax
jne 0x140002b8f
lea rcx, [rsp + 0x270]
call fcn.140001b70
mov qword [rsp + 0x38], rax
jmp 0x140002b91
jmp 0x140002b40
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x38]
add rsp, 0x480
pop rdi
ret