joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b3e40
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
or rdi, 0xffffffffffffffff
mov rcx, qword [rcx + 0x440]
test rcx, rcx
je 0x1400b3e8e
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400b3e60
test rax, rax
je 0x1400b3e8e
call fcn.14004bc80
mov rcx, rax
mov rbx, rax
call qword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call fcn.1400b6820
xor esi, esi
test eax, eax
je 0x1400b3f12
xor r8d, r8d
mov qword [rsp + 0x30], rbp
xor edx, edx
lea rcx, str.C:WindowsSystem32msiexec.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x1400b3efa
mov eax, 2
mul rbp
cmovo rax, rdi
mov rcx, rax
call fcn.14012a2dc
lea r8, [rbp*2]
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14027b2c0
mov r8d, ebp
lea rcx, str.C:WindowsSystem32msiexec.exe
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbp, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x428]
test rcx, rcx
je 0x1400b3f2f
mov rax, rdi
inc rax
cmp word [rcx + rax*2], si
jne 0x1400b3f21
test rax, rax
jne 0x1400b3f4e
mov rcx, qword [rbx + 0x430]
test rcx, rcx
je 0x1400b3f53
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], si
jne 0x1400b3f40
test rax, rax
je 0x1400b3f53
mov rsi, rcx
jmp 0x1400b3f70
mov rax, qword [rbx + 0x458]
test rax, rax
je 0x1400b3f70
nop
inc rdi
cmp word [rax + rdi*2], si
jne 0x1400b3f60
test rdi, rdi
cmovne rsi, rax
mov rcx, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140054e40
Function at 0x1400b4860
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r15, rdx
mov r13, rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov rbx, qword [rdx]
mov rdx, qword [rdx + 8]
sub rdx, rbx
movabs rdi, 0xe38e38e38e38e39
mov rax, rdi
imul rdx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1400b4a85
cmp rbx, qword [r15 + 8]
je 0x1400b4a85
lea rdi, [rbx + 4]
nop dword [rax + rax]
cmp dword [0x14045e968], 0
jne 0x1400b4a7b
cmp qword [rdi + 0x18], 8
jb 0x1400b48f9
mov r8, qword [rdi]
jmp 0x1400b48fc
mov r8, rdi
lea rdx, [0x14033b628]
lea rcx, [rsp + 0x38]
call fcn.14004bec0
nop
cmp qword [rdi + 0x18], 8
jb 0x1400b491a
mov rdx, qword [rdi]
jmp 0x1400b491d
mov rdx, rdi
xor r8d, r8d
mov rcx, qword [r13 + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x1400b498a
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [r13 + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x1400b498a
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400b4973
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14004e2e0
add rbx, 0x24
add rdi, 0x24
cmp rbx, qword [r15 + 8]
jne 0x1400b48e0
jmp 0x1400b4a7b
mov rcx, qword [r13 + 0x480]
call fcn.14004bc80
mov rbp, rax
mov rcx, qword [r13 + 0x480]
call fcn.14004bc80
mov rdi, rax
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1400b4a4a
or r12, 0xffffffffffffffff
nop dword [rax]
cmp qword [rbx + 0x1c], 8
jb 0x1400b49cd
mov rdx, qword [rbx + 4]
jmp 0x1400b49d1
lea rdx, [rbx + 4]
xor r8d, r8d
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b4a4a
test rdi, rdi
je 0x1400b49ee
mov rcx, rdi
call fcn.14012a2d4
xor edi, edi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
test eax, eax
je 0x1400b4a39
mov eax, 2
mul r14
cmovo rax, r12
mov rcx, rax
call fcn.14012a2dc
mov rdi, rax
lea r8, [r14 + r14]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov r8d, r14d
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x1400b49c0
mov rcx, rdi
call fcn.14004bc80
mov qword [r13 + 0x498], rax
mov esi, 1
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x1400b4a7b
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14004e2e0
movabs rdi, 0xe38e38e38e38e39
mov rcx, qword [r15]
test rcx, rcx
je 0x1400b4acf
mov rdx, qword [r15 + 8]
call fcn.140070a30
mov rcx, qword [r15 + 0x10]
sub rcx, qword [r15]
mov rax, rdi
imul rcx
sar rdx, 1
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov rdx, qword [r15]
call fcn.140070950
mov qword [r15], 0
mov qword [r15 + 8], 0
mov qword [r15 + 0x10], 0
mov eax, esi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400b4bf0
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
lea rdx, [rcx + 8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b4d82
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033a8a8]
mov qword [rsp + 0x78], rbx
lea rbx, [rdi + 0x210]
mov rdx, rbx
call fcn.14005ffc0
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033a818]
mov rdx, rbx
mov qword [rdi + 0x428], rax
call fcn.14005ffc0
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033a830]
mov rdx, rbx
mov qword [rdi + 0x458], rax
call fcn.14005ffc0
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033a860]
mov rdx, rbx
mov qword [rdi + 0x430], rax
call fcn.14005ffc0
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033a878]
mov rdx, rbx
mov qword [rdi + 0x440], rax
call fcn.14005ffc0
mov rcx, qword [rsp + 0x50]
lea r8, [0x14033b698]
mov rdx, rbx
mov qword [rdi + 0x448], rax
call fcn.14005ffc0
mov edx, 1
mov qword [rdi + 0x450], rax
mov rcx, rdi
call fcn.1400b3b50
mov rbx, qword [rsp + 0x78]
mov qword [rdi + 0x480], rax
test rax, rax
je 0x1400b4d77
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b4d77
cmp dword [rdi + 0x4a4], 0
jne 0x1400b4d77
lea rdx, [0x140460248]
lea rcx, [rsp + 0x38]
call fcn.140070880
mov rdx, rax
mov rcx, rdi
call fcn.1400b4860
mov dword [rdi + 0x494], eax
test eax, eax
jne 0x1400b4d77
lea rdx, [0x1404602f8]
lea rcx, [rsp + 0x38]
call fcn.140070880
mov rcx, qword [rdi + 0x480]
mov rdx, rax
call fcn.1400b4b00
mov dword [rdi + 0x490], eax
test eax, eax
jne 0x1400b4d77
lea edx, [rax + 1]
mov rcx, rdi
call fcn.1400b43b0
mov qword [rdi + 0x488], rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x60
pop rdi
ret
Function at 0x1400b6950
Capabilities:
Check if file exists

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x488
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, qword [rsp + 0x4e0]
xor r14d, r14d
mov qword [rsp + 0x30], rcx
mov rdi, r9
mov r12, r8
mov r13, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400b6bca
test r8, r8
je 0x1400b6bca
test r15, r15
je 0x1400b6bca
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b6bca
mov r8, r12
mov qword [rsp + 0x478], rsi
mov rdx, r13
mov rcx, rbp
call fcn.14005ffc0
mov rsi, rax
test rax, rax
je 0x1400b6bbd
mov rcx, rax
mov qword [rsp + 0x480], rbx
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov r9, rdi
lea r8, [0x14033bb20]
mov edx, 0x104
lea rcx, [rsp + 0x250]
call fcn.14004ebd0
mov eax, Ordinal_46
lea r8, str._s
mov r9, rdi
mov word [rsp + 0x250], ax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
or rbx, 0xffffffffffffffff
test eax, eax
jne 0x1400b6a83
mov rax, rbx
nop dword [rax]
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b6a50
lea r8, [0x14033bb38]
lea rax, [rsi + rax*2]
mov r9, r15
mov edx, 0x104
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
jmp 0x1400b6b7b
xor r8d, r8d
lea rdx, [rsp + 0x250]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b6ab9
mov r9, r15
lea r8, [0x14033bc70]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
jmp 0x1400b6b7b
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b6ae9
mov rax, rbx
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b6ad1
lea r8, [0x14033bc78]
jmp 0x1400b6a63
mov rcx, rsi
call fcn.14004bc80
mov rcx, rax
mov rbp, rax
call qword [sym.imp.SHLWAPI.dll_PathGetArgsW]
test rax, rax
je 0x1400b6b0b
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
jne 0x1400b6b64
mov rax, rbx
nop dword [rax]
cmp word [rdi + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x1400b6b30
lea rax, [rsi + rax*2]
mov r9, r15
lea r8, [0x14033bc88]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.14004ebd0
mov r14d, 1
test rbp, rbp
je 0x1400b6b71
mov rcx, rbp
call fcn.14012a2d4
test r14d, r14d
je 0x1400b6bad
mov rbp, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x1400b6b80
lea eax, [rbx*2 + 2]
mov r8, r12
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov rdx, r13
mov rcx, rbp
call fcn.140060450
mov r14d, eax
mov rcx, rsi
call fcn.14012a2d4
mov rbx, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x478]
mov eax, r14d
jmp 0x1400b6bcc
xor eax, eax
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x1400b6bf0
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, qword [rsp + 0x2a0]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x1400b6d1f
test r8, r8
je 0x1400b6d1f
test r9, r9
je 0x1400b6d1f
test rbx, rbx
je 0x1400b6d1f
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b6d1f
mov r9, rbp
mov qword [rsp + 0x20], rsi
lea r8, [0x14033bc98]
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14004ebd0
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.DisplayIcon
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.InstallLocation
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.InstallSource
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.ModifyPath
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.UninstallString
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
mov r9, rdi
mov qword [rsp + 0x20], rbx
lea r8, str.QuietUninstallString
mov rcx, r14
lea rdx, [rsp + 0x30]
call fcn.1400b6950
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x250
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400b8b00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rcx + 0xae0], 1
mov rcx, qword [rcx + 0xae8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edi, edi
mov rcx, rbx
mov qword [rbx + 0xae8], rdi
mov dword [rbx + 0xae0], edi
call fcn.1400b91d0
test eax, eax
je 0x1400b8b96
cmp qword [rbx + 0xad0], rdi
je 0x1400b8b96
cmp qword [rbx + 0xab0], rdi
je 0x1400b8b96
cmp qword [0x14045fff0], rdi
je 0x1400b8b96
mov rcx, rbx
call fcn.1400b9700
mov r9, rbx
mov qword [rsp + 0x28], rdi
lea r8, [0x1400b91b0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xae8], rax
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x402
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400ba3c0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
lea rax, [rsp + 0x30]
movzx edi, cx
mov qword [rsp + 0x30], rbx
mov esi, 1
mov qword [rsp + 0x20], rax
mov r9d, esi
lea rdx, [0x14033d2b8]
lea r8d, [rbx + 4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
je 0x1400ba42b
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ba427
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1400ba465
lea rcx, str.X:WindowsSystem32configCOMPONENTS
mov word [str.X:WindowsSystem32configCOMPONENTS], di
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400ba463
lea r8, str.X:WindowsSystem32configCOMPONENTS
mov rcx, 0xffffffff80000002
lea rdx, [0x14033d718]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012a2b0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400be400
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
lea ecx, [rbx + 0x11]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 8
test ax, ax
cmovs ebx, ecx
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400be42f
or ebx, 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400be442
or ebx, 2
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400be455
or ebx, 4
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400be468
or ebx, 0x20
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400c0330
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov r15, r9
mov r14, r8
mov ebp, edx
mov rbx, rcx
mov edi, r12d
cmp dword [rcx + 0x548], r12d
jle 0x1400c03b9
mov esi, r12d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x540]
lea rdx, [rsp + 0x90]
mov byte [rsp + 0x90], r12b
mov r9, r15
mov qword [rsp + 0x20], rdx
mov r8, r14
mov edx, ebp
mov rcx, qword [rsi + rax]
mov rax, qword [rcx]
call qword [rax]
cmp byte [rsp + 0x90], r12b
jne 0x1400c0586
inc edi
add rsi, 8
cmp edi, dword [rbx + 0x548]
jl 0x1400c0370
sub ebp, 0x100
je 0x1400c04b7
sub ebp, 4
je 0x1400c0435
cmp ebp, 2
jne 0x1400c049c
mov ecx, r14d
mov dword [rsp + 0x90], r12d
call fcn.14028ea98
mov rcx, qword [rbx + 0x160]
lea r8, [rsp + 0x90]
mov word [rsp + 0x90], ax
lea rdx, [0x1400c62d0]
mov r9d, 0x80000012
mov rax, qword [rcx]
call qword [rax + 0x268]
mov rbx, rax
test rax, rax
je 0x1400c049c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x250]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x30]
mov al, 1
jmp 0x1400c049e
cmp qword [rbx + 0x168], r12
je 0x1400c049c
xor eax, eax
mov dword [rsp + 0x30], 6
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x190]
mov qword [rsp + 0x44], rax
mov word [rsp + 0x4c], r14w
call fcn.1400be400
mov word [rsp + 0x4e], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rbx + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
cmp r14, 9
jne 0x1400c049c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400c051b
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400c051b
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400c051b
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, str.RichEditUI
call fcn.140279308
test rax, rax
je 0x1400c051b
mov rax, qword [rbx + 0x168]
cmp byte [rax + 0x719], r12b
jne 0x1400c049c
mov rcx, qword [rbx + 0x168]
test rcx, rcx
je 0x1400c056d
mov rax, qword [rcx]
call qword [rax + 0x200]
test al, al
je 0x1400c056d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + 0x218]
test al, al
je 0x1400c056d
mov rcx, qword [rbx + 0x168]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
mov rcx, rax
lea rdx, str.WkeWebkitUI
call fcn.140279308
test rax, rax
jne 0x1400c049c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
call fcn.1400c3d70
mov al, 1
jmp 0x1400c049e
Function at 0x1400c3740
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0xc8]
cmp rax, rcx
je 0x1400c3771
cmp rbx, qword [rdi + 0x168]
je 0x1400c3771
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rdi + 0x168]
cmp rbx, rax
je 0x1400c38a9
test rax, rax
je 0x1400c37fa
xor eax, eax
mov dword [rsp + 0x30], reloc.WS2_32.dll_socket
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, str.killfocus
xor r9d, r9d
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.1400c41e0
mov qword [rdi + 0x168], 0
test rbx, rbx
je 0x1400c38a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp rax, rdi
jne 0x1400c38a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
je 0x1400c38a9
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x218]
test al, al
je 0x1400c38a9
xor eax, eax
mov qword [rdi + 0x168], rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x30], Ordinal_27
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0x168]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov rax, qword [rcx]
call qword [rax + 0x280]
mov rdx, qword [rdi + 0x168]
lea r8, str.setfocus
xor r9d, r9d
mov byte [rsp + 0x28], 0
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.1400c41e0
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400c9760
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x278]
sub rsp, 0x360
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rdi, rcx
mov edx, 0xfffffff0
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x6000000
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rsi, [rdi + 0x58]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
mov r8, rax
mov rdx, qword [rdi + 8]
mov rcx, rsi
call fcn.1400bfec0
lea rdx, [rdi + 0x40]
xor r14d, r14d
test rdi, rdi
cmove rdx, r14
lea rcx, [rdi + 0x598]
call fcn.1400c73b0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], r14d
mov byte [rbp + 0x1a4], 1
mov qword [rbp + 0x1a8], r14
movdqa xmmword [rbp + 0x1b0], xmm0
mov rax, qword [rdi]
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [rax + 0x50]
nop
mov rax, qword [rbp - 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rdi
cmp word [rax], r14w
mov rax, qword [rdi]
je 0x1400c988c
call qword [rax + 0x58]
mov rcx, qword [rax]
call fcn.14028cfec
movzx ebx, ax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x1400c9862
call fcn.1402804a8
lea r9, [rdi + 0x48]
test rdi, rdi
cmove r9, r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
mov r8, qword [rbp - 0x30]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400e0c20
mov rbx, rax
jmp 0x1400c98cb
call qword [rax + 0x58]
nop
lea r9, [rdi + 0x48]
test rdi, rdi
cmove r9, r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, qword [rax]
lea rcx, [rbp + 0x60]
call fcn.1400e0c20
mov rbx, rax
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp rcx, rax
je 0x1400c98cb
call fcn.1402804a8
test rbx, rbx
jne 0x1400c9955
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], r14w
or r8d, 0xffffffff
lea rdx, [0x140351e10]
lea rcx, [rsp + 0x40]
call fcn.1400c76f0
nop
mov rax, qword [rdi]
lea rdx, [rbp + 0x1c0]
mov rcx, rdi
call qword [rax + 0x58]
mov rdx, qword [rax]
lea rcx, [rsp + 0x40]
call fcn.1400c7590
lea rax, [rbp + 0x1c8]
mov rcx, qword [rbp + 0x1c0]
cmp rcx, rax
je 0x1400c992f
call fcn.1402804a8
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Duilib
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, rbx
mov rcx, rsi
call fcn.1400c3100
lea rdx, [rdi + 0x38]
test rdi, rdi
cmove rdx, r14
lea rcx, [rdi + 0x568]
call fcn.1400c73b0
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + gethostname]
nop
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
cmp rcx, rax
je 0x1400c9994
call fcn.1402804a8
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400c99a2
call fcn.1402804a8
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x1400c99b0
call fcn.1402804a8
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.14012a2b0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400cb920
Capabilities:
Get graphical window text

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov rax, qword [0x1403a8088]
xor rax, rbp
mov qword [rbp], rax
cmp byte [rcx + 0x30], 0
mov rdi, rcx
je 0x1400cba05
cmp qword [rcx + 0x20], 0
je 0x1400cba05
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea r8d, [rax + 1]
movsxd rax, r8d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400cb980
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14012b0b0
sub rsp, rcx
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400cba05
mov rcx, qword [rdi + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x20]
mov rdx, rbx
add rcx, 0x1f8
call fcn.1400c7800
mov rbx, qword [rdi + 0x20]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + gethostname]
mov byte [rsp + 0x28], 0
lea r8, str.textchanged
mov rcx, rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
call fcn.1400c41e0
mov rcx, qword [rdi + 0x20]
mov rax, qword [rcx]
call qword [rax + gethostname]
cmp byte [rax + 0x1e1], 0
je 0x1400cba05
mov rcx, qword [rdi + 0x20]
call fcn.1400db070
xor eax, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14012a2b0
mov rbx, qword [rbp + 0x20]
mov rdi, qword [rbp + 0x28]
lea rsp, [rbp + 0x10]
pop rbp
ret

Function at 0x1400cc340
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400dae50
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x200]
test al, al
jne 0x1400cc378
cmp qword [rbx + 0x5e0], 0
je 0x1400cc378
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400c3740
add rsp, 0x20
pop rbx
ret

Function at 0x1400cc380
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x200]
test al, al
jne 0x1400cc3b0
cmp qword [rbx + 0x5e0], 0
je 0x1400cc3b0
mov rcx, qword [rbx + 0x58]
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400c3740
add rsp, 0x20
pop rbx
ret