joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
cmp dword [rcx + 0xb4], 0
mov r10, rcx
jne 0x140076f47
xor eax, eax
add rsp, 0x38
ret
mov ecx, dword [rcx + 0x88]
sub ecx, 1
je 0x140076f77
cmp ecx, 1
jne 0x140076f40
mov dword [rsp + 0x20], r9d
lea rcx, [r10 + 8]
mov r9, r8
mov r8, rdx
mov rdx, qword [r10 + 0xa8]
call fcn.140043500
add rsp, 0x38
ret
mov rcx, r10
add rsp, 0x38
jmp fcn.140064dc0

Function at 0x140077370
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x14007738c
add rsp, 0x38
ret

Function at 0x140077920
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [rcx + 0x18]
mov rdi, rcx
test rax, rax
jne 0x1400779ac
mov edx, 0x104
mov qword [rsp + 0x268], rbx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [rdi + 0x30]
mov dword [rsp + 0x20], 0x101
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140077370
mov rcx, qword [rdi + 0x30]
lea r8, [rdi + 0x18]
mov qword [rdi + 0x18], rcx
lea rdx, str._folder_
lea rcx, [rdi + 0x330]
call fcn.14003cf10
mov ecx, dword [rdi + 0x38]
mov rax, qword [rdi + 0x18]
mov rbx, qword [rsp + 0x268]
mov dword [rdi + 0x28], ecx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401f74b0
mov rsi, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x140077b70
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rdx]
mov rsi, 0xffffffffffffffff
cmp dword [rax - 0x10], 0
jne 0x140077bc5
lea rdx, str.__noext__
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140077bb0
mov rcx, rdi
call fcn.140018f50
jmp 0x140077bcd
mov rcx, rdi
call fcn.14003cea0
mov r8, qword [rbx + 0x3c8]
test r8, r8
je 0x140077d00
mov r9, qword [rdi]
mov rax, r9
sub r8, r9
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140077c04
add rax, 2
test ecx, ecx
jne 0x140077bf0
test edx, edx
jne 0x140077c13
mov ebx, dword [rbx + 0x3c0]
jmp 0x140077cc6
mov dword [rsp + 0x20], 0x1511
lea r8, [rbx + 0x30]
mov edx, 0x80
mov rcx, r9
call fcn.140077370
mov rcx, qword [rbx + 0x30]
xor r15d, r15d
test rcx, rcx
je 0x140077c42
call qword [sym.imp.USER32.dll_DestroyIcon]
mov qword [rbx + 0x30], r15
cmp dword [rbx + 0x38], r15d
je 0x140077c71
lea rdx, [0x14029b580]
mov rcx, qword [rdi]
call fcn.14020ca3c
test eax, eax
je 0x140077c71
cmp dword [rbx + 0x38], r15d
jl 0x140077c71
lea rcx, [rbx + 0x40]
cmp word [rcx], r15w
je 0x140077c71
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea rbp, [rbx + 0x248]
lea rcx, [rbx + 0x378]
mov rdx, qword [rdi]
call fcn.140049b70
mov rcx, rax
test rbp, rbp
je 0x140077ca0
mov rax, rsi
inc rax
cmp word [rbp + rax*2], r15w
jne 0x140077c92
mov r15d, eax
mov r8d, r15d
mov rdx, rbp
call fcn.140018f50
mov eax, dword [rbx + 0x38]
mov dword [rbx + 0x3c0], eax
mov rdx, rdi
lea rcx, [rbx + 0x3c8]
call fcn.140017b80
mov ebx, dword [rbx + 0x38]
mov rdx, qword [rdi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140077ce7
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140019300
int3
Function at 0x14007bce0
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x20], eax
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x14007bcfe
add rsp, 0x38
ret

Function at 0x14007c4f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
cmp qword [rcx + 0x160], 0
jne 0x14007c695
mov ecx, 0xc8
call fcn.1401f7b18
mov rbx, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xc8
mov rcx, rax
call fcn.14022eb00
mov rcx, rbx
call fcn.14007b700
nop
mov qword [rdi + 0x160], rax
lea rbx, [rax + 0x70]
mov rcx, qword [rbx]
xor esi, esi
test rcx, rcx
je 0x14007c55c
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx], rsi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x14007c695
mov rbx, qword [rdi + 0x160]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14007c58b
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx + 0x78], rsi
mov rsi, qword [rbx + 0x70]
test rsi, rsi
je 0x14007c5e7
mov rcx, rsi
mov r8d, 2
movzx eax, word [rsi]
test ax, ax
je 0x14007c5c1
nop word [rax + rax]
movzx eax, ax
add r8d, eax
add rcx, rax
movzx eax, word [rcx]
test ax, ax
jne 0x14007c5b0
mov r14d, r8d
mov ecx, r8d
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
test rax, rax
je 0x14007c5e3
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.14022e460
mov qword [rbx + 0x78], rbp
mov rax, qword [rdi + 0x160]
mov dword [rax + 0x98], 1
mov rax, qword [rdi + 0x160]
mov dword [rax + 0xa0], 1
lea r8, [rdi + 0x208]
cmp qword [r8], 0
jne 0x14007c623
mov edx, 0xa
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea rcx, [rdi + 0x210]
cmp qword [rcx], 0
jne 0x14007c63c
lea rdx, str.::26EE0668_A00A_44D7_9371_BEB064C98683
call fcn.14007efe0
mov r8, qword [rdi + 0x160]
mov qword [rdi + 0x168], r8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14007c68e
mov rdx, 0xffffffffffff0000
call fcn.14007f460
mov rcx, qword [rdi + 0x160]
mov qword [rcx + 8], rax
mov r9, qword [rdi + 0x160]
mov rcx, qword [rdi + 0x10]
mov r9, qword [r9 + 8]
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x14007c697
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14007ed70
Capabilities:
Get file system object information

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x20], 0x208
xor edx, edx
mov r9d, 0x2b8
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x14007ed8e
add rsp, 0x38
ret

Function at 0x140086390
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [rcx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetVersion]
shr ax, 8
cmp dil, 6
ja 0x1400863c0
jne 0x140086404
test ax, ax
je 0x140086404
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400863dd
mov qword [rbx], 0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140038ca6.0]
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x14029be78]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1402446b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x140086404
xor eax, eax
jmp 0x14008641d
mov dword [rbx + 8], 0xffffffff
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1400866e0
Capabilities:
Create process on windows

Disassembly:
push rdi
sub rsp, 0x40
cmp dword [rsp + 0x80], 0
jne 0x140086707
cmp r8d, 2
jne 0x14008670f
call fcn.140086870
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
xor eax, eax
add rsp, 0x40
pop rdi
ret
cmp r8d, 5
jne 0x140086731
call fcn.140086b70
mov rax, qword [rsp + 0x78]
mov qword [rax], 0
mov eax, 1
add rsp, 0x40
pop rdi
ret
cmp r8d, 0x4a
jne 0x140086707
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0x2710
jne 0x14008671a
mov rdi, qword [rax + 0x10]
cmp dword [rdi], 0x1348acf
jne 0x14008671a
add rdi, 4
je 0x14008671a
cmp word [rdi], 0x68
jne 0x14008671a
call fcn.14002ef00
test eax, eax
je 0x140086788
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400190e0
nop
mov rcx, rax
call fcn.140087870
jmp 0x14008671a
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14008671a
Function at 0x14008d020
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
movd xmm0, dword [rsp + 0xc0]
mov r12d, r9d
movaps xmmword [rsp + 0x50], xmm6
mov r15d, r8d
cvtdq2pd xmm0, xmm0
mov r14, rdx
mov rbp, rcx
movaps xmmword [rsp + 0x40], xmm7
movaps xmm6, xmm0
mulsd xmm6, qword [0x1402b4340]
mulsd xmm6, xmm0
xorps xmm0, xmm0
movaps xmm1, xmm6
divsd xmm1, qword [0x1402b4308]
addsd xmm1, qword [0x1402b42e0]
ucomisd xmm0, xmm1
ja 0x14008d083
sqrtpd xmm0, xmm1
jmp 0x14008d08b
movaps xmm0, xmm1
call fcn.14022dc7c
call fcn.14022d65c
cvttsd2si ecx, xmm0
xorps xmm7, xmm7
test cl, 1
lea eax, [rcx - 1]
cmovne eax, ecx
cvtsi2sd xmm7, eax
movaps xmm0, xmm7
movaps xmm1, xmm7
mulsd xmm0, qword [0x1402b4308]
addsd xmm1, qword [0x1402b4300]
mulsd xmm0, xmm7
subsd xmm6, xmm0
movaps xmm0, xmm7
mulsd xmm0, qword [0x1402b4340]
subsd xmm6, xmm0
movaps xmm0, xmm7
mulsd xmm0, qword [0x1402b43d0]
subsd xmm6, qword [0x1402b4328]
subsd xmm0, qword [0x1402b4318]
divsd xmm6, xmm0
addsd xmm6, qword [0x1402b42b8]
cvttsd2si eax, xmm6
test eax, eax
jle 0x14008d114
cvttsd2si ecx, xmm7
cmp eax, 1
jle 0x14008d118
cvttsd2si esi, xmm7
cmp eax, 2
jle 0x14008d11c
jmp 0x14008d11f
cvttsd2si ecx, xmm1
cvttsd2si esi, xmm1
movaps xmm7, xmm1
mov edi, dword [rsp + 0xd0]
lea eax, [rcx - 1]
mov ebx, dword [rsp + 0xc8]
cdq
sub eax, edx
mov dword [rsp + 0x30], edi
sar eax, 1
mov r9d, r12d
mov dword [rsp + 0x28], ebx
mov r8d, r15d
mov rdx, r14
mov dword [rsp + 0x20], eax
mov rcx, rbp
call fcn.14008cf80
lea eax, [rsi - 1]
mov dword [rsp + 0x30], edi
cdq
mov dword [rsp + 0x28], ebx
sub eax, edx
mov r9d, r12d
sar eax, 1
mov r8d, r15d
mov rdx, rbp
mov dword [rsp + 0x20], eax
mov rcx, r14
call fcn.14008cf80
cvttsd2si eax, xmm7
mov r9d, r12d
mov r8d, r15d
mov rcx, rbp
dec eax
cdq
sub eax, edx
mov rdx, r14
sar eax, 1
mov dword [rsp + 0xc0], eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.14008cf80
Function at 0x14008d780
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x140316220], eax
jg 0x14008d7cb
lea rax, [0x140316230]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x60
pop rbx
ret
lea rcx, [0x140316220]
call fcn.1401f7578
cmp dword [0x140316220], 0xffffffff
jne 0x14008d7b1
xor edx, edx
mov r8d, 0xf8
lea rbx, [0x140316230]
mov rcx, rbx
call fcn.14022eb00
lea rcx, [0x140316238]
call fcn.1400955a0
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov dword [0x1403162b0], eax
xor eax, eax
mov qword [0x140316318], rax
mov qword [0x140316320], rax
mov qword [0x140316230], rax
mov qword [0x1403162b8], rax
xorps xmm0, xmm0
movdqa xmmword [0x1403162c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [0x1403162d0], xmm1
movdqa xmmword [0x1403162e0], xmm0
movdqa xmmword [0x1403162f0], xmm1
movdqa xmmword [0x140316300], xmm0
mov qword [0x140316310], rax
lea rcx, [0x140241210]
call fcn.1401f7844
nop
lea rcx, [0x140316220]
call fcn.1401f750c
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x60
pop rbx
ret
Function at 0x1400a3030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov ebx, r8d
lea rdx, [rsp + 0x20]
mov rsi, rcx
call fcn.1400a2a30
xor ebp, ebp
cmp dword [rsi + 0x310], ebp
jne 0x1400a3085
sub ebx, dword [rsi + 0x230]
imul ebx, dword [rsi + 0x234]
mov ecx, dword [rax + 8]
sub ecx, dword [rax]
mov edx, ecx
mov r11d, ecx
mov r10d, ebx
test ebx, ebx
js 0x1400a3121
jmp 0x1400a3091
mov r10d, ebp
mov r11d, ebp
mov ebx, ebp
mov ecx, ebp
mov edx, ebp
cmp ebx, dword [rdi + 0x34]
jge 0x1400a3121
mov r8d, dword [rdi + 0x30]
mov r9d, ebp
dec r8d
mov eax, ebx
test r8d, r8d
cmovle r9d, r8d
test ecx, ecx
movsxd rcx, dword [rdi + 0x3c]
cmovs edx, ebp
cmp edx, r8d
cmovl r8d, edx
movsxd rdx, dword [rdi + 0x28]
imul rdx, rax
movsxd rax, r9d
imul rcx, rax
mov eax, dword [rdi + 0x38]
add rdx, rcx
add rdx, qword [rdi + 0x40]
cmp eax, 0x18
je 0x1400a3103
cmp eax, 0x20
jne 0x1400a3121
cmp r9d, r8d
jg 0x1400a3121
sub r8d, r9d
lea ecx, [r8 + 1]
nop dword [rax]
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 4]
sub rcx, 1
jne 0x1400a30f0
jmp 0x1400a3121
cmp r9d, r8d
jg 0x1400a3121
sub r8d, r9d
lea ecx, [r8 + 1]
nop
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 3]
sub rcx, 1
jne 0x1400a3110
lea ecx, [r10 - 1]
test ecx, ecx
js 0x1400a31c1
cmp ecx, dword [rdi + 0x34]
jge 0x1400a31c1
mov r8d, dword [rdi + 0x30]
mov eax, r11d
movsxd rdx, dword [rdi + 0x28]
dec r8d
cmp ebp, r8d
mov r9d, ebp
cmovge r9d, r8d
test r11d, r11d
cmovs eax, ebp
cmp eax, r8d
cmovl r8d, eax
movsxd rax, ecx
movsxd rcx, dword [rdi + 0x3c]
imul rdx, rax
movsxd rax, r9d
imul rcx, rax
mov eax, dword [rdi + 0x38]
add rdx, rcx
add rdx, qword [rdi + 0x40]
cmp eax, 0x18
je 0x1400a31a3
cmp eax, 0x20
jne 0x1400a31c1
cmp r9d, r8d
jg 0x1400a31c1
sub r8d, r9d
lea ecx, [r8 + 1]
nop dword [rax]
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 4]
sub rcx, 1
jne 0x1400a3190
jmp 0x1400a31c1
cmp r9d, r8d
jg 0x1400a31c1
sub r8d, r9d
lea ecx, [r8 + 1]
nop
xor byte [rdx], 0x80
xor byte [rdx + 2], 0x80
lea rdx, [rdx + 3]
sub rcx, 1
jne 0x1400a31b0
lea ecx, [r10 + 1]
test ecx, ecx
js 0x1400a3261
cmp ecx, dword [rdi + 0x34]
jge 0x1400a3261
mov r8d, dword [rdi + 0x30]
mov r9d, ebp
movsxd rax, dword [rdi + 0x28]
dec r8d
movsxd rdx, dword [rdi + 0x3c]
cmp ebp, r8d
movsxd rcx, ecx
cmovge r9d, r8d
test r11d, r11d
cmovs r11d, ebp
cmp r11d, r8d
cmovl r8d, r11d
imul rax, rcx
movsxd rcx, r9d
imul rdx, rcx
mov ecx, dword [rdi + 0x38]
add rax, rdx
add rax, qword [rdi + 0x40]
cmp ecx, 0x18
je 0x1400a3243
cmp ecx, 0x20
jne 0x1400a3261
cmp r9d, r8d
jg 0x1400a3261
sub r8d, r9d
lea edx, [r8 + 1]
nop dword [rax + rax]
xor byte [rax], 0x80
xor byte [rax + 2], 0x80
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400a3230
jmp 0x1400a3261
cmp r9d, r8d
jg 0x1400a3261
sub r8d, r9d
lea edx, [r8 + 1]
nop
xor byte [rax], 0x80
xor byte [rax + 2], 0x80
lea rax, [rax + 3]
sub rdx, 1
jne 0x1400a3250
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400a57f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x20
cmp byte [rcx + 0x1f8], 0
mov rbx, rdx
mov rsi, rcx
je 0x1400a58e4
call fcn.14009b2a0
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
bt edx, 0x10
jae 0x1400a58aa
lea r14, [rsi + 0x200]
mov rax, qword [r14]
cmp rax, qword [r14 + 8]
je 0x1400a5847
mov qword [r14 + 8], rax
mov rbp, qword [rsi + 0x368]
xor edi, edi
test rbp, rbp
je 0x1400a58aa
nop word [rax + rax]
cmp rdi, qword [rsi + 0x368]
jae 0x1400a5913
mov rax, qword [rsi + 0x360]
mov rcx, qword [rax + rdi*8]
cmp dword [rcx + 0x20], 0
je 0x1400a58a2
mov rdx, qword [r14 + 8]
mov dword [rsp + 0x40], edi
cmp rdx, qword [r14 + 0x10]
je 0x1400a5895
mov dword [rdx], edi
add qword [r14 + 8], 4
jmp 0x1400a58a2
lea r8, [rsp + 0x40]
mov rcx, r14
call fcn.1400a61c0
inc rdi
cmp rdi, rbp
jb 0x1400a5860
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1400a2890
xor r8d, r8d
mov edx, eax
mov rcx, rsi
mov edi, eax
call fcn.1400a54d0
cmp byte [rsi + 0x1f8], 0
je 0x1400a58fb
mov dword [rsi + 0x218], edi
mov dword [rsi + 0x21c], edi
mov qword [rsi + 0x220], rbx
jmp 0x1400a58fb
lea rdx, [rsp + 0x48]
call fcn.1400a2890
xor r8d, r8d
mov edx, eax
mov rcx, rsi
call fcn.1400a54d0
mov rbx, qword [rsp + 0x50]
mov eax, 1
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80070057
call fcn.140019300
int3
Function at 0x1400a5f60
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x1f8], 0
mov rbx, rcx
je 0x1400a60f1
cmp dword [rcx + 0x15c], 0
je 0x1400a60f1
cmp dword [rcx + 0x220], edx
jne 0x1400a5fa7
mov rax, rdx
shr rax, 0x20
cmp dword [rcx + 0x224], eax
je 0x1400a60f1
call fcn.1400a5ab0
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov edi, eax
call fcn.1400a5bd0
cmp edi, 0xffffffff
je 0x1400a60f1
mov r9d, dword [rbx + 0x368]
cmp edi, r9d
jge 0x1400a60f1
mov r8d, dword [rbx + 0x21c]
cmp r8d, edi
je 0x1400a60f1
mov ecx, dword [rbx + 0x218]
mov eax, r8d
cmp ecx, r8d
cmovl eax, ecx
xor r10d, r10d
test eax, eax
cmovs eax, r10d
cmp ecx, r8d
mov edx, eax
lea eax, [r9 - 1]
cmovg r8d, ecx
cmp eax, r8d
cmovl r8d, eax
movsxd r9, r8d
cmp rdx, r9
jg 0x1400a6050
nop dword [rax + rax]
cmp rdx, qword [rbx + 0x368]
jae 0x1400a6101
mov rax, qword [rbx + 0x360]
mov rcx, qword [rax + rdx*8]
cmp dword [rcx + 0x20], 1
jne 0x1400a6048
mov dword [rcx + 0x20], r10d
dec dword [rbx + 0x3a0]
inc rdx
cmp rdx, r9
jle 0x1400a6020
mov edx, dword [rbx + 0x218]
mov r8d, edi
mov rcx, rbx
call fcn.1400a4d60
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jae 0x1400a60c5
mov rcx, qword [rbx + 0x200]
mov r9, qword [rbx + 0x208]
cmp rcx, r9
je 0x1400a60c5
nop dword [rax + rax]
movsxd rdx, dword [rcx]
cmp rdx, qword [rbx + 0x368]
jae 0x1400a6101
mov rax, qword [rbx + 0x360]
mov r8, qword [rax + rdx*8]
cmp dword [r8 + 0x20], 0
jne 0x1400a60bc
mov dword [r8 + 0x20], 1
inc dword [rbx + 0x3a0]
add rcx, 4
cmp rcx, r9
jne 0x1400a6090
mov r8d, dword [rbx + 0x188]
xor r9d, r9d
mov edx, dword [0x14030c244]
mov rcx, rbx
mov dword [rbx + 0x3b0], edi
mov dword [rbx + 0x21c], edi
call fcn.14009a620
mov rcx, rbx
call fcn.1400a45f0
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140019300
int3

Function at 0x1400aace0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsx ebp, r8w
mov eax, 0x88888889
imul ebp
mov rbx, rcx
add edx, ebp
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov esi, edx
neg esi
cmovs esi, edx
test esi, esi
jle 0x1400aad67
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [rbx + 0x238]
mov edi, 1
movsx ecx, ax
bt ecx, 0x10
mov rcx, rbx
cmovb esi, edi
test bp, bp
js 0x1400aad54
add edx, esi
call fcn.1400ab9f0
mov rcx, rbx
call fcn.1400abaf0
mov eax, edi
jmp 0x1400aad6c
sub edx, esi
call fcn.1400ab9f0
mov rcx, rbx
call fcn.1400abaf0
mov eax, edi
jmp 0x1400aad6c
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b0170
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor eax, eax
mov qword [rdx], rax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400b0251
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbx], rax
mov esi, 1
mov dword [rsp + 0x20], esi
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x1400b023b
lea edi, [rax + 1]
test edi, edi
js 0x1400b025c
mov rax, qword [rbx]
sub esi, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or esi, ecx
jge 0x1400b01f9
mov edx, edi
mov rcx, rbx
call fcn.140018ea0
mov r8d, edi
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x1e0]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400b0219
mov eax, r14d
jmp 0x1400b0226
movsxd rdx, dword [rcx - 0xc]
call fcn.1401fe5d0
test eax, eax
js 0x1400b025c
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400b025c
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov word [rax + rcx*2], r14w
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov ecx, 0x80004005
call fcn.140019300
int3
mov ecx, 0x80070057
call fcn.140019300
int3
Function at 0x1400b8780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b8900
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 3
jne 0x1400b88e3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jl 0x1400b88fc
mov qword [rsp + 0x30], rbx
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400b8925
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdi, [0x14026b1d8]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140018bb0
mov rbx, 0xffffffffffffffff
test al, al
jne 0x1400b883e
mov r8, rbx
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400b8825
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140018f50
nop
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1400179b0
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400b8876
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, 0xffffffff
je 0x1400b88c0
test sil, 0x10
jne 0x1400b88c0
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400b88f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov eax, 1
jmp 0x1400b8908
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x1400b88e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
lea eax, [rdi - 2]
cmp eax, 1
jbe 0x1400b88fc
cmp edi, 0x7b
je 0x1400b88fc
cmp edi, 0x35
je 0x1400b88fc
mov eax, 1
jmp 0x1400b8908
xor eax, eax
jmp 0x1400b8908
shr eax, 4
not eax
and eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, 0x80004005
call fcn.140019300
int3
Function at 0x1400b9130
Capabilities:
Delete file
Get common file path

Disassembly:
push rbx
sub rsp, 0x460
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x240]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.tmp.
lea rcx, [rsp + 0x240]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400b9211
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbx], rax
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140018bb0
test al, al
jne 0x1400b91ed
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400b91d4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140018f50
nop
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0x460
pop rbx
ret
mov ecx, 0x80004005
call fcn.140019300
int3