joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001e20
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x140001e78
cmp dword [rcx + 0x20], 0
jne 0x140001e78
mov r9, rcx
mov qword [rsp + 0x40], rbx
xor ebx, ebx
lea r8, [0x140001f40]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, 0xffffffffffffffff
mov qword [rdi + 0x18], rax
mov eax, 1
setne bl
mov dword [rdi + 0x20], ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140002910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov r11, qword [rcx + 0x28]
mov edi, r9d
mov rsi, r8
cmp rax, r11
je 0x140002944
mov r10, qword [rax]
cmp rdx, qword [r10 + 0x18]
je 0x140002956
add rax, 8
cmp rax, r11
jne 0x140002932
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, r10
test r10, r10
je 0x140002944
mov rdx, rbx
call fcn.140003c50
test eax, eax
je 0x140002944
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400015f0

Function at 0x140002990
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov edi, edx
mov rbp, rcx
mov eax, 0x3d
cmp edx, eax
cmovg edi, eax
lea ecx, [rax + 0x6b]
call fcn.1400e5d1c
mov qword [rsp + 0x70], rax
xor esi, esi
test rax, rax
je 0x1400029d6
mov rcx, rax
call fcn.140002100
mov rbx, rax
jmp 0x1400029d9
mov rbx, rsi
mov rcx, rbx
call fcn.1400022c0
test eax, eax
je 0x140002a4e
test edi, edi
jle 0x140002a0d
nop dword [rax]
mov edx, 1
mov rcx, rbp
call fcn.140001670
mov rdx, rax
mov rcx, rbx
call fcn.1400023e0
dec rdi
jne 0x1400029f0
cmp dword [rbx + 8], 0
je 0x140002a4e
cmp dword [rbx + 0xc], 0
jne 0x140002a4e
mov dword [rsp + 0x68], esi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140003110]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x78], rax
cmp rax, 0xffffffffffffffff
setne sil
mov dword [rbx + 0xc], esi
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140005d20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rdi, [0x140179838]
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140005d58
inc ebx
add rdi, 4
cmp ebx, 7
jb 0x140005d33
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006ca0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.SynECR.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rbx], rax
test rax, rax
jne 0x140006ccc
xor edi, edi
mov dword [rbx + 8], edi
jmp 0x140006d9f
lea rdx, str.SynCR_Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_SetParam
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_GetParam
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_Recog
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx]
lea rdx, str.SynCR_CleanUp
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140006d3e
call rax
mov dword [rbx + 8], eax
cmp qword [rbx + 0x10], 0
je 0x140006d77
cmp qword [rbx + 0x18], 0
je 0x140006d77
cmp qword [rbx + 0x20], 0
je 0x140006d77
cmp qword [rbx + 0x28], 0
je 0x140006d77
cmp qword [rbx + 0x30], 0
je 0x140006d77
cmp dword [rbx + 8], 0
je 0x140006d77
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbx + 8]
xor edi, edi
test ecx, ecx
je 0x140006d8e
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x140006d8b
call rax
mov dword [rbx + 8], edi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140006d9f
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140009020
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x10020
call fcn.1400e75d0
sub rsp, rax
mov rsi, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, 0x7fff
jbe 0x14000905c
xor eax, eax
jmp 0x140009075
test eax, eax
je 0x140009058
lea r8, [rsp + 0x20]
mov r9, rdi
mov rdx, rdi
mov rcx, rsi
call fcn.1400e71f0
mov eax, ebx
lea r11, [rsp + 0x10020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000c140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x14000c173
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14000c1b9
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14000c1b4
nop
cmp rbx, rcx
jae 0x14000c1b9
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x14000c1a0
cmp rbx, rcx
jb 0x14000c1bd
xor eax, eax
jmp 0x14000c1c9
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14001ea80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x788]
test rcx, rcx
jne fcn.14006e1c0
ret
Function at 0x140024500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp dword [0x1402711d8], 0
mov edi, r8d
mov esi, edx
mov rbx, rcx
je 0x14002453d
mov ecx, 0x30
call qword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x18
call fcn.1400e5d1c
mov r9, rax
test rax, rax
je 0x14002455e
xor eax, eax
mov qword [r9], rax
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rax
jmp 0x140024561
xor r9d, r9d
mov rax, qword [0x1402711d0]
xor ecx, ecx
mov qword [r9], rcx
mov qword [r9 + 8], rax
mov dword [r9], esi
mov dword [r9 + 4], edi
mov qword [r9 + 0x10], rbx
cmp qword [rbx + 0x90], rcx
jne 0x1400245b1
cmp dword [0x1402711d8], ecx
jne 0x1400245b1
lea rax, [rsp + 0x58]
lea r8, [0x1400245d0]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x90], rax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x140029f70
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, vtable.CManagedPointingDeviceList.0
mov qword [rcx], rax
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x140029fa1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rdx, qword [rbx + 0x50]
test rdx, rdx
je 0x140029fb2
mov rcx, rbx
call fcn.14002c070
mov rdx, qword [rbx + 0x58]
test rdx, rdx
je 0x140029fc3
mov rcx, rbx
call fcn.14002c070
mov rdx, qword [rbx + 0x60]
test rdx, rdx
je 0x140029fd4
mov rcx, rbx
call fcn.14002c070
mov rcx, rbx
call fcn.14002b020
nop
lea rax, vtable.CSynList_class_CManagedPointingDevice_.0
mov qword [rbx], rax
mov rcx, rbx
call fcn.14002fb40
lea rcx, [rbx + 0x20]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
Function at 0x14002e400
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov qword [rcx], rax
mov qword [rsp + 0x90], rax
or rbx, 0xffffffffffffffff
call fcn.140030d10
cmp word [rax], 0
je 0x14002e490
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140030d10
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002e490
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x14027046c]
test al, 1
jne 0x14002e4b1
or eax, 1
mov dword [0x14027046c], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140270468], eax
jmp 0x14002e4b7
mov eax, dword [0x140270468]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e4dd
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x140270468]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, [0x14012a178]
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x14002e51d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x14002e52c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002e550
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov qword [rcx], rax
mov qword [rsp + 0x90], rax
or rbx, 0xffffffffffffffff
call fcn.140030d10
cmp word [rax], 0
je 0x14002e5e0
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140030d10
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002e5e0
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x140270474]
test al, 1
jne 0x14002e601
or eax, 1
mov dword [0x140270474], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140270470], eax
jmp 0x14002e607
mov eax, dword [0x140270470]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e62d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x140270470]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, [0x14012a188]
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x14002e66d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x14002e67c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002e6a0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov qword [rcx], rax
mov qword [rsp + 0x90], rax
or rbx, 0xffffffffffffffff
call fcn.140030d10
cmp word [rax], 0
je 0x14002e730
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140030d10
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002e730
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x140270464]
test al, 1
jne 0x14002e751
or eax, 1
mov dword [0x140270464], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140270460], eax
jmp 0x14002e757
mov eax, dword [0x140270460]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e77d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x140270460]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, [0x14012a168]
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x14002e7bd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x14002e7cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002e7f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
xor eax, eax
mov rsi, rdx
mov rdi, rcx
mov qword [rcx], rax
mov qword [rsp + 0x90], rax
or rbx, 0xffffffffffffffff
call fcn.140030d10
cmp word [rax], 0
je 0x14002e880
xor eax, eax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x40], 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
call fcn.140030d10
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002e880
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov eax, dword [0x14027045c]
test al, 1
jne 0x14002e8a1
or eax, 1
mov dword [0x14027045c], eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140270458], eax
jmp 0x14002e8a7
mov eax, dword [0x140270458]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14002e8cd
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [0x140270458]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edx, edx
lea r9, [0x14012a158]
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x15]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x14002e90d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
cmp rbx, 0xffffffffffffffff
je 0x14002e91c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
lea r11, [rsp + 0x80]
mov rax, rdi
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140031430
Capabilities:
Check if file exists

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x140031653
test r8, r8
je 0x140031653
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140031653
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.14000b1d0
nop
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.14000b1d0
nop
test rbx, rbx
jne 0x1400314b4
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbx, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14000b1d0
nop
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x20]
call fcn.14000b1d0
nop
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x68]
call fcn.14000b1d0
nop
mov dword [rdi + 0xcc], 0
lea rcx, [rdi + 0x98]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rsi + rax*2], 0
jne 0x140031500
mov r8d, eax
mov rdx, rsi
call fcn.14000be50
lea rcx, [rdi + 0x90]
mov rax, rbx
nop
inc rax
cmp word [rbp + rax*2], 0
jne 0x140031520
mov r8d, eax
mov rdx, rbp
call fcn.14000be50
mov rax, qword [rsp + 0x28]
cmp dword [rax - 0x10], 0
je 0x140031552
lea rcx, [rdi + 0xa0]
lea rdx, [rsp + 0x28]
call fcn.140034a90
mov rax, qword [rsp + 0x38]
cmp dword [rax - 0x10], 0
je 0x14003156b
lea rcx, [rdi + 0x30]
lea rdx, [rsp + 0x38]
call fcn.140034a90
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], 0
je 0x14003158e
lea rcx, [rdi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140034a90
mov dword [rdi + 0xcc], 1
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], 0
je 0x1400315ca
lea rcx, [rdi + 0x50]
lea rdx, [rsp + 0x20]
call fcn.140034a90
mov rax, qword [rsp + 0x68]
cmp dword [rax - 0x10], 0
je 0x1400315ca
lea rcx, [rdi + 0x70]
lea rdx, [rsp + 0x68]
call fcn.140034a90
mov dword [rdi + 0xcc], 0x100
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400315e4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400315fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140031618
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140031632
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003164c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x140031655
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140037ae0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
xor r8d, r8d
mov rcx, rax
xor edx, edx
call fcn.1400aab30
mov ebx, eax
bt eax, 0x12
jae 0x140037b1e
mov rcx, rdi
call fcn.140038010
test al, al
je 0x140037b1e
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
bt ebx, 0x13
jae 0x140037b30
mov rcx, rdi
call fcn.140037f90
test al, al
jne 0x140037b11
bt ebx, 0x14
jae 0x140037b5b
xor ecx, ecx
call fcn.1400dd550
cmp eax, 0xb
jl 0x140037b5b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [str.SearchPane]
mov rcx, rax
call fcn.1400e2230
test al, al
jne 0x140037b11
bt ebx, 0x16
jae 0x140037b7b
lea rcx, [0x140038360]
mov rdx, rdi
mov byte [rdi + 0x28], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rdi + 0x28], 0
jne 0x140037b11
bt ebx, 0x15
jae 0x140037b8d
mov rcx, rdi
call fcn.140038140
test al, al
jne 0x140037b11
test ebx, 0x1800000
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x140037f90
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call fcn.1400dd550
cmp eax, 0xa
jl 0x140037ffb
mov rcx, rbx
call fcn.140038220
mov dword [rbx + 0x1c], eax
cmp eax, 0xffffffff
je 0x140037ffb
lea rcx, [0x1400382b0]
mov rdx, rbx
mov byte [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x20], 0
je 0x140037fe0
mov al, 1
add rsp, 0x20
pop rbx
ret
cmp byte [rbx + 0x18], 0
je 0x140037ffb
movsxd rax, dword [rbx + 0x1c]
lea rcx, [0x1401f1a5a]
shl rax, 4
cmp byte [rax + rcx], 0
jne 0x140037fd8
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140038010
Capabilities:
Get graphical window text

Disassembly:
sub rsp, 0x238
xor ecx, ecx
call fcn.1400dd550
cmp eax, 0xb
jge 0x14003802d
xor al, al
add rsp, 0x238
ret
xor eax, eax
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x230], rbx
mov word [rsp + 0x20], ax
call fcn.1400e5ee0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x104
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rsp + 0x20], 0
je 0x1400380b3
mov rdx, qword [str.NativeHWNDHost]
mov rcx, rbx
call fcn.1400e2230
test al, al
je 0x1400380b3
mov rcx, qword [str.Charm_Bar]
lea rdx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1400e7d40
test eax, eax
jne 0x1400380b3
mov al, 1
mov rbx, qword [rsp + 0x230]
add rsp, 0x238
ret
xor al, al
mov rbx, qword [rsp + 0x230]
add rsp, 0x238
ret
Function at 0x140038220
Capabilities:
Get keyboard layout

Disassembly:
mov r11, rsp
sub rsp, 0x78
xor eax, eax
lea rdx, [r11 - 0x58]
xor ecx, ecx
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x20], 0x48
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
mov rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov r8d, dword [0x1401f1a48]
mov rdx, rax
xor eax, eax
shr edx, 0x10
test r8d, r8d
jle 0x1400382a1
lea rcx, [0x1401f1a58]
cmp dx, word [rcx]
je 0x1400382a4
inc eax
add rcx, 0x10
cmp eax, r8d
jl 0x140038291
or eax, 0xffffffff
add rsp, 0x78
ret
Function at 0x14003a3b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [rsp + 0x70]
mov rbx, rcx
mov dword [rcx + 0x28e8], 1
mov qword [rcx + 0x2978], rax
movzx eax, word [rsp + 0x78]
mov dword [rcx + 0x2974], 2
mov word [rcx + 0x2980], ax
mov ecx, 0x14
mov edi, r9d
mov r14, r8
movzx esi, dx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
mov ecx, 0x10
and ebp, 1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [rbx + 0x28e4], eax
je 0x14003a439
xor ecx, ecx
test edi, edi
cmove eax, ecx
mov dword [rbx + 0x28e4], eax
mov ecx, dword [rbx + 0x28e0]
test ecx, ecx
jne 0x14003a44d
test edi, edi
jne 0x14003a44d
cmp si, 0xd
je 0x14003a49b
movzx eax, si
add eax, 0xffffffa5
cmp eax, 2
jbe 0x14003a49b
cmp dword [rbx + 0x59a0], 0
je 0x14003a49b
cmp ecx, 0x100
je 0x14003a49b
mov edx, dword [rbx + 0x28e4]
mov dword [rsp + 0x30], 1
lea rcx, [rbx + 0x28c0]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], edx
mov r9d, edi
movzx edx, si
mov r8, r14
call fcn.140038920
mov eax, 1
jmp 0x14003a49d
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret