joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b6a0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1470
call fcn.140145640
sub rsp, rax
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbx, qword [rcx]
cmp rbx, rsi
je 0x14004b6e6
nop dword [rax]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
add rbx, 0x50
cmp rbx, rsi
jne 0x14004b6d0
mov rbx, qword [rdi]
mov qword [rdi + 8], rbx
lea rdx, [rsp + 0x470]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x14004b7c0
movsxd rsi, eax
cmp rsi, 0x800
jae 0x14004b7c0
test eax, eax
jle 0x14004b7bc
xor ebp, ebp
mov ebx, ebp
nop dword [rax]
nop word [rax + rax]
mov rcx, rbp
movzx eax, word [rsp + rbx*2 + 0x470]
test ax, ax
je 0x14004b758
mov word [rsp + rcx*2 + 0x70], ax
inc rcx
inc rbx
movzx eax, word [rsp + rbx*2 + 0x470]
test ax, ax
jne 0x14004b740
inc rbx
mov word [rsp + rcx*2 + 0x70], bp
lea rcx, [rsp + 0x20]
call fcn.140022db0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x70]
call fcn.1400156a0
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14004b798
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.140022f70
add qword [rdi + 8], 0x50
jmp 0x14004b7a9
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rdi
call fcn.14004ba70
nop
lea rcx, [rsp + 0x20]
call fcn.140023130
cmp rbx, rsi
jl 0x14004b730
mov al, 1
jmp 0x14004b7c2
xor al, al
lea r11, [rsp + 0x1470]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004b860
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rdi, rcx
mov rdx, qword [0x14024d960]
mov rax, qword [0x14024d958]
cmp rax, rdx
je 0x14004b8a7
cmp qword [rax], rdi
je 0x14004b89e
add rax, 8
cmp rax, rdx
jne 0x14004b890
cmp rax, rdx
jne 0x14004ba55
lea r14, [0x14024d958]
cmp qword [0x14024d950], 0
jne 0x14004ba2f
mov ecx, 0x20
call fcn.1401455e4
mov rbx, rax
mov qword [rsp + 0xe8], rax
xor esi, esi
test rax, rax
je 0x14004ba1e
mov qword [rax], r14
mov dword [rax + 8], esi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], si
mov dword [rsp + 0x70], 0x50
mov dword [rsp + 0x74], 3
lea rax, [0x14004bd50]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rsi
call fcn.1400356c0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x98], rsi
movdqa xmm0, xmmword [0x1401c1bc0]
movdqa xmmword [rsp + 0xa0], xmm0
lea rbp, str.BFDDrumsDiskInfoCallbackWindow
mov qword [rsp + 0xb0], rbp
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov word [rbx + 0x18], ax
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
mov r8, rbp
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14004ba21
mov r8, rbx
lea edx, [rsi - 0x15]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
lea r8, [rsp + 0xe8]
xor edx, edx
mov rcx, qword [rbx + 0x10]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x14004ba21
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov edx, 0x2381f
mov r9d, 0x458
lea r8d, [rsi + 0x60]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [rbx + 8], eax
jmp 0x14004ba21
mov rbx, rsi
mov qword [0x14024d950], rbx
mov rdx, qword [0x14024d960]
cmp rdx, qword [0x14024d968]
je 0x14004ba45
mov qword [rdx], rdi
add qword [0x14024d960], 8
jmp 0x14004ba55
lea r8, [rsp + 0xe0]
mov rcx, r14
call fcn.14001d180
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14004ff40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rdi + 0x28]
mov edx, 2
lea r8d, [rdx - 1]
cmp al, bl
je 0x14004ff7c
mov rcx, rsi
jmp 0x14004ff90
movzx eax, byte [rsi + 1]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], al
movzx eax, byte [rsi]
mov byte [rsp + 0x31], al
call fcn.140175d14
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14004ffb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rdx
mov rsi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rsi + 0x28]
mov edx, 4
lea r8d, [rdx - 3]
cmp al, bl
je 0x14004ffec
mov rcx, rdi
jmp 0x140050010
movzx eax, byte [rdi + 3]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x31], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x32], al
movzx eax, byte [rdi]
mov byte [rsp + 0x33], al
call fcn.140175d14
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rdx
mov rsi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rsi + 0x28]
mov edx, 8
lea r8d, [rdx - 7]
cmp al, bl
je 0x14005006c
mov rcx, rdi
jmp 0x1400500b0
movzx eax, byte [rdi + 7]
lea rcx, [rsp + 0x30]
mov byte [rsp + 0x30], al
movzx eax, byte [rdi + 6]
mov byte [rsp + 0x31], al
movzx eax, byte [rdi + 5]
mov byte [rsp + 0x32], al
movzx eax, byte [rdi + 4]
mov byte [rsp + 0x33], al
movzx eax, byte [rdi + 3]
mov byte [rsp + 0x34], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x35], al
movzx eax, byte [rdi + 1]
mov byte [rsp + 0x36], al
movzx eax, byte [rdi]
mov byte [rsp + 0x37], al
call fcn.140175d14
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400500f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rdi + 0x28]
mov edx, 2
lea r8d, [rdx - 1]
cmp al, bl
je 0x14005013e
mov rcx, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401757ac
lea rcx, [rsp + 0x30]
call fcn.1401757ac
movzx eax, byte [rsp + 0x31]
mov rbx, qword [rsp + 0x38]
mov byte [rsi], al
movzx eax, byte [rsp + 0x30]
mov byte [rsi + 1], al
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.14005e9d0
mov r9, qword [rbx + 0x28]
mov edx, 2
lea r8d, [rdx - 1]
test al, al
je 0x1400501a8
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401757ac
lea rcx, [rsp + 0x40]
call fcn.1401757ac
movzx eax, byte [rsp + 0x41]
mov rbx, qword [rsp + 0x30]
mov byte [rdi], al
movzx eax, byte [rsp + 0x40]
mov byte [rdi + 1], al
add rsp, 0x20
pop rdi
ret
Function at 0x1400501e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rdi + 0x28]
mov edx, 1
lea r8d, [rdx + 3]
cmp al, bl
jne 0x140050255
lea rcx, [rsp + 0x30]
call fcn.1401757ac
test rax, rax
je 0x14005025d
movzx eax, byte [rsp + 0x33]
mov byte [rsi], al
movzx eax, byte [rsp + 0x32]
mov byte [rsi + 1], al
movzx eax, byte [rsp + 0x31]
mov byte [rsi + 2], al
movzx eax, byte [rsp + 0x30]
mov byte [rsi + 3], al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rsi
call fcn.1401757ac
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050280
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, rdx
mov rdi, rcx
call qword [rax + 0x88]
movzx ebx, al
call fcn.14005e9d0
mov r9, qword [rdi + 0x28]
mov edx, 8
lea r8d, [rdx - 7]
cmp al, bl
je 0x1400502ce
mov rcx, rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401757ac
lea rcx, [rsp + 0x30]
call fcn.1401757ac
movzx eax, byte [rsp + 0x37]
mov rbx, qword [rsp + 0x38]
mov byte [rsi], al
movzx eax, byte [rsp + 0x36]
mov byte [rsi + 1], al
movzx eax, byte [rsp + 0x35]
mov byte [rsi + 2], al
movzx eax, byte [rsp + 0x34]
mov byte [rsi + 3], al
movzx eax, byte [rsp + 0x33]
mov byte [rsi + 4], al
movzx eax, byte [rsp + 0x32]
mov byte [rsi + 5], al
movzx eax, byte [rsp + 0x31]
mov byte [rsi + 6], al
movzx eax, byte [rsp + 0x30]
mov byte [rsi + 7], al
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140050330
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.14005e9d0
mov r9, qword [rbx + 0x28]
mov edx, 1
lea r8d, [rdx + 3]
test al, al
jne 0x14005038a
lea rcx, [rsp + 0x40]
call fcn.1401757ac
movzx eax, byte [rsp + 0x43]
mov byte [rdi], al
movzx eax, byte [rsp + 0x42]
mov byte [rdi + 1], al
movzx eax, byte [rsp + 0x41]
mov byte [rdi + 2], al
movzx eax, byte [rsp + 0x40]
mov byte [rdi + 3], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401757ac

Function at 0x1400503b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.14005e9d0
mov r9, qword [rdi + 0x28]
mov edx, 4
lea r8d, [rdx - 3]
test al, al
je 0x1400503e9
mov rcx, rbx
call fcn.140175d14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 3]
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], al
movzx eax, byte [rbx + 2]
mov byte [rsp + 0x41], al
movzx eax, byte [rbx + 1]
mov byte [rsp + 0x42], al
movzx eax, byte [rbx]
mov byte [rsp + 0x43], al
call fcn.140175d14
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400507d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400507ff
xor al, al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 0x80]
test al, al
je 0x140050890
mov rax, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x30], rbp
call qword [rax + 0xd0]
mov rbp, rax
cmp rax, rdi
jb 0x140050867
mov ecx, dword [rbx + 0x4c]
mov r8d, 1
mov rax, qword [rbx + 0x38]
dec ecx
mov rdx, rdi
add qword [rax + rcx*8], rdi
mov r9, qword [rbx + 0x28]
mov rcx, rsi
call fcn.1401757ac
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
cmp rax, 1
mov rsi, qword [rsp + 0x40]
sete al
add rsp, 0x20
pop rdi
ret
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.1401666a0
mov ecx, dword [rbx + 0x4c]
mov r8d, 1
mov rax, qword [rbx + 0x38]
dec ecx
mov rdx, rbp
add qword [rax + rcx*8], rbp
mov r9, qword [rbx + 0x28]
jmp 0x140050843
mov r9, qword [rbx + 0x28]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1401757ac
jmp 0x140050850

Function at 0x1400508b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r10, r8
mov rax, rdx
test rdx, rdx
jne 0x1400508c4
add rsp, 0x28
ret
mov r9, qword [rcx + 0x28]
mov r8d, 1
mov rcx, rax
mov rdx, r10
call fcn.140175d14
cmp rax, 1
sete al
add rsp, 0x28
ret

Function at 0x140051470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400514cc
mov rax, qword [rcx]
mov esi, 1
mov byte [rsp + 0x30], dl
lea rdx, [rsp + 0x38]
mov word [rsp + 0x38], si
call qword [rax + 8]
movzx edx, word [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov r9, qword [rbx + 0x28]
mov r8d, esi
call fcn.140175d14
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400514d3
inc ax
lea rdx, [rsp + 0x38]
mov word [rsp + 0x38], ax
mov rax, qword [rcx]
call qword [rax + 8]
movzx r8d, word [rsp + 0x38]
mov edx, 1
mov r9, qword [rbx + 0x28]
mov rcx, rdi
call fcn.140175d14
cmp ax, word [rsp + 0x38]
je 0x140051519
lea rcx, str.VAIFile::___ARGH_
call fcn.14003a610
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140051540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rdx]
test rcx, rcx
je 0x140051569
mov edx, 1
call fcn.140145620
mov qword [rdi], 0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x80]
test al, al
je 0x1400515ae
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd0]
cmp rax, 3
jae 0x1400515ae
call fcn.1400106a0
mov ecx, 1
call fcn.140145a74
mov qword [rdi], rax
mov byte [rax], 0
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
call fcn.1400106a0
movzx ecx, word [rsp + 0x30]
inc ecx
call fcn.140145a74
movzx r8d, word [rsp + 0x30]
xor edx, edx
inc r8d
mov qword [rdi], rax
mov rcx, rax
call fcn.1401666a0
movzx edx, word [rsp + 0x30]
mov r8d, 1
mov r9, qword [rbx + 0x28]
mov rcx, qword [rdi]
call fcn.1401757ac
movzx ecx, word [rsp + 0x30]
mov rax, qword [rdi]
mov byte [rcx + rax], 0
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x80]
test al, al
je 0x14005162e
mov ecx, dword [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
dec ecx
lea rdx, [rax + rcx*8]
movzx eax, word [rsp + 0x30]
add eax, 2
add qword [rdx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14007d3b0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xd8], 0
mov rbx, rcx
je 0x14007d413
mov rcx, qword [rcx + 0xe8]
test rcx, rcx
je 0x14007d413
xor edx, edx
mov qword [rsp + 0x30], rdi
mov byte [rbx + 0xd9], 0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0xb8]
cmp eax, 1
sete dil
test rcx, rcx
je 0x14007d404
test dil, dil
je 0x14007d404
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 0x38]
movzx eax, dil
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140081820
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rcx, [rbx + 0x18]
call fcn.140015800
mov r8, rax
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x30
pop rbx
ret
Function at 0x1400a12f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x1401c878c]
movaps xmm0, xmm6
call fcn.140186eac
movss xmm1, dword [0x1401c8784]
divss xmm1, xmm0
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x1400a1347
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x1400a1347
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, 1
xor eax, 1
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm2, dword [0x1401bd170]
mov ecx, 1
cvttss2si eax, xmm1
xorps xmm0, xmm0
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1400a150e
mov edx, dword [rbx]
mov qword [rsp + 0x40], rsi
xor esi, esi
mov qword [rsp + 0x48], rdi
mov edi, eax
cmp edx, 0x270
jne 0x1400a13d0
lea r8, [rbx + 8]
mov r9d, edx
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1400a1390
mov edx, dword [rbx]
jmp 0x1400a14b0
cmp edx, 0x4e0
jb 0x1400a14b0
lea r10, [rbx + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
nop dword [rax]
mov edx, dword [r10 + 4]
lea r8, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400a13f0
lea r10, [rbx + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
nop dword [rax]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400a1440
mov edx, dword [rbx + 0x1380]
xor edx, dword [rbx + 4]
btr edx, 0x1f
xor edx, dword [rbx + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [rbx + 0x634]
xor ecx, edx
mov edx, esi
mov dword [rbx + 0x9c0], ecx
mov dword [rbx], esi
mov eax, edx
xorps xmm1, xmm1
inc edx
mov ecx, dword [rbx + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbx + 0x1384]
xor ecx, eax
mov dword [rbx], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2ss xmm1, rax
mulss xmm1, xmm2
mulss xmm2, xmm6
addss xmm0, xmm1
sub rdi, 1
jne 0x1400a1378
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x20]
divss xmm0, xmm2
add rsp, 0x30
pop rbx
ret
Function at 0x1400b2e60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x11
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x12
movzx edi, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x5b
movzx esi, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x5c
movzx ebp, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, ebx
mov rbx, qword [rsp + 0x30]
shr ecx, 0xf
mov edx, ecx
or edx, 2
test di, di
mov rdi, qword [rsp + 0x48]
cmovns edx, ecx
mov ecx, 0xf
mov r8d, edx
or r8d, 4
test si, si
mov rsi, qword [rsp + 0x40]
cmovns r8d, edx
or ax, bp
mov rbp, qword [rsp + 0x38]
bt ax, cx
mov ecx, r8d
setae al
or ecx, 8
test al, al
cmovne ecx, r8d
mov eax, ecx
or eax, 0x10
cmp byte [r14 + 0x50c], 0
cmove eax, ecx
mov ecx, eax
or ecx, 0x20
cmp byte [r14 + 0x50d], 0
cmove ecx, eax
mov eax, ecx
or eax, 0x40
cmp byte [r14 + 0x50e], 0
cmove eax, ecx
add rsp, 0x20
pop r14
ret
Function at 0x14012fd40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x240
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
call fcn.140010740
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call fcn.1401666a0
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400156a0
mov rax, rdi
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret

Function at 0x14013b1c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
lea rax, vtable.CStaticTimer.0
mov esi, edx
mov qword [rcx], rax
mov rdi, rcx
mov rdx, qword [0x14024e0e8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
mov ebx, eax
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14013b258
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xc8
jae 0x14013b258
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x14013b214
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14013b285
nop
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140145620
mov rcx, rbx
test rbx, rbx
jne 0x14013b270
mov rcx, qword [rdi + 8]
mov edx, 0x18
call fcn.140145620
test sil, 1
je 0x14013b2a6
mov edx, 0x38
mov rcx, rdi
call fcn.140145620
mov rbx, qword [rsp + 0x70]
mov rax, rdi
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1401402a0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rcx + 0x14], 0xffffffff
lea rsi, [rcx - 0x58]
mov ecx, 0x10
call fcn.1401455e4
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140140319
mov ecx, 8
call fcn.1401455e4
test rax, rax
je 0x1401402e6
mov qword [rax], rsi
mov qword [rsp + 0x50], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140140ec0]
xor edx, edx
xor ecx, ecx
call fcn.14017e404
mov qword [rbx], rax
test rax, rax
je 0x140140366
jmp 0x14014031b
xor ebx, ebx
lea rax, [rdi + 0x30]
lea rcx, [rsp + 0x40]
cmp rax, rcx
je 0x14014033c
mov rcx, qword [rax]
mov qword [rax], rbx
test rcx, rcx
je 0x140140354
cmp dword [rcx + 8], 0
jne 0x140140377
jmp 0x14014034a
test rbx, rbx
je 0x140140354
cmp dword [rbx + 8], 0
jne 0x140140377
mov rcx, rbx
mov edx, 0x10
call fcn.140145620
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call fcn.140143e90
nop
call fcn.14017e2b8
int3

Function at 0x140141320
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
lea rax, vtable.DragDropSource.0
mov rbx, rcx
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
lea ecx, [rax + 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14014135b
or dword [rbx + 0x10], 1
mov rax, rbx
or dword [rbx + 0xc], 2
add rsp, 0x20
pop rbx
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140141373
or dword [rbx + 0x10], 2
or dword [rbx + 0xc], 1
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140145498
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14024e920]
mov ebx, r9d
mov rdi, r8
mov esi, edx
test rax, rax
je 0x1401454c3
call qword [case.0x140152076.0]
jmp 0x1401454d8
call fcn.140145464
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14014b434
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14014b447
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14014ba48
lea rdx, [0x140233bb0]
lea rcx, [rsp + 0x20]
call fcn.14016534c
int3

Function at 0x140155bd8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14024f0f8]
xor edx, edx
jmp fcn.14014b434

Function at 0x14015654c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14024f0f8]
jmp fcn.14014b434

Function at 0x140161d80
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140161e3c]
mov r9, qword [r9 + 8]
jmp fcn.1401535f0