joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab4e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x1400ab720
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x1400ab576
sub ecx, 1
je 0x1400ab546
cmp ecx, 1
je 0x1400ab52a
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400ab534
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140004f70
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x1400ab6b9
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001420
cmp dword [0x140131484], 0
jne 0x1400ab677
cmp qword [rdi + 0x10], 0
jne 0x1400ab677
cmp qword [0x14013af80], rdi
jne 0x1400ab5a4
test rbx, rbx
jne 0x1400ab623
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400ab61e
xor esi, esi
mov qword [0x14013af80], rsi
test rbx, rbx
je 0x1400ab60c
mov edx, dword [0x140135214]
test edx, edx
je 0x1400ab5ee
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x1401395c0]
mov qword [rsp + 0x20], rsi
call fcn.1400419b0
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.1400a7dc0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400ab65e
cmp byte [rdi + 0x23], 0
jne 0x1400ab62f
mov rax, qword [rdi + 0x10]
jmp 0x1400ab632
mov rax, rdi
test byte [rax + 0x21], 4
je 0x1400ab640
mov rdx, rdi
call fcn.140041b00
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x14013af80], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x14013af80], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x1400ab71b
test r8, r8
jne 0x1400ab6c9
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x1400ab6af
mov rdx, rdi
call fcn.140041b00
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x1400ab71b
cmp r8, 0x186a0
jae 0x1400ab70d
movzx eax, word [rdx]
test ax, ax
je 0x1400ab703
nop dword [rax]
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x1400ab6f0
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x1400ab6b4
mov rcx, rbx
call fcn.1400c64d0
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x1400ab6b4
mov rcx, qword [rdi + 0x10]
call fcn.1400ab4e0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400ac290
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x1400ac2a6
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140139538]
mov r15d, eax
je 0x1400ac2d7
mov rcx, rbx
call fcn.1400ad6d0
test al, al
je 0x1400ac2d7
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x1400ac2fc
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rbx, rsi
jne 0x1400ac314
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400ac32f
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x1401344fe], 0
jne 0x1400ac34c
mov rdx, rsi
mov rcx, rbx
call fcn.1400ac1d0
test rax, rax
jne 0x1400ac49b
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x1400ac3d5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400ac3da
cmp dword [0x140139538], eax
je 0x1400ac3b1
mov rcx, rsi
call fcn.1400ad6d0
test al, al
jne 0x1400ac3b1
mov ecx, dword [0x140139538]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x1400ac3da
cmp r14d, r15d
je 0x1400ac3da
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x1400ac3da
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.1400ac1d0
mov rbp, rax
test rax, rax
jne 0x1400ac442
inc edi
cmp edi, 5
jl 0x1400ac3e0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.1400113e0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.1400113e0
mov rdx, rsi
mov rcx, rbx
call fcn.1400ac1d0
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x1400ac463
mov ecx, dword [0x140139538]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x1400ac47c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x1400ac494
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x1400ac496
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x1400ac5f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400ac610
call fcn.140074790
jmp 0x1400ac620
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x1400ac686
mov qword [rsp + 0x30], rbp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword gs:[0x48]
mov ebp, eax
cmp dword [0x140139538], esi
jne 0x1400ac659
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400018b0
jmp 0x1400ac664
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400ac681
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rdi + rbp]
sub ecx, eax
cmp ecx, 5
jg 0x1400ac640
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ac870
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11bf0]
mov eax, 0x11cf0
call fcn.1400decd0
sub rsp, rax
mov r10, qword [rbp + 0x11c20]
mov rdi, rcx
movzx ecx, word [rdx]
mov r11d, 0xffdf
lea eax, [rcx - 0x41]
test r11w, ax
jne 0x1400ac924
cmp word [rdx + 2], 0
jne 0x1400ac924
cmp word [r8], 0
jne 0x1400ac924
cmp word [r9], 0
jne 0x1400ac924
cmp word [r10], 0
jne 0x1400ac924
mov qword [rsp + 0x11d00], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x1400ac8f3
cmp byte [rdi + 0x12a], 0
jne 0x1400ac8f3
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
cmp byte [rbp + 0x11c30], 0
je 0x1400ac908
test rbx, rbx
je 0x1400ac908
mov qword [rdi + 0xf8], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x11d00]
mov rdi, qword [rsp + 0x11d08]
add rsp, 0x11cf0
pop rbp
ret
test cx, cx
jne 0x1400ac954
cmp word [r8], cx
jne 0x1400ac954
cmp word [r9], cx
jne 0x1400ac954
cmp word [r10], cx
jne 0x1400ac954
mov rcx, rdi
call fcn.1400acad0
mov rdi, qword [rsp + 0x11d08]
add rsp, 0x11cf0
pop rbp
ret
xor ecx, ecx
mov qword [rsp + 0x28], r10
xorps xmm0, xmm0
mov qword [rsp + 0x20], r9
mov r9, r8
mov dword [rsp + 0x30], ecx
mov r8, rdx
mov byte [rbp + 0x1789], cl
lea rax, [0x140117ad8]
mov dword [rbp + 0x178c], ecx
mov qword [rbp + 0x17a0], rcx
mov rdx, rdi
mov dword [rbp + 0x17a8], ecx
mov qword [rbp + 0x17b0], rcx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf48], rax
movdqa xmmword [rbp + 0x1790], xmm0
movdqa xmmword [rbp + 0x17c0], xmm0
call fcn.1400ad8f0
test eax, eax
je 0x1400aca70
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c28]
mov byte [rbp + 0x1789], al
mov rax, qword [rbp + 0x11c38]
mov qword [rbp + 0x17a0], rax
mov eax, dword [rbp + 0x11c40]
mov dword [rbp + 0x17a8], eax
je 0x1400aca83
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x1400aca45
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400aca70
cmp byte [rdi + 0x12a], 0
jne 0x1400aca3e
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1400aca3e
mov rcx, qword [rbp + 0xf68]
lea edx, [rax - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400aca70
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c8], rax
je 0x1400aca5f
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c8], rax
call fcn.1400ade00
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400adf00
test rax, rax
jne 0x1400aca95
xor eax, eax
mov rdi, qword [rsp + 0x11d08]
add rsp, 0x11cf0
pop rbp
ret
lea rdx, [rsp + 0x30]
lea rcx, [0x1400acb60]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbp + 0x11c30], 0
mov rax, qword [rbp + 0x1790]
je 0x1400acab1
test rax, rax
je 0x1400acab1
mov qword [rdi + 0xf8], rax
mov rdi, qword [rsp + 0x11d08]
add rsp, 0x11cf0
pop rbp
ret
Function at 0x1400ade00
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1898]
test rcx, rcx
je 0x1400adef9
mov eax, dword [rbx]
test eax, eax
je 0x1400adef9
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400ade3f
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400ade5d
mov r8d, 0x7fff
lea rdx, [rbx + 0x18ac]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400ade5d
mov word [rbx + 0x18ac], si
test byte [rbx], 4
je 0x1400ade76
mov rcx, qword [rbx + 0x1898]
lea rdx, [rbx + 0x18a8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x1400adeb4
mov rcx, qword [rbx + 0x1898]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400adeb4
movzx r9d, byte [rbx + 0x1858]
lea rdx, [rbx + 0x11aac]
mov ecx, dword [rsp + 0x30]
call fcn.14006f260
test eax, eax
jne 0x1400adeb4
mov word [rbx + 0x11aac], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x1400adedd
mov rcx, qword [rbx + 0x1898]
lea rdx, [rbx + 0x118aa]
mov r8d, 0x101
call qword [sym.imp.USER32.dll_GetClassNameW]
test dword [rbx], 0x100
je 0x1400adef9
mov rcx, qword [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetParent]
mov qword [rbx + 0x18a0], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1400ae760
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11ce8
call fcn.1400decd0
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400ae83c
xor r9d, r9d
mov byte [rsp + 0x18a8], dl
xorps xmm0, xmm0
mov dword [rsp + 0x20], r9d
lea rcx, [0x140117ad8]
mov byte [rsp + 0x1879], r9b
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400af0f0]
mov dword [rsp + 0x187c], r9d
movdqa xmmword [rsp + 0x1880], xmm0
mov qword [rsp + 0x1890], r9
mov dword [rsp + 0x1898], r9d
movdqa xmmword [rsp + 0x18b0], xmm0
mov qword [rsp + 0x18a0], rax
mov dword [rsp + 0x18ac], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1880], 0
je 0x1400ae83c
mov rax, qword [0x14012fa58]
cmp dword [rax + 0x74], 0xffffffff
jle 0x1400ae83c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140139538], eax
mov rax, qword [0x14012fa58]
mov ecx, dword [rax + 0x74]
jne 0x1400ae836
mov edx, 1
call fcn.1400018b0
mov eax, 1
add rsp, 0x11ce8
ret
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
add rsp, 0x11ce8
ret
Function at 0x1400ae850
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Enumerate gui resources

Disassembly:
push rbx
push r15
sub rsp, 0x28
cmp qword [rcx + 0x10], 0
movzx r15d, dl
mov rbx, rcx
jne 0x1400ae873
mov eax, 1
add rsp, 0x28
pop r15
pop rbx
ret
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x50], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14012fa58]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.1400aee90
cmp byte [rbx], 0
mov rbp, rax
je 0x1400ae8aa
test rax, rax
jne 0x1400ae8b3
jmp 0x1400ae97d
test rbp, rbp
jne 0x1400ae978
test rdi, rdi
je 0x1400ae978
xor r9d, r9d
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword gs:[0x48]
mov r14d, eax
nop word [rax + rax]
cmp dword [0x140139538], esi
jne 0x1400ae909
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400018b0
jmp 0x1400ae914
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400ae937
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, r14d
sub ecx, eax
add ecx, 0x1f4
cmp ecx, 5
jg 0x1400ae8f0
mov rax, qword [0x14012fa58]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
cmp dword [rax + 0x74], 0xffffffff
jle 0x1400ae978
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140139538], eax
mov rax, qword [0x14012fa58]
mov ecx, dword [rax + 0x74]
jne 0x1400ae972
mov edx, 1
call fcn.1400018b0
jmp 0x1400ae978
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [rbx], 0
je 0x1400ae9a0
xor r9d, r9d
mov r8, rbp
movzx edx, r15b
mov rcx, rbx
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop r15
pop rbx
jmp fcn.1400ae9c0
movzx edx, r15b
mov rcx, rbx
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
add rsp, 0x28
pop r15
pop rbx
jmp fcn.1400aebd0
Function at 0x1400aebd0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11cf0
call fcn.1400decd0
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x1400aedae
xor edx, edx
call fcn.1400aedd0
test eax, eax
jne 0x1400aec10
mov rbx, qword [rsp + 0x11d10]
add rsp, 0x11cf0
pop rdi
ret
mov qword [rsp + 0x11d00], rbp
mov qword [rsp + 0x11d08], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14012fa58]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400aee90
mov ecx, dword [0x14013951c]
xor ebp, ebp
test rax, rax
mov dword [rsp + 0x30], ebp
lea rax, [0x140117ad8]
mov dword [rsp + 0x188c], ebp
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [0x14013951c], ecx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x1890], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x18c0], xmm1
test dil, dil
je 0x1400aec92
mov byte [rsp + 0x1889], bpl
test ecx, ecx
je 0x1400aec9a
mov byte [rsp + 0x1889], 1
mov rax, qword [0x140139528]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x18a0], rax
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x18a8], ecx
lea rcx, [0x1400aefb0]
mov qword [rsp + 0x18b0], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1890]
test rax, rax
je 0x1400aed72
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ad610]
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov r10, qword [rsp + 0x28]
test r10, r10
je 0x1400aed1c
mov rcx, qword [rsp + 0x1890]
call fcn.1400ae470
mov qword [rsp + 0x1890], r10
jmp 0x1400aed24
mov r10, qword [rsp + 0x1890]
mov rcx, r10
call fcn.1400ac290
mov rcx, qword [rsp + 0x1890]
call fcn.1400ae470
mov rcx, qword [0x14012fa58]
cmp dword [rcx + 0x74], 0xffffffff
jle 0x1400aed9e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140139538], eax
mov rax, qword [0x14012fa58]
mov ecx, dword [rax + 0x74]
jne 0x1400aed6a
mov edx, 1
call fcn.1400018b0
jmp 0x1400aed9e
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400aed9e
mov eax, dword [0x14013951c]
test eax, eax
je 0x1400aed9e
cmp eax, 1
mov dword [0x14013951c], ebp
setg al
test al, al
je 0x1400aed9e
mov rcx, rsi
call fcn.1400ae470
xor edx, edx
mov rcx, rbx
call fcn.1400aebd0
mov rsi, qword [rsp + 0x11d08]
mov rbp, qword [rsp + 0x11d00]
mov eax, 1
mov rbx, qword [rsp + 0x11d10]
add rsp, 0x11cf0
pop rdi
ret
Function at 0x1400c4ea4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x1400cc450
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400cc224
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400cc224
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400cc224
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400cc224
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400cc224
cmp dword [rcx + 0x84], 0xe
jbe 0x1400cc224
cmp dword [rcx + 0xf8], esi
je 0x1400cc224
mov ecx, r14d
call fcn.1400cc36c
mov ecx, 2
call fcn.1400d68c8
nop
cmp byte [0x140133520], 0
jne 0x1400cc2ee
mov r15d, 1
mov eax, r15d
xchg dword [0x140133514], eax
test ebx, ebx
jne 0x1400cc297
mov rdi, qword [0x14012f020]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140133518]
cmp rcx, rax
je 0x1400cc28e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14001cf60]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140133760]
jmp 0x1400cc2a3
cmp ebx, r15d
jne 0x1400cc2a9
lea rcx, [0x140133778]
call fcn.1400d3458
nop
test ebx, ebx
jne 0x1400cc2c0
lea rdx, [0x1400e6108]
lea rcx, [0x1400e60e8]
call fcn.1400d37f0
lea rdx, [0x1400e6118]
lea rcx, [0x1400e6110]
call fcn.1400d37f0
movzx eax, byte [0x140133520]
test esi, esi
cmove eax, r15d
mov byte [0x140133520], al
jmp 0x1400cc2ee
mov ecx, 2
call fcn.1400d691c
test esi, esi
jne 0x1400cc305
mov ecx, r14d
call fcn.1400cc320
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400cc1b4
Function at 0x1400d8194
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400d8034
call fcn.1400d4024
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.1400d3f04
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400d801c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400d801c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400d8066
lock or dword [rax + 0x14], 0x10
jmp 0x1400d801c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400d8083
mov rcx, qword [rbp + 0x10]
call fcn.1400dd5f8
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400d594c
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400d7a6c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400d80da
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400d801c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400d8146
mov rcx, qword [rbp + 0x10]
call fcn.1400d594c
cmp eax, 0xffffffff
je 0x1400d812d
mov rcx, qword [rbp + 0x10]
call fcn.1400d594c
cmp eax, 0xfffffffe
je 0x1400d812d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1400d594c
movsxd rdi, eax
lea rsi, [0x1401337e0]
mov rcx, rbx
sar rdi, 6
call fcn.1400d594c
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400d8134
lea rax, [0x14012f2e0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400d8146
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400d817c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400d8178
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400d8178
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400d801f
jmp 0x1400d7fec
Function at 0x14014ede0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14014ee0d
xor al, al
jmp 0x14014ef6f
mov rax, qword [0x14016f700]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14016f708]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14016f710]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14016f718]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14016f720]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14016f728]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14016f730]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14016f738]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14016f740]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14014ef61
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14014eeb9
mov r11d, 2
jmp 0x14014eedd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14014eed3
mov r11d, 1
jmp 0x14014eedd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14014ef85
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14014ef22
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14014ef3a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14014ef4a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14014ef58
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14014eea0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14014ef6a