joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003ee80
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdi, rcx
call fcn.14000c980
cmp dword [rax + 0x3335c], 7
jg 0x14003eec4
xor al, al
jmp 0x14003ef7f
lea rbx, [rdi + 0x70]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003eed5
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14003eebd
lea rcx, [rdi + 0x50]
cmp qword [rdi + 0x68], 8
jb 0x14003eeee
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14003eebd
lea rcx, [rsp + 0x30]
call fcn.140003350
nop
mov r8d, 2
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006e90
test al, al
jne 0x14003ef1e
xor bl, bl
jmp 0x14003ef35
mov r8d, 1
lea rdx, [rdi + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140006e90
movzx ebx, al
lea rcx, [rsp + 0xb8]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x98]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x78]
call fcn.1400068c0
nop
lea rcx, [rsp + 0x60]
call fcn.14000b980
nop
lea rcx, [rsp + 0x48]
call fcn.14000b980
nop
lea rcx, [rsp + 0x30]
call fcn.14000b980
movzx eax, bl
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret

Function at 0x140043330
Capabilities:
Check if file exists
Get file version info

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp qword [rdx + 0x10], 0
mov rbx, rdx
mov rdi, rcx
je 0x14004341f
cmp qword [rdx + 0x18], 8
mov rcx, rdx
jb 0x140043355
mov rcx, qword [rdx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14004341f
cmp qword [rbx + 0x18], 8
mov rcx, rbx
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x48], 0
jb 0x14004337d
mov rcx, qword [rbx]
lea rdx, [rsp + 0x48]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
je 0x14004341a
mov ecx, ebp
mov qword [rsp + 0x20], rsi
call fcn.14017f5ec
cmp qword [rbx + 0x18], 8
mov rsi, rax
jb 0x1400433aa
mov rbx, qword [rbx]
mov edx, dword [rsp + 0x48]
mov r9, rsi
mov r8d, ebp
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], 0
lea r8, [rsp + 0x58]
mov dword [rsp + 0x50], 0
lea rdx, [0x1401e42c8]
mov rcx, rsi
call sub.VERSION.dll_VerQueryValueW
cmp dword [rsp + 0x50], 0
je 0x14004340d
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + 0xa]
mov dword [rdi], eax
movzx eax, word [rcx + 8]
mov dword [rdi + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rdi + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rdi + 0xc], eax
mov rcx, rsi
call fcn.14017f5e4
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x140044520
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [rax - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov r14, rcx
mov qword [rsp + 0x30], 0
call fcn.14003ee80
test al, al
je 0x140044708
mov byte [rsp + 0x40], 0
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.140038c00
nop
lea rcx, [r14 + 0x70]
cmp qword [rcx + 0x18], 8
jb 0x140044578
mov rcx, qword [rcx]
xor edx, edx
lea r8d, [rdx + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x1400445a7
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003c620
xor al, al
jmp 0x140044708
mov edx, 0x65
mov r8d, 0x100
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rcx, rsi
test rax, rax
jne 0x1400445e3
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003c620
xor al, al
jmp 0x140044708
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rcx, rsi
test rax, rax
jne 0x140044614
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003c620
xor al, al
jmp 0x140044708
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
lea ecx, [rbx + 1]
call fcn.14017f5ec
mov r15, rax
mov qword [rsp + 0xc8], rax
mov r8d, ebx
mov rdx, rdi
mov rcx, rax
call fcn.14019dbf0
mov byte [rbx + r15], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x98], 0
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x50]
call fcn.140034e00
mov qword [rsp + 0xc8], rax
movzx edx, byte [rsp + 0x40]
movzx ecx, byte [rax]
mov byte [rsp + 0x40], cl
mov byte [rax], dl
lea rcx, [rax + 8]
mov rdx, qword [rsp + 0x48]
mov r8, qword [rcx]
mov qword [rsp + 0x48], r8
mov qword [rcx], rdx
movzx edx, byte [rax]
call fcn.14003c620
mov rcx, r15
call fcn.14017f5e4
lea rcx, [r14 + 0xe8]
lea rdx, [rsp + 0x40]
call fcn.14003f100
mov rcx, r14
call fcn.14003ff50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.14003c620
mov al, 1
jmp 0x140044708
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140044dd0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
xor r9d, r9d
mov rcx, qword [rcx + 0x40]
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
movsxd r8, eax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x20]
mov qword [rsp + 0x28], rcx
mov edx, 0x133c
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx + 0x40]
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_SendMessageW]
cmp qword [rsp + 0x40], 0
je 0x140044e70
mov rcx, qword [rbx + 0x10]
mov r9, rbx
xor r8d, r8d
mov edx, 0x5001
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x140044e70
mov rdx, qword [rsp + 0x40]
lea r8d, [rax + 1]
mov rcx, rbx
call fcn.140045a40
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x140044f17
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
test al, al
jne 0x140044ef6
mov rax, qword [rbx]
mov r9b, 1
xor r8d, r8d
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov edx, 0xfffffff0
mov r8d, 0x40000000
mov byte [rbx + 0x34], 0
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x18]
xor r8d, r8d
lea edx, [r8 - 0x14]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x38]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbx + 0x48], rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1401297a0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x50
pop rbx
ret
Function at 0x1400475b0
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rdi
sub rsp, 0x50
xor eax, eax
mov rbp, rdx
mov rbx, rcx
mov qword [r11 - 0x38], rax
mov rcx, qword [rcx + 0x40]
mov edx, 0x1304
xor r9d, r9d
mov qword [r11 - 0x30], rax
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, rax
test eax, eax
jle 0x140047645
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x20]
mov r8d, eax
mov edx, 0x133c
mov dword [rsp + 0x20], 8
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140047745
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbp
mov qword [rsp + 0x60], rsi
mov rcx, rbx
call fcn.140046ec0
mov rcx, qword [rbx + 0x40]
lea r9, [rsp + 0x20]
movsxd rsi, eax
mov dword [rsp + 0x20], 8
mov qword [rsp + 0x40], rbp
cmp esi, 0xffffffff
jne 0x140047683
movsxd r8, edi
mov edx, 0x133e
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140047693
mov r8, rsi
mov edx, 0x133d
call qword [sym.imp.USER32.dll_SendMessageW]
mov edi, esi
mov edx, edi
mov rcx, rbx
call fcn.140046f70
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rsi, qword [rsp + 0x60]
test al, al
jne 0x14004773d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x68]
test al, al
jne 0x14004771c
mov rax, qword [rbx]
mov r9b, 1
xor r8d, r8d
mov edx, 0x8b
mov rcx, rbx
call qword [rax + 0x60]
mov rcx, qword [rbx + 0x18]
mov edx, 0xfffffff0
mov r8d, 0x40000000
mov byte [rbx + 0x34], 0
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x18]
xor r8d, r8d
lea edx, [r8 - 0x14]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x38]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rbx + 0x48], rax
xor r8d, r8d
mov dl, 1
mov rcx, rbx
call fcn.1401297a0
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.140045df0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140057810
Capabilities:
Get graphical window text

Disassembly:
push rdi
mov eax, 0x1050
call fcn.140180000
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1070], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rax, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x40]
lea edx, [rdi + 0xd]
mov r8d, 0x7ff
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x140057885
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140006d60
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x1070]
add rsp, 0x1050
pop rdi
ret

Function at 0x140058430
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test rax, rax
je 0x140058465
mov rax, qword [rcx + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x120], rax
test rax, rax
je 0x140058501
mov qword [rdi + 0x10], rbx
test rbx, rbx
je 0x1400584aa
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
jne 0x140058490
lea rax, str.Operation_progress...
test rsi, rsi
lea rcx, [rdi + 0x18]
mov edx, 0x80
cmove rsi, rax
mov r8, rsi
call fcn.1401a66e0
xor eax, eax
lea r8, [0x140061f10]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rdi + 0x120]
mov qword [rdi + 0x118], rax
test rax, rax
jne 0x140058513
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [rdi + 8]
test rax, rax
jne 0x140058553
mov rcx, qword [rdi + 0x118]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14006a6d0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx + 0x10]
mov rbx, rcx
cmp eax, 0xfffffdee
jne 0x14006a733
mov rax, qword [rdx + 8]
mov qword [rdx + 0xc0], 0
cmp rax, 0xd4d
jne 0x14006a703
lea r8, [rcx + 0x190]
jmp 0x14006a716
cmp rax, 0xd4c
jne 0x14006a885
lea r8, [rcx + 0x1b0]
cmp qword [r8 + 0x18], 8
jb 0x14006a720
mov r8, qword [r8]
lea rcx, [rdx + 0x20]
mov edx, 0x50
add rsp, 0x20
pop rbx
jmp fcn.1401a66e0
mov rcx, qword [rdx]
mov r8, qword [rbx + 0xb8]
cmp rcx, r8
je 0x14006a788
cmp rcx, qword [rbx + 0x128]
je 0x14006a788
cmp eax, 0x41e
jne 0x14006a75f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14006ad80
cmp eax, 0x41b
jne 0x14006a885
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
mov edx, 0x111
mov r8d, 0xac34
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x30], rdi
cmp rcx, r8
mov edi, 0xa0
mov r9d, 0x110
cmovne edi, r9d
add rdi, rbx
cmp eax, 0xfffffe64
je 0x14006a7c7
cmp eax, 0xfffffffc
je 0x14006a82c
cmp eax, 0xfffffffd
jne 0x14006a880
mov rdx, rdi
mov rcx, rbx
call fcn.14006a890
jmp 0x14006a85d
movzx eax, word [rdx + 0x18]
cmp ax, 0xd
jne 0x14006a819
mov rdx, rdi
mov rcx, rbx
call fcn.14006a890
test al, al
jne 0x14006a85d
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
mov edx, 0x110a
lea r8d, [r9 + 9]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x18]
mov edx, 0x1102
mov r9, rax
mov r8d, 3
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SendMessageW]
cmp ax, 9
jne 0x14006a847
mov rcx, qword [rbx + 0x90]
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rbx + 0x18]
xor edx, edx
lea r8d, [rdx + 1]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_SetWindowLongPtrW]
cmp ax, 0x1b
jne 0x14006a880
mov rcx, qword [rbx + 0x18]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rax, qword [rbx + 0x200]
mov r8d, 0x2000000
mov rcx, qword [rbx + 0x10]
mov edx, 0x111
mov r9, qword [rax]
mov r9, qword [r9 + 0x18]
call qword [sym.imp.USER32.dll_PostMessageW]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140073080
Capabilities:
Access peb ldr_data
Log keystrokes via application hook

Disassembly:
push rdi
sub rsp, 0x180
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x198], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
mov rax, qword [rcx + 0x68]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rdi - 1]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [0x1402be238]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1402aba20], ecx
jg 0x140073277
mov rax, qword [0x1402aba18]
mov edi, dword [rax + 0x3335c]
xor r9d, r9d
mov r8, qword [rbx]
lea rdx, [0x140073c10]
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1402bbd60], rax
test rax, rax
jne 0x140073180
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetLastError___returned__lu
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, InitCommonControls
lea r8, str.SetWindowsHookEx_MOUSE__failed_on_Gripper::create__
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
je 0x1400731e1
cmp edi, 0xa
jge 0x1400731e1
xor r9d, r9d
mov r8, qword [rbx]
lea rdx, [0x140073bc0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1402bbd68], rax
test rax, rax
jne 0x1400731e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.GetLastError___returned__lu
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, InitCommonControls
lea r8, str.SetWindowsHookEx_KEYBOARD__failed_on_Gripper::create__
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, rbx
call fcn.140073cb0
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x58]
cmp byte [rcx + 0x34], 1
jne 0x14007320f
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x140073228
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbx + 0x68]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [rsp + 0x40]
sub eax, dword [rsp + 0x58]
mov dword [rbx + 0x70], eax
mov eax, dword [rsp + 0x44]
sub eax, dword [rsp + 0x5c]
mov dword [rbx + 0x74], eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
mov qword [0x1402aba18], rdi
lea rcx, [0x1402aba20]
call fcn.14017fbbc
jmp 0x14007311b
lea rcx, [0x1402aba20]
call fcn.14017fc1c
cmp dword [0x1402aba20], 0xffffffff
jne 0x14007311b
mov ecx, 0x33400
call fcn.14017f5a8
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14007325f
mov rcx, rax
call fcn.1400d0c00
mov rdi, rax
jmp 0x14007325f
Function at 0x1400859b0
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rdx
mov r9b, 1
mov edx, dword [rcx + 0x30]
mov rsi, rcx
call fcn.140129490
mov rcx, qword [rsi + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
lea rbx, [rsi + 0x60]
inc r8
cmp word [rax + r8*2], 0
jne 0x140085a03
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140006d60
mov rax, qword [rsi + 0x18]
mov qword [rdi], rax
cmp qword [rbx + 0x18], 8
jb 0x140085a2c
mov rbx, qword [rbx]
xor eax, eax
mov qword [rdi + 8], rbx
mov dword [rdi + 0x14], eax
mov qword [rdi + 0x20], rax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x240
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400881f0
Capabilities:
Check if file exists
Get graphical window text
Open clipboard
Persist via app paths registry key
Query or enumerate registry value
Read clipboard data
Set registry value
Write clipboard data

Disassembly:
push rbx
push r14
sub rsp, 0x28
mov r14d, edx
mov rbx, rcx
cmp edx, 2
jne 0x140088245
mov rax, qword [rcx + 0x640]
cmp qword [rax + 0x20], 1
jne 0x140088245
mov r8, qword [rcx + 0x8d0]
lea rax, [rcx + 0x6f0]
add rcx, 0x650
cmp r8, rax
je 0x140088237
cmp r8, rcx
jne 0x140088432
mov rcx, rax
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x140088432
mov rax, qword [rbx + 0x8d0]
mov rcx, qword [rbx + 0x648]
mov qword [rsp + 0x40], rbp
mov ebp, dword [rbx + 0x9840c]
mov qword [rsp + 0x48], rsi
mov rsi, qword [rax + 0x38]
mov qword [rsp + 0x50], rdi
mov rdx, rsi
xor edi, edi
mov qword [rsp + 0x20], r15
test ebp, ebp
mov r15d, edi
sete r15b
call fcn.14004a400
cmp eax, 0xffffffff
je 0x140088298
cmp dword [rbx + 0x9840c], edi
sete dil
jmp 0x140088318
mov rcx, qword [rbx + 0x8d0]
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400882c6
mov rcx, qword [rbx + 0x8d8]
mov rax, qword [rcx]
call qword [rax + 0x58]
test al, al
je 0x1400882c6
mov rcx, qword [rbx + 0x8d8]
call fcn.1401154c0
xor r9d, r9d
mov r8d, r15d
mov rdx, rsi
mov rcx, rbx
call fcn.140092c10
call fcn.14004a480
mov rcx, qword [rbx + 0x8d0]
call fcn.1401154c0
mov rdx, qword [rbx + 0x8d0]
mov rcx, rsi
call fcn.14001f5e0
mov r8, qword [rbx + 0x8d8]
mov rdx, rax
mov rcx, rsi
call fcn.140021140
mov rcx, qword [rbx + 0x8d8]
call fcn.140115350
mov edi, r15d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140082600
movzx edx, byte [rbx + 0x98408]
mov eax, ebp
neg eax
sbb ecx, ecx
add ecx, 2
test dl, cl
jne 0x1400883c8
lea rcx, [rbx + 0x8e8]
test dl, 4
je 0x14008835c
mov rax, qword [rbx + 0x8e0]
mov qword [rax + 0x20], rcx
mov rcx, qword [rbx + 0x8e0]
mov qword [rbx + 8], rcx
mov dl, 1
test ebp, ebp
je 0x14008837c
lea rcx, [rbx + 0x6f0]
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rcx, [rbx + 0x490]
jmp 0x140088390
lea rcx, [rbx + 0x650]
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rcx, [rbx + 0x568]
mov rax, qword [rcx]
mov dl, 1
call qword [rax + 0x18]
mov rcx, qword [rbx + 8]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbx]
test ebp, ebp
sete al
xor r9d, r9d
inc al
xor r8d, r8d
or byte [rbx + 0x98408], al
mov rcx, qword [rcx + 0x18]
lea edx, [r9 + 5]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, qword [rsp + 0x40]
xor dil, dil
cmp r14d, 2
jne 0x1400883ff
call fcn.14004a480
mov rdx, qword [rbx + 0x8d0]
xor r9d, r9d
mov r8d, dword [rbx + 0x9840c]
mov rcx, rbx
movzx edi, byte [rsi + 0x110]
mov rdx, qword [rdx + 0x38]
call fcn.1400c0700
mov edx, r15d
mov rcx, rbx
call fcn.140099fa0
mov r15, qword [rsp + 0x20]
test dil, dil
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
je 0x140088432
mov edx, 0xac41
mov rcx, rbx
add rsp, 0x28
pop r14
pop rbx
jmp fcn.1400b5110
add rsp, 0x28
pop r14
pop rbx
ret
Function at 0x140089720
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2a0], rbx
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, r8
mov r15, rdx
xor bpl, bpl
xor r14b, r14b
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.14019e060
xor r13d, r13d
mov ebx, r13d
mov edx, 4
mov ecx, dword [0x1402be238]
mov rax, qword gs:[0x58]
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [0x1402bbb60]
cmp eax, dword [rsi]
jle 0x140089590
lea rcx, [0x1402bbb60]
call fcn.14017fc1c
mov eax, dword [0x1402bbb60]
cmp eax, 0xffffffff
jne 0x140089590
xorps xmm0, xmm0
movdqa xmmword [0x1402bbb20], xmm0
mov qword [0x1402bbb38], r13
xorps xmm1, xmm1
movdqa xmmword [0x1402bbb40], xmm1
mov qword [0x1402bbb50], r13
mov qword [0x1402bbb58], r13
lea rcx, [0x1401df970]
call fcn.14017f9ec
nop
lea rcx, [0x1402bbb60]
call fcn.14017fbbc
mov eax, dword [0x1402bbb60]
cmp rbx, qword [0x1402bbb58]
jae 0x1400896df
cmp eax, dword [rsi]
jle 0x1400895fa
lea rcx, [0x1402bbb60]
call fcn.14017fc1c
cmp dword [0x1402bbb60], 0xffffffff
jne 0x1400895fa
xorps xmm0, xmm0
movdqa xmmword [0x1402bbb20], xmm0
mov qword [0x1402bbb38], r13
xorps xmm1, xmm1
movdqa xmmword [0x1402bbb40], xmm1
mov qword [0x1402bbb50], r13
mov qword [0x1402bbb58], r13
lea rcx, [0x1401df970]
call fcn.14017f9ec
nop
lea rcx, [0x1402bbb60]
call fcn.14017fbbc
mov rdx, rbx
lea rcx, [0x1402bbb20]
call fcn.14001eea0
mov rdi, rax
cmp byte [rax + 0x48], 0
je 0x1400896d7
mov r14b, 1
lea rcx, [0x1401e4278]
cmp dword [rax + 0x4c], 0
lea rax, str._utf8
cmovne rcx, rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
mov r9, r12
mov r8, r15
lea rdx, str._s_s_03d_s.dump
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rdi, qword [rdi + 0x10]
mov eax, dword [rsi]
cmp dword [0x1402bbb60], eax
jle 0x1400896b8
lea rcx, [0x1402bbb60]
call fcn.14017fc1c
cmp dword [0x1402bbb60], 0xffffffff
jne 0x1400896b8
xorps xmm0, xmm0
movdqa xmmword [0x1402bbb20], xmm0
mov qword [0x1402bbb38], r13
xorps xmm1, xmm1
movdqa xmmword [0x1402bbb40], xmm1
mov qword [0x1402bbb50], r13
mov qword [0x1402bbb58], r13
lea rcx, [0x1401df970]
call fcn.14017f9ec
nop
lea rcx, [0x1402bbb60]
call fcn.14017fbbc
xor r9d, r9d
lea r8, [rsp + 0x40]
mov rdx, rdi
lea rcx, [0x1402bbb20]
call fcn.140020640
test eax, eax
sete al
or bpl, al
inc rbx
jmp 0x140089525
test bpl, bpl
jne 0x1400896ed
test r14b, r14b
je 0x1400896ed
xor al, al
jmp 0x1400896ef
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14017f700
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
jb 0x14008973d
mov rcx, qword [rdx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbx + 0x18], 8
jb 0x14008974f
mov rbx, qword [rbx]
lea r8, [0x140214ab0]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400894b0