joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076ec0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x14007704b
test r8, r8
je 0x140076ef3
cmp word [r8], 0
jne 0x140076f07
test r9, r9
je 0x14007704b
cmp word [r9], 0
je 0x14007704b
mov rax, qword [0x1400edaa8]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov r9d, dword [rax + 0x108]
lea rax, [rsp + 0x58]
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14007703c
test rdi, rdi
je 0x140076f82
cmp word [rdi], ax
je 0x140076f82
lea rdx, [0x1400db680]
mov rcx, rdi
call fcn.140099630
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bdf7c]
test eax, eax
cmovne rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007703c
mov rcx, qword [rsp + 0x58]
call fcn.140076d90
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14007703c
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f8380], eax
jle 0x140077002
lea rcx, [0x1400f8380]
call fcn.140095414
cmp dword [0x1400f8380], 0xffffffff
jne 0x140077002
lea rcx, [0x1400d9ae0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x1400db670]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400f8380]
mov qword [0x1400f8388], rax
call fcn.1400953b4
mov rax, qword [0x1400edaa8]
mov r8d, dword [rax + 0x108]
test r8d, r8d
je 0x14007702e
mov rax, qword [0x1400f8388]
test rax, rax
je 0x14007702e
xor r9d, r9d
mov rdx, rsi
mov rcx, rbp
call rax
jmp 0x14007703a
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x140077050
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140077052
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400edaa8]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r14
call fcn.140030e80
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140077930
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edi, edi
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x14007796c
sub rdx, qword [rcx + 0x38]
lea r8d, [rdi + 1]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x14007798b
cmp qword [rbx + 0x30], rdi
jne 0x14007798b
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x1400779ec
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400779ec
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + gethostname]
mov rbx, qword [rsp + 0x30]
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140078500
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x14007af10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14007aff6
cmp word [rcx], 0
je 0x14007aff6
mov r8d, 4
lea rdx, [0x1400db840]
call fcn.1400a13f8
mov r8, rbx
test eax, eax
jne 0x14007af53
lea r8, [rbx + 8]
test r8, r8
je 0x14007af90
movzx edx, word [r8]
test dx, dx
je 0x14007af90
lea rcx, [0x1400d9748]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x14007afbb
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14007af70
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14007af61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x14007afa2
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14007aff6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x14007afe3
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14007b7e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400ae8c0
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14007b834
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.1400973b0
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret

Function at 0x14007b850
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rdi, r9
lea rax, [rsp + 0x50]
mov r9d, dword [rsp + 0x68]
lea rdx, [0x1400d8f00]
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007b930
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400d8ee8]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x68], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x40]
jne 0x14007b930
mov ecx, dword [rsp + 0x68]
test ecx, ecx
je 0x14007b930
shr ecx, 1
dec ecx
mov dword [rsp + 0x68], ecx
cmp word [rdi + rcx*2], 0
jne 0x14007b910
test ecx, ecx
je 0x14007b908
lea edx, [rcx - 1]
cmp word [rdi + rdx*2], 0
jne 0x14007b908
mov dword [rsp + 0x68], edx
mov ecx, edx
test edx, edx
jne 0x14007b8f4
mov eax, ecx
add rsp, 0x30
pop rdi
ret
inc ecx
mov dword [rsp + 0x68], ecx
cmp ecx, 0x104
jae 0x14007b930
mov eax, ecx
xor ecx, ecx
mov word [rdi + rax*2], cx
mov eax, dword [rsp + 0x68]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
mov word [rdi], cx
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14007c0b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15d, r9d
mov edi, r8d
mov esi, edx
mov r12, rcx
mov r13d, ebx
test rcx, rcx
je 0x14007c0ec
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
jmp 0x14007c0f3
mov rbp, qword [0x1400f15a0]
test rbp, rbp
je 0x14007c284
test esi, esi
jns 0x14007c10b
movzx eax, si
neg ax
movzx edx, ax
jmp 0x14007c141
test esi, esi
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], rbx
cmovne eax, esi
lea r9, [rsp + 0x40]
lea r8, [0x14007c090]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
mov r8d, SafeArrayGetElemsize
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14007c26c
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007c26c
mov rcx, rax
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14007c264
cmp edi, 0xffffffff
cmove edi, r15d
test edi, edi
jne 0x14007c1a1
lea ecx, [rdi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jle 0x14007c1f5
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax + rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14007c1d7
movzx eax, dl
mov edx, ebx
cmp eax, edi
setl dl
jmp 0x14007c1e1
movzx eax, al
mov edx, ebx
cmp eax, edi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14007c1c0
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14007c264
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007c264
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14007c264
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r13, rax
mov r14, qword [rsp + 0x80]
test r12, r12
je 0x14007c27a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13, r13
je 0x14007c284
mov rax, r13
jmp 0x14007c2a1
test esi, esi
jle 0x14007c28d
lea ebx, [rsi - 1]
jmp 0x14007c293
cmp esi, 0xffffffff
cmovl ebx, esi
mov r8d, ebx
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14007ccf0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14007cd0a
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14007cd14
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14007cd96
test al, 8
jne 0x14007cd91
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14007cd52
cmp eax, 9
je 0x14007cd52
cmp ecx, 0x20
je 0x14007cd52
cmp ecx, 9
je 0x14007cd52
cmp eax, 0x30
je 0x14007cd52
cmp eax, 0x2b
jne 0x14007cd91
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14007d4e0
test eax, eax
jne 0x14007cd73
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001460
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14007cd76
test al, 0x20
je 0x14007cde8
mov rcx, rdi
test al, 8
jne 0x14007cdd4
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14007d4e0
test eax, eax
je 0x14007cd66
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14007cd7c
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14007cd7c
test al, 1
je 0x14007ce01
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14007d2a0
test al, 2
je 0x14007ce1a
mov rdx, qword [rbx]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400142e0
cmp byte [rbx + 0x23], 0
jne 0x14007ce26
mov rax, qword [rbx + 0x10]
jmp 0x14007ce29
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14007ce37
mov rdx, rbx
call fcn.140031b50
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14007d4e0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007ce60
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14007cf32
sub r8d, 1
je 0x14007cf1e
sub r8d, 2
je 0x14007cf0c
sub r8d, 1
je 0x14007ceac
cmp r8d, 1
jne 0x14007ceed
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400142e0
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14007ceed
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14007cf32
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14007d4e0
test eax, eax
jne 0x14007cee1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14007cf35
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14007d4e0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007ccf0
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14007cf38
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.140001460
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14007d2a0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14007d2c0
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14007d2b6
cmp byte [rdx + 0x23], 0
jne 0x14007d2ca
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001500
cmp byte [rbx + 0x23], 1
jne 0x14007d337
cmp rbx, rdi
je 0x14007d327
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14007d4e0
test eax, eax
jne 0x14007d30e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400973b0
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007d350
Function at 0x14007d350
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x1400f65f8]
call fcn.140005010
test eax, eax
jne 0x14007d38d
lea r8, [0x1400bdf7c]
lea rdx, [0x1400be2e0]
lea rcx, [0x1400f59d0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.140031460
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14007d44d
nop dword [rax + rax]
mov r15d, dword [rsi]
test r15d, r15d
je 0x14007d44d
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14007d44d
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14007d44d
xor edx, edx
mov ecx, 0x42
test rdi, rdi
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14007d4a9
test rdi, rdi
je 0x14007d434
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14007d476
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400973b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14007d3c0
xor edx, edx
lea rcx, [0x1400f65f8]
call fcn.140004e70
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor edx, edx
lea rcx, [0x1400f65f8]
call fcn.140004e70
lea r8, [0x1400bdf7c]
lea rdx, [0x1400be2a8]
lea rcx, [0x1400f59d0]
call fcn.140031460
jmp 0x14007d45b
xor edx, edx
lea rcx, [0x1400f65f8]
call fcn.140004e70
lea r8, [0x1400bdf7c]
lea rdx, [0x1400d1750]
lea rcx, [0x1400f59d0]
call fcn.140031460
jmp 0x14007d45b
Function at 0x14007d900
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14007db40
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14007d996
sub ecx, 1
je 0x14007d966
cmp ecx, 1
je 0x14007d94a
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x14007d954
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140004960
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14007dad9
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001500
cmp dword [0x1400f22cc], 0
jne 0x14007da97
cmp qword [rdi + 0x10], 0
jne 0x14007da97
cmp qword [0x1400f7fb0], rdi
jne 0x14007d9c4
test rbx, rbx
jne 0x14007da43
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14007da3e
xor esi, esi
mov qword [0x1400f7fb0], rsi
test rbx, rbx
je 0x14007da2c
mov edx, dword [0x1400f22d8]
test edx, edx
je 0x14007da0e
mov r9, qword [rdi + 0x28]
lea r8, [0x1400dbaa0]
lea rcx, [0x1400f59d0]
mov qword [rsp + 0x20], rsi
call fcn.1400319f0
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14007b7e0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14007da7e
cmp byte [rdi + 0x23], 0
jne 0x14007da4f
mov rax, qword [rdi + 0x10]
jmp 0x14007da52
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14007da60
mov rdx, rdi
call fcn.140031b50
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x1400f7fb0], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x1400f7fb0], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14007db3b
test r8, r8
jne 0x14007dae9
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14007dacf
mov rdx, rdi
call fcn.140031b50
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14007db3b
cmp r8, 0x186a0
jae 0x14007db2d
movzx eax, word [rdx]
test ax, ax
je 0x14007db23
nop dword [rax]
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14007db10
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14007dad4
mov rcx, rbx
call fcn.1400973b0
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14007dad4
mov rcx, qword [rdi + 0x10]
call fcn.14007d900
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14007e590
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14007e5a6
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1400f5950]
mov r15d, eax
je 0x14007e5d7
mov rcx, rbx
call fcn.14007f940
test al, al
je 0x14007e5d7
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x14007e5fc
xor edx, edx
lea rcx, [0x1400d2618]
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rbx, rsi
jne 0x14007e614
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14007e62f
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x1400f22d3], 0
jne 0x14007e64c
mov rdx, rsi
mov rcx, rbx
call fcn.14007e4f0
test rax, rax
jne 0x14007e79b
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x14007e6d5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14007e6da
cmp dword [0x1400f5950], eax
je 0x14007e6b1
mov rcx, rsi
call fcn.14007f940
test al, al
jne 0x14007e6b1
mov ecx, dword [0x1400f5950]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14007e6da
cmp r14d, r15d
je 0x14007e6da
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14007e6da
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.14007e4f0
mov rbp, rax
test rax, rax
jne 0x14007e742
inc edi
cmp edi, 5
jl 0x14007e6e0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140010030
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.140010030
mov rdx, rsi
mov rcx, rbx
call fcn.14007e4f0
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x14007e763
mov ecx, dword [0x1400f5950]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14007e77c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x14007e794
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x14007e796
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x14007e8f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test r8b, r8b
je 0x14007e90b
call fcn.140058ed0
jmp 0x14007e91b
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
jle 0x14007e980
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001800
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14007e97b
add edi, esi
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x14007e97b
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001800
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14007e950
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret