joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c480
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008c566
cmp word [rcx], 0
je 0x14008c566
mov r8d, 4
lea rdx, [0x1400ee368]
call fcn.1400b3640
mov r8, rbx
test eax, eax
jne 0x14008c4c3
lea r8, [rbx + 8]
test r8, r8
je 0x14008c500
movzx edx, word [r8]
test dx, dx
je 0x14008c500
lea rcx, [0x1400eb6c8]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x14008c52b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008c4e0
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14008c4d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x14008c512
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14008c566
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x14008c553
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x14008cd30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400c0680
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14008cd84
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.1400a9530
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x14008d5e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov ebp, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x14008d61c
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x14008d623
mov rdi, qword [0x140105dd0]
test rdi, rdi
je 0x14008d7db
mov qword [rsp + 0x80], r14
lea r14, [0x140108204]
test ebp, ebp
jns 0x14008d64a
movzx eax, bp
neg ax
movzx edx, ax
jmp 0x14008d680
test ebp, ebp
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r14
cmovne eax, ebp
lea r9, [rsp + 0x40]
lea r8, [0x14008d5c0]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r14
je 0x14008d7a4
mov r8d, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14008d7a4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008d7a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008d7a4
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x14008d6e2
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jbe 0x14008d735
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14008d717
movzx eax, dl
mov edx, ebx
cmp eax, esi
setl dl
jmp 0x14008d721
movzx eax, al
mov edx, ebx
cmp eax, esi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14008d700
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14008d7a4
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008d7a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008d7a4
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
test rcx, rcx
je 0x14008d7c3
test r12, r12
je 0x14008d7c3
mov qword [rcx], rdi
jmp 0x14008d7d1
test r13, r13
je 0x14008d7d1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14008d7db
mov rax, r12
jmp 0x14008d7f8
test ebp, ebp
jle 0x14008d7e4
lea ebx, [rbp - 1]
jmp 0x14008d7ea
cmp ebp, 0xffffffff
cmovl ebx, ebp
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14008e3a0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14008e3ba
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14008e3c4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14008e446
test al, 8
jne 0x14008e441
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14008e402
cmp eax, 9
je 0x14008e402
cmp ecx, 0x20
je 0x14008e402
cmp ecx, 9
je 0x14008e402
cmp eax, 0x30
je 0x14008e402
cmp eax, 0x2b
jne 0x14008e441
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14008ec90
test eax, eax
jne 0x14008e423
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001280
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14008e426
test al, 0x20
je 0x14008e498
mov rcx, rdi
test al, 8
jne 0x14008e484
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008ec90
test eax, eax
je 0x14008e416
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14008e42c
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14008e42c
test al, 1
je 0x14008e4b1
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008e9c0
test al, 2
je 0x14008e4d6
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008f010
cmp byte [rbx + 0x23], 0
jne 0x14008e4e2
mov rax, qword [rbx + 0x10]
jmp 0x14008e4e5
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14008e4f3
mov rdx, rbx
call fcn.140039db0
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008ec90
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14008e520
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14008e605
sub r8d, 1
je 0x14008e5f1
sub r8d, 2
je 0x14008e5df
sub r8d, 1
je 0x14008e57f
cmp r8d, 1
jne 0x14008e5c0
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008f010
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14008e5c0
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14008e605
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14008ec90
test eax, eax
jne 0x14008e5b4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14008e608
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ec90
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008e3a0
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14008e60b
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.140001280
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14008e9c0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14008e9e0
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14008e9d6
cmp byte [rdx + 0x23], 0
jne 0x14008e9ea
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001320
cmp byte [rbx + 0x23], 1
jne 0x14008ea57
cmp rbx, rdi
je 0x14008ea47
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14008ec90
test eax, eax
jne 0x14008ea2e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400a9530
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008ea70
Function at 0x14008ea70
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140108f00]
call fcn.1400056e0
test eax, eax
jne 0x14008eaad
lea r8, [0x1400cffcc]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1401082b0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.140039240
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008eb72
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008eb72
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008eb72
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008eb72
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008ec30
test rdi, rdi
je 0x14008eb59
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008ebd1
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a9530
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008eae0
cmp dword [0x140108f2c], r12d
je 0x14008ebac
cmp qword [0x140108f10], r12
je 0x14008eb98
mov rcx, qword [0x140108f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f2c], r12d
mov qword [0x140108f00], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140108f2c], r12d
je 0x14008ec14
cmp qword [0x140108f10], r12
je 0x14008ec00
mov rcx, qword [0x140108f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f2c], r12d
mov qword [0x140108f00], r12
lea r8, [0x1400cffcc]
lea rdx, [0x1400d0298]
lea rcx, [0x1401082b0]
call fcn.140039240
jmp 0x14008ebb1
cmp dword [0x140108f2c], r12d
je 0x14008ec6a
cmp qword [0x140108f10], r12
je 0x14008ec56
mov rcx, qword [0x140108f00]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f10], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f2c], r12d
mov qword [0x140108f00], r12
lea r8, [0x1400cffcc]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401082b0]
call fcn.140039240
jmp 0x14008ebb1
Function at 0x14008f0e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14008f320
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14008f17d
sub ecx, 1
je 0x14008f146
cmp ecx, 1
je 0x14008f12a
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f134
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140108f00]
call fcn.140004fa0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14008f2c0
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001320
cmp dword [0x140106b28], 0
jne 0x14008f27e
cmp qword [rdi + 0x10], 0
jne 0x14008f27e
cmp qword [0x14010a880], rdi
jne 0x14008f1ab
test rbx, rbx
jne 0x14008f22a
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008f225
xor esi, esi
mov qword [0x14010a880], rsi
test rbx, rbx
je 0x14008f213
mov edx, dword [0x140106b38]
test edx, edx
je 0x14008f1f5
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x1401082b0]
mov qword [rsp + 0x20], rsi
call fcn.140039c60
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14008cd30
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f265
cmp byte [rdi + 0x23], 0
jne 0x14008f236
mov rax, qword [rdi + 0x10]
jmp 0x14008f239
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14008f247
mov rdx, rdi
call fcn.140039db0
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x14010a880], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x14010a880], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14008f31b
test r8, r8
jne 0x14008f2d0
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14008f2b6
mov rdx, rdi
call fcn.140039db0
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14008f31b
cmp r8, 0x186a0
jae 0x14008f30d
movzx eax, word [rdx]
test ax, ax
je 0x14008f303
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14008f2f0
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14008f2bb
mov rcx, rbx
call fcn.1400a9530
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14008f2bb
mov rcx, qword [rdi + 0x10]
call fcn.14008f0e0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008fe20
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14008fe36
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140108290]
mov r15d, eax
je 0x14008fe67
mov rcx, rbx
call fcn.140091220
test al, al
je 0x14008fe67
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rbp
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14008fe90
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x14008fea8
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
cmp byte [0x140106b2f], 0
jne 0x14008fec5
mov rdx, rbp
mov rcx, rbx
call fcn.14008fd80
test rax, rax
jne 0x140090010
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rbp, rbp
je 0x14008ff4e
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14008ff53
cmp dword [0x140108290], eax
je 0x14008ff2a
mov rcx, rbp
call fcn.140091220
test al, al
jne 0x14008ff2a
mov ecx, dword [0x140108290]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14008ff53
cmp r14d, r15d
je 0x14008ff53
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14008ff53
mov r14d, dword [rsp + 0x60]
xor edi, edi
mov rdx, rbp
mov rcx, rbx
call fcn.14008fd80
mov rsi, rax
test rax, rax
jne 0x14008ffb7
inc edi
cmp edi, 5
jl 0x14008ff55
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140012d70
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rsi + 2]
call fcn.140012d70
mov rdx, rbp
mov rcx, rbx
call fcn.14008fd80
mov rsi, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x14008ffd8
mov ecx, dword [0x140108290]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14008fff1
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rsi, rsi
je 0x140090009
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
test byte [rcx + 3], bh
add byte [rax - 0x75], cl
invalid
jmp 0x14009000b
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x140090170
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x140090190
call fcn.140064f70
jmp 0x1400901a0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x1400901fc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.1400016f0
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400901fc
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x1400901fc
mov edx, 1
mov ecx, 0x8000012f
call fcn.1400016f0
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400901d1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140090410
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400c0680
sub rsp, rax
movzx r10d, word [rdx]
mov r11d, 0xffdf
mov rdi, rcx
mov rcx, qword [rbp + 0x11c10]
lea eax, [r10 - 0x41]
test r11w, ax
jne 0x1400904b8
cmp word [rdx + 2], 0
jne 0x1400904b8
cmp word [r8], 0
jne 0x1400904b8
cmp word [r9], 0
jne 0x1400904b8
cmp word [rcx], 0
jne 0x1400904b8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x14009049b
cmp byte [rdi + 0x12a], 0
jne 0x14009049b
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140090499
mov rcx, rbx
call fcn.1400912d0
test al, al
je 0x14009049b
xor ebx, ebx
cmp byte [rbp + 0x11c20], 0
je 0x1400904b0
test rbx, rbx
je 0x1400904b0
mov qword [rdi + 0xf8], rbx
mov rax, rbx
jmp 0x140090625
test r10w, r10w
jne 0x1400904dd
cmp word [r8], r10w
jne 0x1400904dd
cmp word [r9], r10w
jne 0x1400904dd
cmp word [rcx], r10w
jne 0x1400904dd
mov rcx, rdi
call fcn.140090640
jmp 0x140090625
xor ebx, ebx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r9
lea rax, [0x1400cffcc]
mov r9, r8
mov dword [rsp + 0x30], ebx
mov r8, rdx
mov qword [rbp + 0xf48], rax
xorps xmm0, xmm0
mov byte [rbp + 0x1781], bl
mov rdx, rdi
mov dword [rbp + 0x1784], ebx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x1788], rbx
movdqa xmmword [rbp + 0x1790], xmm0
mov dword [rbp + 0x17a0], ebx
mov qword [rbp + 0x17a8], rbx
mov qword [rbp + 0x17b8], rbx
mov qword [rbp + 0x17c0], rbx
call fcn.1400914f0
test eax, eax
je 0x1400905f4
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x1400905f8
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x1400905c9
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400905f4
mov rdx, qword [rbp + 0xf68]
mov rcx, rdi
call fcn.140091360
test al, al
jne 0x1400905c2
mov rcx, qword [rbp + 0xf68]
lea edx, [rbx - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400905f4
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x1400905e3
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.140091990
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140091a80
test rax, rax
jne 0x14009060a
xor eax, eax
jmp 0x140090625
lea rdx, [rsp + 0x30]
lea rcx, [0x1400906f0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x1788]
cmp byte [rbp + 0x11c20], bl
je 0x140090625
test rax, rax
je 0x140090625
mov qword [rdi + 0xf8], rax
lea r11, [rsp + 0x11ce0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140091990
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x140091a73
mov eax, dword [rbx]
test eax, eax
je 0x140091a73
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400919cf
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400919ed
mov r8d, 0x7fff
lea rdx, [rbx + 0x189c]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400919ed
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x140091a06
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x140091a44
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x140091a44
movzx r9d, byte [rbx + 0x1850]
lea rdx, [rbx + 0x11a9c]
mov ecx, dword [rsp + 0x30]
call fcn.1400600a0
test eax, eax
jne 0x140091a44
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x140091a73
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400922e0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400c0680
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14009239a
xor r9d, r9d
mov byte [rsp + 0x18a0], dl
lea rcx, [0x1400cffcc]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov byte [rsp + 0x1871], r9b
lea rcx, [0x140092c20]
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
movdqa xmmword [rsp + 0x1880], xmm0
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x14009239a
mov rax, qword [0x140101a58]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x14009239a
mov edx, 1
call fcn.1400016f0
mov eax, 1
add rsp, 0x11cd8
ret