joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075970
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov r14, rcx
test rdx, rdx
je 0x140075afb
test r8, r8
je 0x1400759a3
cmp word [r8], 0
jne 0x1400759b7
test r9, r9
je 0x140075afb
cmp word [r9], 0
je 0x140075afb
mov rax, qword [0x1400ebaa8]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbp
mov r9d, dword [rax + 0x108]
lea rax, [rsp + 0x58]
or r9d, 0x2001f
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140075aec
test rdi, rdi
je 0x140075a32
cmp word [rdi], ax
je 0x140075a32
lea rdx, str.ahk_default
mov rcx, rdi
call fcn.1400981f0
mov rcx, qword [rsp + 0x58]
lea rdx, [0x1400bbf7c]
test eax, eax
cmovne rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140075aec
mov rcx, qword [rsp + 0x58]
call fcn.140075840
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140075aec
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f6d40], eax
jle 0x140075ab2
lea rcx, [0x1400f6d40]
call fcn.140093fa4
cmp dword [0x1400f6d40], 0xffffffff
jne 0x140075ab2
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.RegDeleteKeyExW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1400f6d40]
mov qword [0x1400f6d48], rax
call fcn.140093f44
mov rax, qword [0x1400ebaa8]
mov r8d, dword [rax + 0x108]
test r8d, r8d
je 0x140075ade
mov rax, qword [0x1400f6d48]
test rax, rax
je 0x140075ade
xor r9d, r9d
mov rdx, rsi
mov rcx, rbp
call rax
jmp 0x140075aea
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x140075b00
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
jmp 0x140075b02
mov ebx, 0x57
mov ecx, ebx
mov rax, qword [0x1400ebaa8]
test ebx, ebx
setne dl
mov dword [rax + 0x40], ecx
mov rcx, r14
call fcn.14002f160
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400763e0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edi, edi
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x14007641c
sub rdx, qword [rcx + 0x38]
lea r8d, [rdi + 1]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x14007643b
cmp qword [rbx + 0x30], rdi
jne 0x14007643b
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x14007649c
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14007649c
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + gethostname]
mov rbx, qword [rsp + 0x30]
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140076fb0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x1400799c0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140079aa6
cmp word [rcx], 0
je 0x140079aa6
mov r8d, 4
lea rdx, [0x1400d9b18]
call fcn.14009ffb8
mov r8, rbx
test eax, eax
jne 0x140079a03
lea r8, [rbx + 8]
test r8, r8
je 0x140079a40
movzx edx, word [r8]
test dx, dx
je 0x140079a40
lea rcx, [0x1400d7aa8]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x140079a6b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140079a20
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x140079a11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x140079a52
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140079aa6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x140079a93
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x14007a290
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400ad480
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14007a2e4
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.140095f70
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret

Function at 0x14007a300
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rdi, r9
lea rax, [rsp + 0x50]
mov r9d, dword [rsp + 0x68]
lea rdx, str.SOFTWAREAutoHotkey
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007a3e0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x68], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x40]
jne 0x14007a3e0
mov ecx, dword [rsp + 0x68]
test ecx, ecx
je 0x14007a3e0
shr ecx, 1
dec ecx
mov dword [rsp + 0x68], ecx
cmp word [rdi + rcx*2], 0
jne 0x14007a3c0
test ecx, ecx
je 0x14007a3b8
lea edx, [rcx - 1]
cmp word [rdi + rdx*2], 0
jne 0x14007a3b8
mov dword [rsp + 0x68], edx
mov ecx, edx
test edx, edx
jne 0x14007a3a4
mov eax, ecx
add rsp, 0x30
pop rdi
ret
inc ecx
mov dword [rsp + 0x68], ecx
cmp ecx, 0x104
jae 0x14007a3e0
mov eax, ecx
xor ecx, ecx
mov word [rdi + rax*2], cx
mov eax, dword [rsp + 0x68]
add rsp, 0x30
pop rdi
ret
xor ecx, ecx
mov word [rdi], cx
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x14007ac30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov r15d, r9d
mov edi, r8d
mov esi, edx
mov r12, rcx
mov r13d, ebx
test rcx, rcx
je 0x14007ac6c
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
jmp 0x14007ac73
mov rbp, qword [0x1400eff60]
test rbp, rbp
je 0x14007ae04
test esi, esi
jns 0x14007ac8b
movzx eax, si
neg ax
movzx edx, ax
jmp 0x14007acc1
test esi, esi
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], rbx
cmovne eax, esi
lea r9, [rsp + 0x40]
lea r8, [0x14007ac10]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
mov r8d, SafeArrayGetElemsize
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14007adec
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007adec
mov rcx, rax
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14007ade4
cmp edi, 0xffffffff
cmove edi, r15d
test edi, edi
jne 0x14007ad21
lea ecx, [rdi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jle 0x14007ad75
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax + rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14007ad57
movzx eax, dl
mov edx, ebx
cmp eax, edi
setl dl
jmp 0x14007ad61
movzx eax, al
mov edx, ebx
cmp eax, edi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14007ad40
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14007ade4
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14007ade4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14007ade4
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r13, rax
mov r14, qword [rsp + 0x80]
test r12, r12
je 0x14007adfa
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13, r13
je 0x14007ae04
mov rax, r13
jmp 0x14007ae21
test esi, esi
jle 0x14007ae0d
lea ebx, [rsi - 1]
jmp 0x14007ae13
cmp esi, 0xffffffff
cmovl ebx, esi
mov r8d, ebx
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14007b880
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14007b89a
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14007b8a4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14007b926
test al, 8
jne 0x14007b921
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14007b8e2
cmp eax, 9
je 0x14007b8e2
cmp ecx, 0x20
je 0x14007b8e2
cmp ecx, 9
je 0x14007b8e2
cmp eax, 0x30
je 0x14007b8e2
cmp eax, 0x2b
jne 0x14007b921
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14007c070
test eax, eax
jne 0x14007b903
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001460
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14007b906
test al, 0x20
je 0x14007b978
mov rcx, rdi
test al, 8
jne 0x14007b964
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14007c070
test eax, eax
je 0x14007b8f6
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14007b90c
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14007b90c
test al, 1
je 0x14007b991
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14007be30
test al, 2
je 0x14007b9aa
mov rdx, qword [rbx]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140014370
cmp byte [rbx + 0x23], 0
jne 0x14007b9b6
mov rax, qword [rbx + 0x10]
jmp 0x14007b9b9
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14007b9c7
mov rdx, rbx
call fcn.14002fe30
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14007c070
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14007b9f0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14007bac2
sub r8d, 1
je 0x14007baae
sub r8d, 2
je 0x14007ba9c
sub r8d, 1
je 0x14007ba3c
cmp r8d, 1
jne 0x14007ba7d
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140014370
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14007ba7d
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14007bac2
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14007c070
test eax, eax
jne 0x14007ba71
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14007bac5
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14007c070
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007b880
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14007bac8
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.140001460
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14007be30
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14007be50
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14007be46
cmp byte [rdx + 0x23], 0
jne 0x14007be5a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001500
cmp byte [rbx + 0x23], 1
jne 0x14007bec7
cmp rbx, rdi
je 0x14007beb7
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14007c070
test eax, eax
jne 0x14007be9e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.140095f70
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14007bee0
Function at 0x14007bee0
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x1400f4fc0]
call fcn.140005020
test eax, eax
jne 0x14007bf1d
lea r8, [0x1400bbf7c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1400f4390]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.14002f740
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14007bfdd
nop dword [rax + rax]
mov r15d, dword [rsi]
test r15d, r15d
je 0x14007bfdd
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14007bfdd
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14007bfdd
xor edx, edx
mov ecx, 0x42
test rdi, rdi
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14007c039
test rdi, rdi
je 0x14007bfc4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14007c006
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.140095f70
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14007bf50
xor edx, edx
lea rcx, [0x1400f4fc0]
call fcn.140004e80
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor edx, edx
lea rcx, [0x1400f4fc0]
call fcn.140004e80
lea r8, [0x1400bbf7c]
lea rdx, [0x1400bc2a8]
lea rcx, [0x1400f4390]
call fcn.14002f740
jmp 0x14007bfeb
xor edx, edx
lea rcx, [0x1400f4fc0]
call fcn.140004e80
lea r8, [0x1400bbf7c]
lea rdx, str.Out_of_memory.
lea rcx, [0x1400f4390]
call fcn.14002f740
jmp 0x14007bfeb
Function at 0x14007c490
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14007c6d0
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14007c526
sub ecx, 1
je 0x14007c4f6
cmp ecx, 1
je 0x14007c4da
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x14007c4e4
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140004970
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14007c669
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001500
cmp dword [0x1400f0c8c], 0
jne 0x14007c627
cmp qword [rdi + 0x10], 0
jne 0x14007c627
cmp qword [0x1400f6970], rdi
jne 0x14007c554
test rbx, rbx
jne 0x14007c5d3
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14007c5ce
xor esi, esi
mov qword [0x1400f6970], rsi
test rbx, rbx
je 0x14007c5bc
mov edx, dword [0x1400f0c98]
test edx, edx
je 0x14007c59e
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x1400f4390]
mov qword [rsp + 0x20], rsi
call fcn.14002fcd0
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14007a290
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14007c60e
cmp byte [rdi + 0x23], 0
jne 0x14007c5df
mov rax, qword [rdi + 0x10]
jmp 0x14007c5e2
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14007c5f0
mov rdx, rdi
call fcn.14002fe30
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x1400f6970], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x1400f6970], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14007c6cb
test r8, r8
jne 0x14007c679
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14007c65f
mov rdx, rdi
call fcn.14002fe30
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14007c6cb
cmp r8, 0x186a0
jae 0x14007c6bd
movzx eax, word [rdx]
test ax, ax
je 0x14007c6b3
nop dword [rax]
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14007c6a0
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14007c664
mov rcx, rbx
call fcn.140095f70
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14007c664
mov rcx, qword [rdi + 0x10]
call fcn.14007c490
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14007d120
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14007d136
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1400f4310]
mov r15d, eax
je 0x14007d167
mov rcx, rbx
call fcn.14007e4d0
test al, al
je 0x14007d167
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x14007d18c
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rbx, rsi
jne 0x14007d1a4
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14007d1bf
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x1400f0c93], 0
jne 0x14007d1dc
mov rdx, rsi
mov rcx, rbx
call fcn.14007d080
test rax, rax
jne 0x14007d32b
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x14007d265
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14007d26a
cmp dword [0x1400f4310], eax
je 0x14007d241
mov rcx, rsi
call fcn.14007e4d0
test al, al
jne 0x14007d241
mov ecx, dword [0x1400f4310]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14007d26a
cmp r14d, r15d
je 0x14007d26a
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14007d26a
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.14007d080
mov rbp, rax
test rax, rax
jne 0x14007d2d2
inc edi
cmp edi, 5
jl 0x14007d270
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.1400100c0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.1400100c0
mov rdx, rsi
mov rcx, rbx
call fcn.14007d080
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x14007d2f3
mov ecx, dword [0x1400f4310]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14007d30c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x14007d324
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x14007d326
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x14007d480
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test r8b, r8b
je 0x14007d49b
call fcn.140057850
jmp 0x14007d4ab
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
jle 0x14007d510
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001800
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14007d50b
add edi, esi
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x14007d50b
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001800
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14007d4e0
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret