joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a7608
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lock inc dword [rcx + 0x1b88]
mov rcx, qword [rcx + 0x58]
call fcn.1400b5038
mov rax, qword [rbx + 0x58]
mov dl, 1
mov byte [rbx + 0x1c3c], 1
mov rcx, qword [rax]
add rcx, 0x18
add rsp, 0x20
pop rbx
jmp fcn.14010b210

Function at 0x1400aa24c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x14
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400aa268
bts dword [rbx], 7
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400aa27a
or dword [rbx], 0x20
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400aa28c
or dword [rbx], 0x40
add rsp, 0x20
pop rbx
ret

Function at 0x1400aa668
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400aa694
xor eax, eax
jmp 0x1400aa812
mov r14d, dword [rcx + 0x47a4]
test r14d, r14d
je 0x1400aa7ec
mov eax, dword [rcx + 0x4ab8]
and al, 0x14
cmp al, 4
jne 0x1400aa7ec
test ebp, ebp
jns 0x1400aa6d6
lea rsi, [rcx + 0x49b4]
mov r8d, ebp
mov rcx, rsi
lea rdx, str.Bad_anWndIndex_i_was_requested
call fcn.1400011e8
jmp 0x1400aa805
cmp dword [rcx + 0x49a8], ebp
jne 0x1400aa6fc
lea rsi, [rcx + 0x49b4]
mov r8d, ebp
mov rcx, rsi
lea rdx, str.Far_window__i_is_already_active
call fcn.1400011e8
jmp 0x1400aa802
mov dl, 1
call fcn.1400c3784
test rax, rax
je 0x1400aa729
lea rdx, str.PicView_was_found_r_nPID_u__anWndIndex_i
lea rsi, [rbx + 0x49b4]
mov r8d, r14d
mov rcx, rsi
mov r9d, ebp
call fcn.1400011e8
jmp 0x1400aa805
mov rcx, qword [rbx + 0x18]
lea rsi, [rbx + 0x16dc]
mov rdx, rsi
mov r8d, 0x3ff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400aa74a
mov word [rsi], di
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400b104c
test ax, ax
js 0x1400aa765
lea rdx, str.Progress_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400aa70f
mov rcx, qword [rbx + 0x4258]
call fcn.1400a79b0
test al, al
jne 0x1400aa77e
lea rdx, str.Buffer_not_initialized_r_nPID_u__anWndIndex_i
jmp 0x1400aa70f
mov rcx, qword [rbx + 0x4258]
cmp rcx, qword [rbx + 0x4270]
je 0x1400aa79a
lea rdx, str.Alternative_buffer_is_active_r_nPID_u__anWndIndex_i
jmp 0x1400aa70f
cmp byte [rbx + 0x49a0], 1
jne 0x1400aa7bb
call fcn.1400a77f4
movzx eax, al
test eax, eax
je 0x1400aa7bb
lea rdx, str.Menu_or_macro_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400aa70f
mov rcx, qword [rbx + 0x4270]
test rcx, rcx
je 0x1400aa7e7
call fcn.1400a0668
mov rcx, rax
call fcn.140136dd8
test eax, 0xff00
je 0x1400aa7e7
lea rdx, str.Dialog_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400aa70f
mov eax, r14d
jmp 0x1400aa812
lea rsi, [rcx + 0x49b4]
mov rcx, rsi
lea rdx, str.Far_was_not_found_in_console
call fcn.140041e2c
or edi, 0xffffffff
mov rdx, rsi
mov rcx, rbx
call fcn.1400b2d14
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400aad9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rcx + 0x4abc]
mov dl, 1
mov esi, r14d
mov rdi, rcx
and esi, 0xffff0000
call fcn.1400b0590
xor r15d, r15d
test eax, eax
jne 0x1400aade3
or rbp, 0xffffffffffffffff
mov ebx, r15d
mov edx, ebp
jmp 0x1400aaf10
movzx eax, byte [rdi + 0x49a0]
cmp eax, 1
je 0x1400aae01
cmp eax, 2
jne 0x1400aadf9
or esi, 0x20
jmp 0x1400aae01
cmp eax, 3
jne 0x1400aae01
or esi, 0x10
or rbp, 0xffffffffffffffff
test si, si
jne 0x1400aaeb7
lea rdx, [rdi + 0x27074]
mov r8, rbp
lea rbx, [rdi + 0xeda]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400aae1f
mov rcx, rbx
call fcn.140146910
test eax, eax
je 0x1400aaeb4
lea rdx, [rdi + 0x270b4]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400aae3f
mov rcx, rbx
call fcn.140146910
test eax, eax
je 0x1400aaeb4
lea rdx, [rdi + 0x270f4]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400aae5f
mov rcx, rbx
call fcn.140146910
test eax, eax
je 0x1400aaeaf
lea rdx, [rdi + 0x27134]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400aae7f
mov rcx, rbx
call fcn.140146910
test eax, eax
je 0x1400aaeaf
mov r8b, 1
xor r9d, r9d
mov dl, r8b
mov rcx, rdi
call fcn.1400c3384
test al, al
je 0x1400aaeb7
or esi, 1
jmp 0x1400aaeb7
or esi, 0x20
jmp 0x1400aaeb7
or esi, 0x10
mov ebx, esi
mov eax, esi
and ebx, 0xfff8ffff
mov ecx, 0x10000
and al, 0x30
cmove ebx, esi
test bl, 1
je 0x1400aaed8
and ebx, 0xfff9ffff
or ebx, ecx
movzx edx, word [rdi + 0x3a20]
cmp dx, 0x64
ja 0x1400aaf1a
cmp word [rdi + 0x3a2c], dx
jne 0x1400aaefb
btr ebx, 0x12
movzx edx, bp
bts ebx, 0x11
jmp 0x1400aaf10
mov eax, ebx
and eax, ecx
mov ecx, ebx
bts ecx, 0x11
test eax, eax
cmove ecx, ebx
mov ebx, ecx
btr ebx, 0x12
mov rcx, rdi
call fcn.1400c4638
jmp 0x1400aaf69
mov ecx, 0x30000
mov eax, ebx
and eax, ecx
cmp eax, ecx
jne 0x1400aaf69
cmp word [rdi + 0x3a24], bp
je 0x1400aaf69
cmp dword [rdi + 0x3a28], r15d
jne 0x1400aaf47
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x3a28], eax
jmp 0x1400aaf69
mov esi, 0x40000
test dword [rdi + 0x4abc], esi
jne 0x1400aaf67
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + 0x3a28]
cmp eax, 0x7d0
jbe 0x1400aaf69
or ebx, esi
cmp word [rdi + 0x3a20], bp
jne 0x1400aafa6
cmp word [rdi + 0x3a24], bp
je 0x1400aafa6
bt ebx, 0x11
jae 0x1400aaf8c
test bl, 1
je 0x1400aafa6
and ebx, 0xfff9ffff
mov edx, ebp
mov rcx, rdi
call fcn.1400c4638
mov rcx, qword [rdi + 8]
mov dword [rdi + 0x3a28], r15d
call fcn.140025078
cmp ebx, r14d
je 0x1400aafbc
mov rcx, qword [rdi + 8]
xor edx, edx
mov dword [rdi + 0x4abc], ebx
call fcn.140024d60
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400aafd8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x820], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x4998], edi
jle 0x1400ab051
cmp byte [rcx + 0x49a0], 1
jne 0x1400ab051
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x3ff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400ab02f
mov word [rbx + 0x3220], di
jmp 0x1400ab051
cmp word [rsp + 0x20], 0x7b
je 0x1400ab03f
cmp word [rsp + 0x20], 0x28
jne 0x1400ab051
lea rcx, [rbx + 0x3220]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x848]
add rsp, 0x830
pop rdi
ret

Function at 0x1400abed4
Capabilities:
Enumerate processes

Disassembly:
test rcx, rcx
je 0x1400ac05d
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
mov rdx, qword [rcx + 0x678]
lea rcx, [rsp + 0x28]
call fcn.1400a8c74
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1400abffd
lea rdx, str.Prepare_searching_for_conhost
mov rcx, rsi
call fcn.1400b2d14
mov rdi, qword [rbx + 0x10]
jmp 0x1400abf5b
mov rax, qword [rdi + 8]
lea r8, [rax + rax*2]
shl r8, 2
mov rcx, qword [rdi]
call fcn.14013b230
mov rdi, qword [rdi + 0x10]
xor edx, edx
test rdi, rdi
jne 0x1400abf43
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400abfed
mov dword [rsp + 0x40], 0x238
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x44]
call fcn.14013b230
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400abfe4
mov dword [rsp + 0x20], 1
lea rdx, str.conhost.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400abfd3
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
lea rcx, [rbx + 0x10]
call fcn.1400bc474
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400abfaa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Prepare_searching_for_conhost___Done
mov rcx, rsi
call fcn.1400b2d14
nop
lea rax, vtable.CRefGuard_class_CRealConsole::CConHostSearch_.0
mov qword [rsp + 0x28], rax
test rbx, rbx
je 0x1400ac037
mov eax, dword [rbx + 8]
mov ecx, 0x7fffffff
cmp eax, ecx
je 0x1400ac037
lock dec dword [rbx + 8]
mov eax, dword [rbx + 8]
test eax, eax
jg 0x1400ac034
mov dword [rbx + 8], ecx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax]
jmp 0x1400ac037
mov eax, dword [rbx + 8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ad4f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
test rcx, rcx
je 0x1400ad54d
push rbx
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x14021f3fc]
sub edx, eax
cmp edx, 0x3e8
jae 0x1400ad531
or r9, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, str.Space_bounce_received_from_unknown_window
lea edx, [r9 + 0x41]
call fcn.14002b0f8
jmp 0x1400ad548
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or edx, 0xffffffff
mov rcx, rbx
mov dword [0x14021f3fc], eax
call fcn.1400be710
add rsp, 0x30
pop rbx
ret

Function at 0x1400ae418
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rdi, rdx
mov rbx, rcx
and dword [rbp + 0x20], 0
lea r14, vtable.CRefGuard_class_CRConData_.0
mov qword [rbp - 0x20], r14
and qword [rbp - 0x18], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x10], eax
lea rax, vtable.CRConDataGuard.0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.1400a0568
test al, al
je 0x14009ea10
lea rcx, [rbp - 0x30]
call fcn.1401277b4
nop
lea rdx, [rbx + 0x1a80]
or r9d, 0xffffffff
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.1401279e0
mov rdx, qword [rbp - 0x18]
mov eax, dword [rbx + 0x1c08]
imul eax, dword [rbx + 0x1c04]
cmp dword [rdx + 0x18], eax
cmovb eax, dword [rdx + 0x18]
lea ebx, [rax + rax]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
mov r8d, ebx
mov rdx, qword [rdx + 0x28]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x20]
mov r8d, ebx
mov rdx, qword [rbp - 0x18]
mov rdx, qword [rdx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rbp - 0x30]
call fcn.14012782c
nop
mov qword [rbp - 0x20], r14
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14009ea41
mov eax, dword [rcx + 8]
mov edx, 0x7fffffff
cmp eax, edx
je 0x14009ea41
lock dec dword [rcx + 8]
mov eax, dword [rcx + 8]
test eax, eax
jg 0x14009ea3e
mov dword [rcx + 8], edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x14009ea41
mov eax, dword [rcx + 8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rcx + 0x4270]
jmp 0x14009e93c

Function at 0x1400b074c
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x240], rax
test rcx, rcx
je 0x1400b07c4
mov eax, dword [rcx + 0x4290]
test eax, eax
je 0x1400b077c
cmp eax, dword [rcx + 0x644]
je 0x1400b07c4
cmp byte [rcx + 0x4b06], 0
jne 0x1400b07c4
cmp dword [rcx + 0x644], 0
je 0x1400b07c4
lea rax, [rcx + 0x4032]
xor edx, edx
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov r8d, 0x210
call fcn.14013b230
lea rdx, [rsp + 0x20]
lea rcx, [0x1400aec04]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rsp + 0x30]
jmp 0x1400b07c6
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x258
ret
Function at 0x1400b1df4
Capabilities:
Log keystrokes

Disassembly:
test rcx, rcx
je 0x1400b1ea7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x28], 0
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400b1e8f
and dword [r8], 0
xor edx, edx
mov r15, qword [rsp + 0x60]
and dword [r15], 0
mov rcx, qword [0x14021c5e0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
and dword [r14], 0
xor edx, edx
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
cmp eax, dword [rbx + 0x48]
je 0x1400b1e89
mov r8d, 1
mov edx, ebp
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rdi], eax
test eax, eax
jne 0x1400b1e7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
jmp 0x1400b1e80
mov dword [rbx + 0x48], esi
mov dword [r14], 1
jmp 0x1400b1e8f
mov dword [rdi], 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400b45ec
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rdi, r9
mov ecx, 0x286
cmp r8d, ecx
jne 0x1400b47de
mov rdx, qword [rbx + 0x28]
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b464c
mov rax, qword [rbp + 0x60]
mov r8d, ecx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400b6da0
jmp 0x1400b47de
mov r15d, 1
xorps xmm0, xmm0
mov word [rbp - 0x28], r15w
movups xmmword [rbp - 0x24], xmm0
lea ecx, [r15 + 0x13]
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, r15w
mov ecx, 0x90
mov word [rbp - 0x30], ax
call qword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
mov ecx, 0x91
and si, r15w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, 0xa4
and r14w, r15w
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13d, 0x8000
mov ecx, 0xa5
movzx r15d, ax
and r15w, r13w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r12d, ax
mov ecx, 0xa2
and r12w, r13w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, ax
mov ecx, 0xa3
mov eax, 0x8000
and r13w, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov ecx, 0x10
mov word [rbp - 0x2e], ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [rbx + 0x47a4]
xor r9d, r9d
movzx r8d, ax
mov r10d, 1
mov eax, 0x8000
mov word [rbp - 0x20], r10w
and r8w, ax
test edx, edx
je 0x1400b472e
mov ecx, dword [rbx + 0x4ab8]
and cl, 0x14
cmp cl, 4
je 0x1400b4731
mov edx, r9d
neg edx
mov word [rbp - 0x1a], di
mov ecx, 0xff
mov dword [rbp - 0x24], r10d
sbb ax, ax
and ax, 0xe5
mov word [rbp - 0x1e], ax
mov eax, dword [rbp + 0x60]
shr eax, 0x10
and ax, cx
mov ecx, 0x100
test dword [rbp + 0x60], 0x1000000
mov word [rbp - 0x1c], ax
mov eax, r9d
cmovne eax, ecx
mov dword [rbp - 0x18], eax
cmp word [rbp - 0x30], r9w
je 0x1400b477b
bts eax, 7
mov dword [rbp - 0x18], eax
test si, si
je 0x1400b4786
or eax, 0x20
mov dword [rbp - 0x18], eax
test r14w, r14w
je 0x1400b4792
or eax, 0x40
mov dword [rbp - 0x18], eax
test r15w, r15w
je 0x1400b479e
or eax, 2
mov dword [rbp - 0x18], eax
test r12w, r12w
je 0x1400b47aa
or eax, r10d
mov dword [rbp - 0x18], eax
test r13w, r13w
je 0x1400b47b6
or eax, 8
mov dword [rbp - 0x18], eax
cmp word [rbp - 0x2e], r9w
je 0x1400b47c3
or eax, 4
mov dword [rbp - 0x18], eax
test r8w, r8w
je 0x1400b47cf
or eax, 0x10
mov dword [rbp - 0x18], eax
mov r8b, r10b
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.1400b6a14
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b5a28
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1400ab3f8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov edx, dword [rbx + 0xc]
mov ecx, dword [rbx + 8]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbx + 0x18], rax
inc rax
mov byte [rbx + 0x10], 1
test rax, 0xfffffffffffffffe
jne 0x1400b5a86
test byte [rbx + 8], 0x18
mov byte [rbx + 0x11], 0
je 0x1400b5a8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x18
jne 0x1400b5a8a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
ja 0x1400b5a8a
jmp 0x1400b5a42
mov byte [rbx + 0x11], 1
mov al, byte [rbx + 0x11]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b6c64
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400b6caa
test r8, r8
je 0x1400b6caa
xor dil, dil
call fcn.1400c3b00
test al, al
jne 0x1400b6cc5
lea rdx, str.PostConsoleEventPipe_skipped_due_to_server_not_alive
mov rcx, rbx
call fcn.1400b2c74
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
mov rax, qword [rbx + 0x8b8]
mov r12d, 1
add rax, r12
test rax, 0xfffffffffffffffe
jne 0x1400b6cf2
mov rcx, rbx
call fcn.1400b5a98
test al, al
jne 0x1400b6cf2
lea rdx, str.PostConsoleEventPipe_skipped_due_to_OpenConsoleEventPipe_failed
jmp 0x1400b6ca2
and qword [rsp + 0x20], 0
lea eax, [rsi + rsi*2]
lea ebp, [rax*8 + 8]
mov dword [r14 + 4], esi
mov dword [r14], ebp
lea r9, [rsp + 0x58]
mov rcx, qword [rbx + 0x8b8]
mov r8d, ebp
mov rdx, r14
mov dword [0x14021f3f8], r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400b6d31
mov dil, r12b
jmp 0x1400b6d90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov esi, eax
call fcn.1400c2ff4
test al, al
jne 0x1400b6d90
lea eax, [rsi - 0xe8]
cmp eax, r12d
ja 0x1400b6d90
mov rcx, rbx
call fcn.1400c3b00
test al, al
je 0x1400b6d90
mov rcx, rbx
call fcn.1400b5a98
test al, al
je 0x1400b6d90
mov rcx, qword [rbx + 0x8b8]
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
movzx edi, dil
cmovne edi, r12d
and dword [0x14021f3f8], 0
mov al, dil
jmp 0x1400b6cac
Function at 0x1400b71ec
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, dx
movzx ebp, r9w
mov ebx, r8d
mov rsi, rcx
test rcx, rcx
jne 0x1400b721d
xor al, al
jmp 0x1400b72a5
mov eax, dword [rsp + 0x90]
cmp eax, 0xffffffff
jne 0x1400b7233
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test ebx, ebx
jne 0x1400b7266
mov edx, edi
sub edx, 0xa2
je 0x1400b7261
sub edx, 1
je 0x1400b725c
sub edx, 1
je 0x1400b7255
cmp edx, 1
jne 0x1400b7266
mov ebx, 0x100
mov edi, 0x12
jmp 0x1400b7266
mov ebx, 0x100
mov edi, 0x11
mov ecx, 1
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov word [rsp + 0x20], cx
movups xmmword [rsp + 0x24], xmm0
and dword [rsp + 0x24], 0
xor r8d, r8d
mov word [rsp + 0x28], cx
mov rcx, rsi
mov word [rsp + 0x2a], di
mov word [rsp + 0x2c], ax
mov word [rsp + 0x2e], bp
mov dword [rsp + 0x30], ebx
call fcn.1400b6a14
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140139b10
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b9a6c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rdi, rdx
xor esi, esi
lea rdx, [rsp + 0x40]
mov ecx, 0xc8
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400b9aff
mov r9, rdi
lea rdx, [0x1401a2c20]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1400b9aff
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b9aff
mov word [rdi], si
mov ebx, esi
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400be8f0
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x1400be946
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400be946
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400be946
mov rdx, qword [rbx + 0x28]
mov r9b, 1
mov r8d, 5
mov byte [rbx + 0x61], 0
mov rcx, rbx
call fcn.1400be9bc
mov rcx, qword [rbx]
add rcx, 0x18
call fcn.14010a2c4
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx]
add rcx, 0x18
mov byte [rbx + 0x61], 1
call fcn.14010a2c4
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400be989
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400be989
mov rdx, qword [rbx + 0x28]
mov r9b, 1
xor r8d, r8d
mov rcx, rbx
call fcn.1400be9bc
mov rcx, qword [rbx]
add rcx, 0x18
add rsp, 0x20
pop rbx
jmp fcn.14010a48c

Function at 0x1400beae8
Capabilities:
Get graphical window text

Disassembly:
test rcx, rcx
je 0x1400bebc0
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
xor edx, edx
xor r9d, r9d
mov r8d, 0x8002
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400beb88
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1400beb83
cmp word [rsp + 0x20], 0x22
jne 0x1400beb83
cmp word [rsp + 0x2e], 0x22
jne 0x1400beb83
mov edx, 6
xor ecx, ecx
lea rax, [0x14016a968]
movzx eax, word [rcx + rax]
cmp word [rsp + rcx + 0x22], ax
jne 0x1400beb83
add rcx, 2
sub rdx, 1
jne 0x1400beb5d
mov rcx, rbx
call fcn.14012c370
jmp 0x1400beba0
mov rdx, rbx
jmp 0x1400beb15
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xfff7
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.140139b10
mov rbx, qword [rsp + 0x248]
add rsp, 0x230
pop rdi
ret
Function at 0x1400bf064
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rdi + 5]
mov rcx, rsi
lea rdx, str.Initializing_ConEmu__4_
mov ebx, eax
call fcn.1400bca4c
mov rcx, qword [rsi]
call fcn.140118b94
lea r8, [rsi + 0x3a48]
mov dword [rsp + 0x20], eax
lea r9, str.RCon::MonitorThread_ID_i
mov rdx, rsi
lea rcx, [0x1400b2dd0]
call fcn.1401270bc
lea r8d, [rdi + 5]
mov qword [rsi + 0x3a40], rax
lea rdx, str.Initializing_ConEmu__5_
mov rcx, rsi
call fcn.1400bca4c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x9c4
jbe 0x1400bf11b
mov r8d, eax
lea rdx, str._DBG__Very_high_CPU_load__CreateThread_takes__u_ms
lea rcx, [rsp + 0x30]
call fcn.140003d74
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400b2d14
cmp qword [rsi + 0x3a40], rdi
jne 0x1400bf13f
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, str.Cant_create_console_thread_
xor edx, edx
call fcn.14011f550
jmp 0x1400bf142
mov dil, 1
mov al, dil
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret