joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015778
Capabilities:
Check mutex on windows
Enumerate gui resources
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x60
mov r8, qword [0x140047568]
and dword [0x14006db30], 0
mov rbx, rcx
mov qword [0x14006c9c0], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
and qword [rsp + 0x70], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400157be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1400157db
lea rdx, [rsp + 0x70]
lea rcx, [0x140014f34]
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 0xaffe
call qword [sym.imp.USER32.dll_PostQuitMessage]
and qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rbx
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov eax, 0xffffff9c
lea r8, [0x14006c7c0]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov eax, 0x80000000
mov dword [rsp + 0x28], eax
lea rdx, [0x14006c5c0]
mov r9d, 0xcf0002
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 0x3e8
xor r9d, r9d
mov r8d, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140015b74
Capabilities:
Capture webcam image

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
movsxd r8, r8d
xor r9d, r9d
mov edx, 0x419
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rdi
mov edx, 0x41d
movsxd r8, eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140015dcc
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x38
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r12, rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rax + 0x18], r13d
lea rcx, [rax - 0x48]
call fcn.140004508
nop
mov edx, 0x20004
lea rcx, [rsp + 0x20]
call fcn.140004588
mov rbx, rax
mov rcx, rsi
call fcn.140004508
mov dword [rsp + 0x80], 1
lea r9, [0x14006d330]
mov r8d, 0x10000
mov rdx, rbx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov edi, eax
lea rcx, [rsp + 0x88]
call fcn.140004508
nop
lea edx, [rdi + rdi + 4]
lea rcx, [rsp + 0x88]
call fcn.140004588
mov rbp, rax
cmp edi, r13d
jle 0x140015ea8
movzx ecx, word [rbx]
cmp cx, r13w
je 0x140015e7d
mov word [rax], cx
add rax, 2
jmp 0x140015e9e
mov word [rax], r13w
mov rdx, rbp
mov rcx, rsi
call fcn.140004544
lea rdx, [0x140039ff8]
mov rcx, rsi
call fcn.140004544
mov rax, rbp
add rbx, 2
sub rdi, 1
jne 0x140015e6b
lea rcx, [rsp + 0x88]
call fcn.140004268
nop
lea rcx, [rsp + 0x20]
call fcn.140004268
nop
mov rcx, r12
call fcn.140004268
mov rax, rsi
add rsp, 0x38
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140016974
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x460
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
lea rdx, [0x14003a9a0]
mov rcx, qword [rcx]
call fcn.140023f98
mov rbp, rax
xor ebx, ebx
cmp rax, rbx
jne 0x1400169cd
jmp 0x140016ac3
mov word [rsp + 0x20], bx
mov r9, rax
mov r12d, 1
mov r8, r12
lea edx, [r12 + 1]
lea rcx, [rsp + 0x20]
call fcn.1400235e8
mov rcx, rbp
call fcn.140023694
mov eax, ebx
mov r13d, 0xfeff
cmp word [rsp + 0x20], r13w
cmove eax, r12d
mov dword [0x14006db3c], eax
lea rdx, [0x14003a9a0]
mov rcx, qword [rdi]
call fcn.140023f98
mov rbp, rax
mov edx, 0x400
mov rcx, rsi
call fcn.140004588
mov byte [rsp + 0x40], bl
mov r9, rbp
mov r8d, 0x400
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400235e8
cmp eax, ebx
je 0x140016ab7
cmp word [rsp + 0x20], r13w
jne 0x140016a6b
cdqe
mov byte [rsp + rax + 0x40], bl
mov byte [rsp + rax + 0x41], bl
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140004544
jmp 0x140016a99
cdqe
mov byte [rsp + rax + 0x40], bl
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x28]
call fcn.140004c38
nop
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14000451c
nop
lea rcx, [rsp + 0x28]
call fcn.140004268
mov byte [rsp + 0x40], bl
mov r9, rbp
mov r8d, 0x400
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.1400235e8
cmp eax, ebx
jne 0x140016a4a
mov rcx, rbp
call fcn.140023694
nop
mov ebx, r12d
mov rcx, rdi
call fcn.140004268
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140021e20
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140017ca4
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140017d7a
and dword [rsp + 0x38], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rbx
mov esi, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
cmp esi, eax
je 0x140017d26
mov r8d, 1
mov edx, eax
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov ecx, 0x2000
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov rax, qword [0x1400b3d60]
test rax, rax
je 0x140017d39
mov ecx, 2
call rax
mov rax, qword [0x1400b3d58]
test rax, rax
je 0x140017d4a
or ecx, 0xffffffff
call rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
cmp esi, ebx
je 0x140017d7a
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x2001
lea r9d, [rdx + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r8d, r8d
mov edx, ebx
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140017d8c
Capabilities:
Log keystrokes via polling

Disassembly:
test rcx, rcx
je 0x140017dfe
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140017df4
mov ecx, 0x12
xor dil, dil
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x140017dd5
mov edi, 1
xor r9d, r9d
xor edx, edx
mov r8d, edi
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test dil, dil
je 0x140017df4
xor r9d, r9d
xor edx, edx
mov cl, 0x12
lea r8d, [r9 + 3]
call qword [sym.imp.USER32.dll_keybd_event]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140017e00
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x8a8
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x890], rax
mov rsi, rdx
xor edx, edx
mov rbp, r8
mov rdi, rcx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x20]
mov ebx, r9d
call fcn.140021ef0
bts ebx, 9
lea rax, str._UserProfile_
lea rcx, [rsp + 0x94]
mov dword [rsp + 0x24], ebx
xor ebx, ebx
xor edx, edx
mov r8d, 0x7fc
mov dword [rsp + 0x20], 0x70
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x90], ebx
call fcn.140021ef0
lea rcx, [rsp + 0x90]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x90]
mov dx, 0x2e
call fcn.140021fdc
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x68], rbx
cmp rax, rbx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x50], 1
cmove rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.140021e20
add rsp, 0x8a8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140017fd0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
mov bl, cl
movzx ecx, cl
test edx, edx
jne 0x140017fea
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r8d, r8d
jmp 0x140017ff8
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r8d, 2
mov r9d, 0x1bc
mov edx, eax
mov cl, bl
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_keybd_event]
Function at 0x140018b70
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x11
mov ebx, edx
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
lea rax, str.runas
shr r11d, 0xf
and r11d, 1
neg r11d
sbb r8, r8
xor r9d, r9d
xor edx, edx
and r8, rax
lea eax, [rbx - 0x8016]
movsxd rcx, eax
shl rcx, 9
lea rcx, [rcx + rdi + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140017e00
Function at 0x140019468
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1240
call fcn.1400332d0
sub rsp, rax
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x1230], rax
xor r15d, r15d
mov rsi, rcx
mov rbx, rcx
mov ebp, r15d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
movsxd rcx, eax
mov r8d, 0xffc
mov dword [rsp + 0x230], r15d
lea rdi, [rbx + rcx*2]
lea rcx, [rsp + 0x234]
call fcn.140021ef0
cmp rbx, rdi
jae 0x1400195aa
lea r14d, [r15 + 0x25]
cmp word [rbx], r14w
jne 0x140019562
mov r12, rbx
add rbx, 2
mov r13, rbx
cmp rbx, rdi
jae 0x140019587
cmp word [rbx], r14w
jne 0x140019539
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x204
mov word [rbx], r15w
mov dword [rsp + 0x20], r15d
call fcn.140021ef0
lea rdx, [rsp + 0x20]
mov r8d, 0x208
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, r15d
jne 0x14001953f
mov word [rbx], r14w
add rbx, 2
jmp 0x1400194f2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x230]
mov word [r12], r14w
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebp, 1
mov word [rbx], r14w
jmp 0x140019587
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
movzx eax, word [rbx]
mov word [rsp + rdx*2 + 0x230], ax
mov word [rsp + rdx*2 + 0x232], r15w
add rbx, 2
cmp rbx, rdi
jb 0x1400194e2
cmp ebp, r15d
je 0x1400195aa
lea rdx, [rsp + 0x230]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov rcx, qword [rsp + 0x1230]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x1240]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400196bc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400196ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400196e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1400196e6
or eax, 0xffffffff
jmp 0x1400196f4
xor eax, eax
jmp 0x1400196f4
and al, 0x10
neg al
sbb eax, eax
neg eax
inc eax
add rsp, 0x28
ret
Function at 0x14001a3f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x110
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x28], 0
call fcn.140004508
mov dword [rsp + 0x28], 1
mov byte [rsp + 0xf0], 0x68
mov byte [rsp + 0xf1], 0x74
mov byte [rsp + 0xf2], 0x74
mov byte [rsp + 0xf3], 0x70
mov byte [rsp + 0xf4], 0x3a
mov byte [rsp + 0xf5], 0x2f
mov byte [rsp + 0xf6], 0x2f
mov byte [rsp + 0xf7], 0x77
mov byte [rsp + 0xf8], 0x77
mov byte [rsp + 0xf9], 0x77
mov byte [rsp + 0xfa], 0x2e
mov byte [rsp + 0xfb], 0x73
mov byte [rsp + 0xfc], 0x6f
mov byte [rsp + 0xfd], 0x66
mov byte [rsp + 0xfe], 0x74
mov byte [rsp + 0xff], 0x77
mov byte [rsp + 0x100], 0x61
mov byte [rsp + 0x101], 0x72
mov byte [rsp + 0x102], 0x65
mov byte [rsp + 0x103], 0x6f
mov byte [rsp + 0x104], 0x6b
mov byte [rsp + 0x105], 0x2e
mov byte [rsp + 0x106], 0
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.140004d58
cmp dword [0x14006d310], 0
jne 0x14001a52e
lea rdx, [0x140039d28]
lea rcx, [rsp + 0x20]
call fcn.140004c38
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000451c
nop
lea rcx, [rsp + 0x20]
call fcn.140004268
jmp 0x14001a5d3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
test eax, eax
je 0x14001a5a9
cmp dword [rsp + 0x40], 0xffffff10
jl 0x14001a57d
cmp dword [rsp + 0x40], 0xf0
jg 0x14001a57d
lea rdx, [0x140039d24]
lea rcx, [rsp + 0x20]
call fcn.140004c38
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000451c
nop
lea rcx, [rsp + 0x20]
call fcn.140004268
jmp 0x14001a5d3
lea rdx, [0x140039d20]
lea rcx, [rsp + 0x20]
call fcn.140004c38
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000451c
nop
lea rcx, [rsp + 0x20]
call fcn.140004268
jmp 0x14001a5d3
lea rdx, [0x140039d20]
lea rcx, [rsp + 0x20]
call fcn.140004c38
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14000451c
nop
lea rcx, [rsp + 0x20]
call fcn.140004268
mov rax, rbx
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.140021e20
add rsp, 0x110
pop rbx
ret
Function at 0x14001a620
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rdi, r9
mov rax, r8
mov rbx, rdx
cmp r9, rsi
jne 0x14001a64a
mov ecx, 0x80004005
call fcn.14000d7e0
int3
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x58], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
cmp rbx, rsi
je 0x14001a6ce
cmp dword [rdi], esi
jbe 0x14001a6cb
mov ecx, dword [rsp + 0x58]
cmp ecx, esi
jbe 0x14001a6c1
cmp ecx, 2
jbe 0x14001a6b0
cmp ecx, 7
jne 0x14001a6c1
test byte [rdi], 1
jne 0x14001a6c1
mov eax, dword [rdi]
shr eax, 1
cmp eax, 1
jb 0x14001a6c1
mov ecx, dword [rdi]
shr rcx, 1
cmp word [rbx + rcx*2 - 2], si
jne 0x14001a6c1
cmp eax, 1
jbe 0x14001a6ce
cmp word [rbx + rcx*2 - 4], si
jmp 0x14001a6bf
test byte [rdi], 1
jne 0x14001a6c1
mov eax, dword [rdi]
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x14001a6ce
mov word [rbx], si
mov eax, 0xd
jmp 0x14001a6d1
mov word [rbx], si
mov eax, r11d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001ad24
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
lea rax, fcn.140017d8c
mov rbx, rcx
xor edx, edx
mov qword [rcx], rax
lea rax, [rcx + 0x4020]
mov ecx, 0x3f
mov word [rax], dx
add rax, 0x1000
sub ecx, 1
jns 0x14001ad45
lea rcx, str.Shell32.dll
mov qword [rbx + GetClientRect], rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbx + 0x45030]
mov ecx, 0x400
mov qword [rbx + MapWindowPoints], rax
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14001b120
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x48
call fcn.140019698
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x14001a798]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400b3d88], rax
test rax, rax
jne 0x14001b1c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea rcx, [rsp + 0x58]
xor r9d, r9d
mov r8d, eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x1100
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x14001b1c1
mov eax, dword [0x1400b4248]
test eax, eax
jne 0x14001b1ae
mov rdx, qword [rsp + 0x58]
lea r9d, [rax + 0x10]
lea r8, str.Error_hooking_keyboard
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x1400b4248]
mov rcx, qword [rsp + 0x58]
inc eax
mov dword [0x1400b4248], eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
add rsp, 0x48
ret
Function at 0x14001be90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x38], 0xfffffffffffffffe
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
lea rcx, [rsp + 0x30]
call fcn.140004c38
nop
and qword [rsp + 0x40], 0
and dword [rsp + 0x48], 0
or dword [rsp + 0x60], 0xffffffff
lea rdx, str.AppsUseLightTheme
lea rcx, [rsp + 0x78]
call fcn.140004c38
and dword [rsp + 0x70], 0
mov dword [rsp + 0x68], 4
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, qword [rax]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x78]
call fcn.140004268
mov ebx, 1
cmp dword [rsp + 0x60], ebx
jne 0x14001bf1d
jmp 0x14001bf1f
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.140004268
mov al, bl
add rsp, 0x50
pop rbx
ret
Function at 0x14001efb4
Capabilities:
Hide graphical window

Disassembly:
push rsi
push rdi
push r13
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rdi, rcx
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rcx, qword [0x1400b4200]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, qword [0x1400b4200]
call qword [sym.imp.USER32.dll_SetActiveWindow]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rsi, rax
lea rdx, [0x14003bb90]
lea rcx, [rsp + 0x88]
call fcn.140004c38
mov rbx, rax
mov ecx, 0x43
call fcn.140014f98
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x80]
call fcn.140011144
mov r9, qword [rax]
mov r13d, 6
mov r8, r13
mov edx, 0x400
mov rcx, rsi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rsp + 0x80]
call fcn.140004268
nop
lea rcx, [rsp + 0x88]
call fcn.140004268
lea ecx, [r13 + 0x3d]
call fcn.140014f98
mov r9, rax
mov r8, r13
mov ebx, 0xc00
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r8d, [rbx - 0x47]
mov rdx, rsi
lea rcx, [0x1400b3e10]
call fcn.14000a678
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rsi
call qword [sym.imp.USER32.dll_AppendMenuW]
lea ecx, [r13 + 0xd]
call fcn.140014d98
mov r9, rax
mov edx, 0x400
lea r8d, [r13 - 4]
mov rcx, rsi

Function at 0x14001f1e4
Capabilities:
Acquire debug privileges
Check os version
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1200
call fcn.1400332d0
sub rsp, rax
mov qword [rsp + 0x80], 0xfffffffffffffffe
movaps xmmword [rsp + 0x11f0], xmm6
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x11e0], rax
mov r13, rdx
mov rsi, rcx
mov rax, qword [rsp + 0x1260]
Function at 0x140020288
Capabilities:
Hide graphical window

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xe8
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov edi, ecx
mov ecx, 0x32
mov esi, r9d
mov r12, r8
mov ebx, edx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
and qword [rsp + 0x58], 0
mov rdx, qword [0x14006c9c0]
mov ebp, eax
movd xmm0, ebp
mov qword [rsp + 0x50], rdx
and qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
cvtdq2pd xmm0, xmm0
lea rdx, str.ToolbarWindow32
mov r9d, ebx
xor r8d, r8d
mulsd xmm0, qword [0x14003bd60]
mov ecx, edi
cvttsd2si r13d, xmm0
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], 0xb4
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateWindowExW]
cmp qword [0x1400b4250], 0
mov rdi, rax
jne 0x140020387
mov ecx, 0x11
call qword [sym.imp.GDI32.dll_GetStockObject]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x5c]
mov rbx, rax
call fcn.140021ef0
lea r8, [rsp + 0x70]
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetObjectW]
lea rcx, [rsp + 0x70]
mov byte [rsp + 0x84], 0
mov byte [rsp + 0x87], 1
mov byte [rsp + 0x8a], 2
call qword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov qword [0x1400b4250], rax
xor r9d, r9d
mov edx, 0x41e
mov rcx, rdi
lea r8d, [r9 + 0x20]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r11d, bp
xor r8d, r8d
shl r11d, 0x10
mov edx, 0x420
mov rcx, rdi
movsxd r9, r11d
call qword [sym.imp.USER32.dll_SendMessageW]
test esi, esi
je 0x140020442
mov edx, esi
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDlgItem]
and dword [rsp + 0x60], 0
xor edx, edx
mov rbx, rax
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
lea rdx, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.USER32.dll_ScreenToClient]
and dword [rsp + 0x30], 0
mov r11d, dword [rsp + 0x68]
mov r8d, dword [rsp + 0x60]
mov r9d, dword [rsp + 0x64]
xor edx, edx
sub r11d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r11d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rax, rdi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140021e20
add rsp, 0xe8
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140020634
Capabilities:
Find taskbar

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
lea r8, str.Shell_TrayWnd
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x140020681
lea r8, str.TrayNotifyWnd
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x140020681
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x14002076c
lea rdx, [rsp + 0x20]
mov ecx, 5
mov dword [rsp + 0x20], 0x30
call qword [0x1400385a8]
test rax, rax
je 0x1400206f4
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1400206d5
sub eax, 1
je 0x1400206b9
sub eax, 1
je 0x1400206d5
cmp eax, 1
jne 0x14002076c
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x44]
mov dword [rbx + 0xc], eax
lea eax, [rcx - 0x64]
mov dword [rbx], eax
lea eax, [rcx - 0x10]
jmp 0x1400206ef
mov ecx, dword [rsp + 0x44]
lea eax, [rcx - 0x64]
mov dword [rbx + 4], eax
lea eax, [rcx - 0x10]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x38]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 8], eax
jmp 0x14002076c
lea r8, str.Shell_TrayWnd
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
test rax, rax
je 0x140020744
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r11d, dword [rbx + 8]
mov eax, r11d
sub eax, dword [rbx]
cmp eax, 0x96
jle 0x140020732
lea eax, [r11 - 0x96]
mov dword [rbx], eax
mov ecx, dword [rbx + 0xc]
mov eax, ecx
sub eax, dword [rbx + 4]
cmp eax, 0x1e
jle 0x14002076c
lea eax, [rcx - 0x1e]
jmp 0x140020769
xor edx, edx
xor r9d, r9d
mov r8, rbx
lea ecx, [rdx + 0x30]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rbx + 8]
mov eax, dword [rbx + 0xc]
sub r11d, 0x96
sub eax, 0x1e
mov dword [rbx], r11d
mov dword [rbx + 4], eax
add rsp, 0x50
pop rbx
ret

Function at 0x140020aa0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rcx + 0x820]
and qword [rsp + 0x30], 0
mov rdx, qword [rcx + 0x830]
and qword [rsp + 0x28], 0
mov r9d, 7
mov rbx, rcx
lea r8d, [r9 - 5]
mov dword [rsp + 0x20], eax
call fcn.14002057c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140020aee
mov edx, 0x444
call qword [sym.imp.KERNEL32.dll_TerminateThread]
and qword [rbx + 0x10], 0
add rsp, 0x40
pop rbx
ret

Function at 0x140020c8c
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov dword [rcx + 0x820], edx
mov rbx, rcx
mov qword [rcx + 0x818], r8
add rcx, 0x18
mov rdx, r9
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.140020b60
mov r11d, dword [rsp + 0x60]
test r11d, r11d
je 0x140020cc8
mov dword [rbx + 0x824], r11d
cmp dword [rsp + 0x68], 0
je 0x140020d09
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140020ce3
mov edx, 0x444
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rax, [rbx + 8]
lea r8, [0x140020c30]
mov r9, rbx
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret