joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400137f0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
cmp r8, 0x7d4
jne 0x1400138ca
cmp dword [rcx + 0x48c], 0
jle 0x14001382d
mov dword [rcx + 0x48c], 0
jmp 0x1400139f1
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [rdi + 0x440]
call fcn.1400e8ee0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, rdi
call fcn.1400e8ee0
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [rdi + 0x440]
call fcn.1400e8ee0
mov rdx, rax
lea r8, [rsp + 0x30]
mov r9d, 2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1400139f1
mov rdx, qword [rdi + 0x458]
mov rcx, rdi
call fcn.140012bd0
test al, al
jne 0x1400139f1
mov rcx, qword [rdi + 0x418]
call fcn.14001f090
jmp 0x1400139f1
cmp r8, 0x7d6
jne 0x1400139f1
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rdi
call fcn.1400e8ee0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x20]
lea rcx, [rdi + 0x58]
call fcn.1400e29f0
test rax, rax
jne 0x1400139e2
cmp qword [rdi + 0x480], rax
je 0x140013925
cmp qword [rdi + 0x460], rax
je 0x1400139e2
mov qword [rsp + 0x68], rbx
mov rbx, qword [rdi + 0x460]
test rbx, rbx
je 0x140013980
nop word [rax + rax]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rbx
call fcn.1400e8ee0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x28]
lea rcx, [rbx + 0x58]
call fcn.1400e29f0
test rax, rax
jne 0x1400139dd
mov rbx, qword [rbx + 0x460]
test rbx, rbx
jne 0x140013940
mov rbx, qword [rdi + 0x458]
test rbx, rbx
je 0x1400139d0
nop dword [rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rbx
call fcn.1400e8ee0
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x30]
lea rcx, [rbx + 0x58]
call fcn.1400e29f0
test rax, rax
jne 0x1400139dd
mov rbx, qword [rbx + 0x458]
test rbx, rbx
jne 0x140013990
mov edx, 1
mov rcx, rdi
call fcn.1400e90a0
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rdi + 8]
mov edx, 0x7d6
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x50
pop rdi
ret
Function at 0x14001a420
Capabilities:
Log keystrokes via polling
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x250]
test al, al
jne 0x14001a46b
mov eax, dword [rdi]
sub eax, 9
cmp eax, 9
ja 0x14001a46b
mov rcx, qword [rbx + 0x60]
mov rdx, rdi
test rcx, rcx
je 0x14001a5a9
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [rax + 0x2b8]
mov eax, dword [rdi]
mov qword [rsp + 0x40], rsi
cmp eax, 0xd
jne 0x14001a511
lea rcx, str.DoEventForBtnDown_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rdi + 0x14]
lea rcx, [rbx + 0x17c]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x14001a591
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x238]
test al, al
je 0x14001a591
or dword [rbx + 0x600], 0x50
mov rcx, rbx
call fcn.1400ec070
mov rcx, qword [rbx + 0x58]
lea r8, str.buttondown
xor esi, esi
mov byte [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call fcn.1400e7380
mov rax, qword [rdi + 0x14]
mov qword [rbx + 0x1138], rax
cmp byte [rbx + 0x11c2], sil
jne 0x14001a505
mov rax, qword [rdi + 0x14]
mov qword [rbx + 0x1128], rax
mov qword [rbx + 0x11b8], rsi
jmp 0x14001a591
cmp eax, 9
jne 0x14001a591
cmp byte [rbx + 0x1161], 0
jne 0x14001a591
test byte [rbx + 0x600], 0x40
je 0x14001a591
lea ecx, [rax - 8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt eax, 0xf
jae 0x14001a591
cmp byte [rbx + 0x1160], 0
jne 0x14001a591
mov eax, dword [rdi + 0x14]
sub eax, dword [rbx + 0x1138]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jg 0x14001a566
mov eax, dword [rdi + 0x18]
sub eax, dword [rbx + 0x113c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xa
jle 0x14001a591
mov rcx, qword [rbx + 0x11a8]
call fcn.1400e8ee0
mov rcx, rax
lea r9, [rbx + 0x1138]
mov r8, rbx
mov edx, 0x44e
call qword [sym.imp.USER32.dll_PostMessageW]
mov byte [rbx + 0x1160], 1
cmp dword [rdi], 0xe
mov rsi, qword [rsp + 0x40]
jne 0x14001a5a6
mov rdx, rdi
mov rcx, rbx
call fcn.14001a5c0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400efa20

Function at 0x14001a5c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
lea rcx, str.DoEventForBtnUp_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbx + 0x600]
mov qword [rbx + 0x1138], 0
test al, 0x40
je 0x14001a635
and eax, 0xffffffaf
mov rcx, rbx
mov dword [rbx + 0x600], eax
call fcn.1400ec070
test rdi, rdi
je 0x14001a626
mov rdx, qword [rdi + 0x14]
lea rcx, [rbx + 0x17c]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x14001a626
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
mov rcx, rbx
call fcn.1400ec260
mov byte [rbx + 0x1160], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001aba0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.DoEventForBtnUp_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbx + 0x600]
mov qword [rbx + 0x1138], 0
test al, 0x40
je 0x14001abeb
and eax, 0xffffffaf
mov rcx, rbx
mov dword [rbx + 0x600], eax
call fcn.1400ec070
mov rcx, rbx
call fcn.1400ec260
mov byte [rbx + 0x1160], 0
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x678]
test rcx, rcx
jne 0x14001aba0
ret

Function at 0x140020b30
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.DoEventForBtnUp_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [rbx + 0x600]
mov qword [rbx + 0x1138], 0
test al, 0x40
je 0x14001abeb
and eax, 0xffffffaf
mov rcx, rbx
mov dword [rbx + 0x600], eax
call fcn.1400ec070
mov rcx, rbx
call fcn.1400ec260
mov byte [rbx + 0x1160], 0
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x678]
test rcx, rcx
jne 0x14001aba0
ret

Function at 0x140024650
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x4060
call fcn.140160af0
sub rsp, rax
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x4050], rax
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 0x4000
lea rcx, [rsp + 0x50]
call fcn.1401afc90
mov dword [rsp + 0x48], 0
test rbx, rbx
je 0x14002474d
test rdi, rdi
je 0x14002474d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea edx, [rax - 1]
cmp edx, 0x3ffe
ja 0x14002474d
lea r9, [rsp + 0x50]
mov r8d, eax
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14002474d
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x40]
lea rdx, [0x1401f991c]
lea rcx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14002474d
mov r8, rsi
xor edx, edx
add r8, r8
mov rcx, rdi
call fcn.1401afc90
mov rax, qword [rsp + 0x40]
mov rcx, rdi
movzx r8d, word [rax + 0xc]
movzx r10d, word [rax + 0xe]
movzx r11d, word [rax + 8]
movzx r9d, word [rax + 0xa]
lea eax, [rsi - 1]
mov dword [rsp + 0x30], r8d
lea r8, [0x1401f9920]
mov dword [rsp + 0x28], r10d
movsxd rdx, eax
mov dword [rsp + 0x20], r11d
call fcn.140024920
mov eax, 1
jmp 0x14002474f
xor eax, eax
mov rcx, qword [rsp + 0x4050]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x4060
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400249f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rsi, rcx
test rcx, rcx
je 0x140024a84
test rdx, rdx
je 0x140024a84
test r8d, r8d
je 0x140024a84
mov edx, r8d
mov rcx, rbx
mov edi, r8d
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140024a84
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], eax
lea r8d, [rax + 0x40]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140024a7e
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call fcn.1401b00b0
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x24]
mov edx, edi
mov dword [rsp + 0x24], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140024a7e
mov al, 1
jmp 0x140024a86
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x140025df0
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp dword [rcx + 0x38], 0
mov rdi, rdx
mov rbx, rcx
je 0x140025e25
mov eax, 1
jmp 0x140025f4b
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1401afc90
mov r8d, 0x104
lea rdx, [rsp + 0x20]
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test rdi, rdi
je 0x140025e71
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
sub rdi, 1
jne 0x140025e60
lea rdx, str.netul64.dll
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140025f4b
mov edi, 1
mov dword [rbx + 0x38], edi
cmp qword [rbx], 0
jne 0x140025f32
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
je 0x140025f47
lea rdx, str.HttpInit
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.HttpUninit
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.zlib_uncompress
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.zlib_compress
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.zlib_compressBound
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140025f32
call rax
mov qword [rbx + 0x18], rax
cmp qword [rbx + 0x10], 0
je 0x140025f47
cmp qword [rbx + 8], 0
je 0x140025f47
cmp qword [rbx + 0x18], 0
jne 0x140025f49
xor edi, edi
mov eax, edi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140160a40
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x140026d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r9, rdx
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140026d40
add eax, eax
movsxd r10, eax
test eax, eax
jle 0x140026d6c
xor ecx, ecx
movzx edx, byte [rcx + r9]
inc rcx
xor edx, r8d
imul r8d, edx, 0x1000193
cmp rcx, r10
jl 0x140026d55
mov eax, r8d
ret
Function at 0x140029760
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x70
mov qword [r11 - 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
mov qword [r11 - 0x28], rcx
lea rsi, [0x1402b6fd0]
cmp word [0x1402b6fd0], 0
jne 0x140029903
xor ebp, ebp
mov qword [r11 - 0x40], rbp
mov qword [r11 - 0x48], rbp
mov qword [r11 - 0x38], rbp
mov r9d, 0x20219
lea r8, str.SOFTWARETabxExplorer
mov rdx, 0xffffffff80000002
lea rcx, [r11 - 0x48]
call fcn.14002ab60
test eax, eax
jne 0x1400298f1
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], 4
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.em_lds
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400298a5
cmp dword [rsp + 0x60], 4
jne 0x1400298a5
mov ecx, 0x3ff
mov rdx, rsi
cmp dword [rsp + 0x58], 1
jne 0x14002986d
lea r8, str.in_tabx
sub r8, rsi
nop dword [rax]
lea rax, [rcx + 0x7ffffbff]
test rax, rax
je 0x1400298e3
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400298e3
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x140029840
jmp 0x1400298e3
lea r8, str.tabx
sub r8, rsi
nop word [rax + rax]
lea rax, [rcx + 0x7ffffbff]
test rax, rax
je 0x1400298e3
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400298e3
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x140029880
jmp 0x1400298e3
mov ecx, 0x3ff
mov rdx, rsi
lea r8, str.tabx
sub r8, rsi
nop word [rax + rax]
lea rax, [rcx + 0x7ffffbff]
test rax, rax
je 0x1400298e3
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400298e3
mov word [rdx], ax
add rdx, 2
sub rcx, 1
jne 0x1400298c0
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], bp
cmp qword [rsp + 0x30], rbp
je 0x140029903
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x14002997b
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbx], rax
cmp rsi, 0x10000
jae 0x140029933
movzx edx, si
mov rcx, rbx
call fcn.14000cd90
jmp 0x140029959
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x140029940
mov r8d, ecx
mov rdx, rsi
mov rcx, rbx
call fcn.14000cfe0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140160a40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3
Function at 0x14002a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x870
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
lea rsi, [0x1402b54c0]
cmp word [0x1402b54c0], 0
jne 0x14002a222
xor ebp, ebp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rbp
mov r9d, 0x20219
lea r8, str.SOFTWARETabxExplorer
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.14002ab60
test eax, eax
jne 0x14002a210
mov dword [rsp + 0x58], 0x800
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.FROM
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a210
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x14002a210
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14002a1bf
test al, 1
jne 0x14002a210
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], bp
je 0x14002a1c4
jmp 0x14002a210
mov word [rsp + 0x60], bp
mov r8d, 0x3ff
mov rdx, rsi
lea rcx, [rsp + 0x60]
sub rcx, rsi
nop word [rax + rax]
lea rax, [r8 + 0x7ffffbff]
test rax, rax
je 0x14002a202
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14002a202
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x14002a1e0
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], bp
cmp qword [rsp + 0x30], rbp
je 0x14002a222
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x14002a2a1
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rbx], rax
cmp rsi, 0x10000
jae 0x14002a252
movzx edx, si
mov rcx, rbx
call fcn.14000cd90
jmp 0x14002a279
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp word [rsi + rcx*2], 0
jne 0x14002a260
mov r8d, ecx
mov rdx, rsi
mov rcx, rbx
call fcn.14000cfe0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140160a40
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3
Function at 0x14002a870
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x870
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rdi
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov ebx, 0x3ff
lea rbp, [0x1402b4cc0]
cmp word [0x1402b4cc0], r14w
jne 0x14002a9b3
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov r9d, 0x20219
lea r8, str.SOFTWARETabxExplorer
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x30]
call fcn.14002ab60
test eax, eax
jne 0x14002a9a1
mov dword [rsp + 0x58], 0x800
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, [0x1401fa480]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a9a1
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x14002a9a1
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x14002a95b
test al, 1
jne 0x14002a9a1
shr rax, 1
cmp word [rsp + rax*2 + 0x5e], r14w
je 0x14002a961
jmp 0x14002a9a1
mov word [rsp + 0x60], r14w
mov r8, rbx
mov rdx, rbp
lea rcx, [rsp + 0x60]
sub rcx, rbp
nop
lea rax, [r8 + 0x7ffffbff]
test rax, rax
je 0x14002a992
movzx eax, word [rcx + rdx]
test ax, ax
je 0x14002a992
mov word [rdx], ax
add rdx, 2
sub r8, 1
jne 0x14002a970
lea rax, [rdx - 2]
test r8, r8
cmovne rax, rdx
mov word [rax], r14w
cmp qword [rsp + 0x30], r14
je 0x14002a9b3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x14002aa01
mov rcx, rbp
lea rdx, str.noset
sub rdx, rbp
nop dword [rax]
lea rax, [rbx + 0x7ffffbff]
test rax, rax
je 0x14002a9f2
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14002a9f2
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14002a9d0
lea rax, [rcx - 2]
test rbx, rbx
cmovne rax, rcx
mov word [rax], r14w
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x14002aa87
mov rax, qword [rax]
call qword [rax + ILCombine]
add rax, 0x18
mov qword [rdi], rax
cmp rbp, 0x10000
jae 0x14002aa31
movzx edx, bp
mov rcx, rdi
call fcn.14000cd90
jmp 0x14002aa5a
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rbp + rcx*2], 0
jne 0x14002aa40
mov r8d, ecx
mov rdx, rbp
mov rcx, rdi
call fcn.14000cfe0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.140160a40
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3
Function at 0x14002aaa0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14029e8b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
lea r8, str.SOFTWARETabxExplorer
mov r9d, 0x20219
mov qword [rsp + 0x38], rbx
mov rdx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rbx
call fcn.14002ab60
test eax, eax
jne 0x14002ab36
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.em_lds
mov dword [rsp + 0x4c], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ab36
cmp dword [rsp + 0x50], 4
jne 0x14002ab36
cmp dword [rsp + 0x48], 1
jne 0x14002ab36
mov bl, 1
cmp qword [rsp + 0x30], 0
je 0x14002ab49
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140160a40
add rsp, 0x60
pop rbx
ret
Function at 0x14002f7b0
Capabilities:
Open clipboard

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14002f7cf
call qword [sym.imp.USER32.dll_EmptyClipboard]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x28
ret
Function at 0x14002ffb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x14002ffcb
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, qword [rbx + 0x10]
mov ecx, 2
lea rdx, [rdx*2 + 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor dil, dil
mov rsi, rax
test rax, rax
je 0x14003004d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp qword [rbx + 0x18], 8
mov r8, qword [rbx + 0x10]
jb 0x140030014
mov rbx, qword [rbx]
lea r8, [r8*2 + 2]
mov rdx, rbx
mov rcx, rax
call fcn.1401b00b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, SafeArrayDestroy
call qword [sym.imp.USER32.dll_SetClipboardData]
movzx edi, dil
mov ecx, 1
test rax, rax
cmovne edi, ecx
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x30]
movzx eax, dil
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400303b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov edi, edx
mov r14, rcx
call fcn.14000a6a0
mov rcx, rax
test rax, rax
je 0x14003056a
mov rax, qword [rax]
call qword [rax + ILCombine]
mov r15, rax
xor esi, esi
mov ebx, esi
lea rcx, [0x1401fb488]
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov r13d, eax
lea edx, [rsi + 4]
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
neg edi
sbb ecx, ecx
add ecx, 2
mov dword [rax], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [rsp + 0x28], ILIsEqual
movdqa xmm0, xmmword [0x1401fbb80]
movdqu xmmword [rsp + 0x2c], xmm0
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
sub r8, rdx
sar r8, 5
test r8, r8
je 0x14003046e
add rdx, 0x10
inc ebx
add ebx, dword [rdx]
lea rdx, [rdx + 0x20]
sub r8, 1
jne 0x140030460
lea edx, [rbx*2 + 0x32]
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rax], xmm0
mov ecx, dword [rsp + 0x38]
mov dword [rax + 0x10], ecx
lea rbx, [rax + 0x14]
mov rdx, qword [r14]
mov rcx, qword [r14 + 8]
sub rcx, rdx
sar rcx, 5
test rcx, rcx
je 0x1400304f3
mov rdi, rsi
add rdx, rdi
cmp qword [rdx + 0x18], 8
jb 0x1400304c2
mov rdx, qword [rdx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
mov rcx, rbx
call fcn.1401b0938
lea rbx, [rax + 2]
inc rsi
add rdi, 0x20
mov rdx, qword [r14]
mov rax, qword [r14 + 8]
sub rax, rdx
sar rax, 5
cmp rsi, rax
jb 0x1400304b5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14003052e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rbp
mov ecx, reloc.OLEAUT32.dll_SafeArrayDestroy
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov eax, 0xffffffff
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x14003054a
mov rcx, qword [r15]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.14000ca90
int3