joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086900
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edi, edi
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x14008693c
sub rdx, qword [rcx + 0x38]
lea r8d, [rdi + 1]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x14008695b
cmp qword [rbx + 0x30], rdi
jne 0x14008695b
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x1400869bc
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1400869bc
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + gethostname]
mov rbx, qword [rsp + 0x30]
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140087580
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14008a030
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008a116
cmp word [rcx], 0
je 0x14008a116
mov r8d, 4
lea rdx, [0x1400eb0d8]
call fcn.1400b1140
mov r8, rbx
test eax, eax
jne 0x14008a073
lea r8, [rbx + 8]
test r8, r8
je 0x14008a0b0
movzx edx, word [r8]
test dx, dx
je 0x14008a0b0
lea rcx, [0x1400e7be8]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x14008a0db
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008a090
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14008a081
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x14008a0c2
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14008a116
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x14008a103
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x14008a810
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400be180
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14008a864
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.1400a7030
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x14008b0c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov ebp, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x14008b0fc
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x14008b103
mov rdi, qword [0x140101fd0]
test rdi, rdi
je 0x14008b2bb
mov qword [rsp + 0x80], r14
lea r14, [0x1401043f0]
test ebp, ebp
jns 0x14008b12a
movzx eax, bp
neg ax
movzx edx, ax
jmp 0x14008b160
test ebp, ebp
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r14
cmovne eax, ebp
lea r9, [rsp + 0x40]
lea r8, [0x14008b0a0]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r14
je 0x14008b284
mov r8d, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14008b284
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008b284
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008b284
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x14008b1c2
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jbe 0x14008b215
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14008b1f7
movzx eax, dl
mov edx, ebx
cmp eax, esi
setl dl
jmp 0x14008b201
movzx eax, al
mov edx, ebx
cmp eax, esi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14008b1e0
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14008b284
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008b284
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008b284
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
test rcx, rcx
je 0x14008b2a3
test r12, r12
je 0x14008b2a3
mov qword [rcx], rdi
jmp 0x14008b2b1
test r13, r13
je 0x14008b2b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14008b2bb
mov rax, r12
jmp 0x14008b2d8
test ebp, ebp
jle 0x14008b2c4
lea ebx, [rbp - 1]
jmp 0x14008b2ca
cmp ebp, 0xffffffff
cmovl ebx, ebp
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14008bcb0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14008bcca
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14008bcd4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14008bd56
test al, 8
jne 0x14008bd51
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14008bd12
cmp eax, 9
je 0x14008bd12
cmp ecx, 0x20
je 0x14008bd12
cmp ecx, 9
je 0x14008bd12
cmp eax, 0x30
je 0x14008bd12
cmp eax, 0x2b
jne 0x14008bd51
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14008c5a0
test eax, eax
jne 0x14008bd33
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400012a0
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14008bd36
test al, 0x20
je 0x14008bda8
mov rcx, rdi
test al, 8
jne 0x14008bd94
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008c5a0
test eax, eax
je 0x14008bd26
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14008bd3c
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14008bd3c
test al, 1
je 0x14008bdc1
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008c2d0
test al, 2
je 0x14008bde6
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008c920
cmp byte [rbx + 0x23], 0
jne 0x14008bdf2
mov rax, qword [rbx + 0x10]
jmp 0x14008bdf5
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14008be03
mov rdx, rbx
call fcn.140037a80
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008c5a0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14008be30
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14008bf15
sub r8d, 1
je 0x14008bf01
sub r8d, 2
je 0x14008beef
sub r8d, 1
je 0x14008be8f
cmp r8d, 1
jne 0x14008bed0
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008c920
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14008bed0
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14008bf15
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14008c5a0
test eax, eax
jne 0x14008bec4
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14008bf18
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008c5a0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008bcb0
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14008bf1b
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.1400012a0
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14008c2d0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14008c2f0
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14008c2e6
cmp byte [rdx + 0x23], 0
jne 0x14008c2fa
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001340
cmp byte [rbx + 0x23], 1
jne 0x14008c367
cmp rbx, rdi
je 0x14008c357
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14008c5a0
test eax, eax
jne 0x14008c33e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400a7030
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008c380
Function at 0x14008c380
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140105138]
call fcn.140005310
test eax, eax
jne 0x14008c3bd
lea r8, [0x1400ccf5c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1401044f0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.140036f10
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008c482
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008c482
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008c482
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008c482
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008c540
test rdi, rdi
je 0x14008c469
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008c4e1
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a7030
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008c3f0
cmp dword [0x140105164], r12d
je 0x14008c4bc
cmp qword [0x140105148], r12
je 0x14008c4a8
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140105164], r12d
je 0x14008c524
cmp qword [0x140105148], r12
je 0x14008c510
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
lea r8, [0x1400ccf5c]
lea rdx, [0x1400cd298]
lea rcx, [0x1401044f0]
call fcn.140036f10
jmp 0x14008c4c1
cmp dword [0x140105164], r12d
je 0x14008c57a
cmp qword [0x140105148], r12
je 0x14008c566
mov rcx, qword [0x140105138]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140105148], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140105164], r12d
mov qword [0x140105138], r12
lea r8, [0x1400ccf5c]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401044f0]
call fcn.140036f10
jmp 0x14008c4c1
Function at 0x14008c9f0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14008cc30
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14008ca8d
sub ecx, 1
je 0x14008ca56
cmp ecx, 1
je 0x14008ca3a
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008ca44
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140105138]
call fcn.140004bd0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14008cbd0
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001340
cmp dword [0x140102d04], 0
jne 0x14008cb8e
cmp qword [rdi + 0x10], 0
jne 0x14008cb8e
cmp qword [0x140106ae0], rdi
jne 0x14008cabb
test rbx, rbx
jne 0x14008cb3a
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008cb35
xor esi, esi
mov qword [0x140106ae0], rsi
test rbx, rbx
je 0x14008cb23
mov edx, dword [0x140102d14]
test edx, edx
je 0x14008cb05
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x1401044f0]
mov qword [rsp + 0x20], rsi
call fcn.140037930
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14008a810
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008cb75
cmp byte [rdi + 0x23], 0
jne 0x14008cb46
mov rax, qword [rdi + 0x10]
jmp 0x14008cb49
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14008cb57
mov rdx, rdi
call fcn.140037a80
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x140106ae0], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x140106ae0], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14008cc2b
test r8, r8
jne 0x14008cbe0
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14008cbc6
mov rdx, rdi
call fcn.140037a80
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14008cc2b
cmp r8, 0x186a0
jae 0x14008cc1d
movzx eax, word [rdx]
test ax, ax
je 0x14008cc13
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14008cc00
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14008cbcb
mov rcx, rbx
call fcn.1400a7030
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14008cbcb
mov rcx, qword [rdi + 0x10]
call fcn.14008c9f0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008d730
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14008d746
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140104468]
mov r15d, eax
je 0x14008d777
mov rcx, rbx
call fcn.14008eb10
test al, al
je 0x14008d777
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x14008d79c
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14008d7b7
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rsi
jne 0x14008d7cf
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
cmp byte [0x140102d0b], 0
jne 0x14008d7ec
mov rdx, rsi
mov rcx, rbx
call fcn.14008d690
test rax, rax
jne 0x14008d93b
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x14008d875
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14008d87a
cmp dword [0x140104468], eax
je 0x14008d851
mov rcx, rsi
call fcn.14008eb10
test al, al
jne 0x14008d851
mov ecx, dword [0x140104468]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14008d87a
cmp r14d, r15d
je 0x14008d87a
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14008d87a
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.14008d690
mov rbp, rax
test rax, rax
jne 0x14008d8e2
inc edi
cmp edi, 5
jl 0x14008d880
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140011c90
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.140011c90
mov rdx, rsi
mov rcx, rbx
call fcn.14008d690
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x14008d903
mov ecx, dword [0x140104468]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14008d91c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x14008d934
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x14008d936
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x14008da90
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x14008dab0
call fcn.140062990
jmp 0x14008dac0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x14008db1c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001710
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008db1c
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x14008db1c
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001710
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14008daf1
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008dd00
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400be180
sub rsp, rax
mov r10, qword [rbp + 0x11c10]
mov rdi, rcx
movzx ecx, word [rdx]
mov r11d, 0xffdf
lea eax, [rcx - 0x41]
test r11w, ax
jne 0x14008ddb4
cmp word [rdx + 2], 0
jne 0x14008ddb4
cmp word [r8], 0
jne 0x14008ddb4
cmp word [r9], 0
jne 0x14008ddb4
cmp word [r10], 0
jne 0x14008ddb4
mov qword [rsp + 0x11cf0], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x14008dd83
cmp byte [rdi + 0x12a], 0
jne 0x14008dd83
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
cmp byte [rbp + 0x11c20], 0
je 0x14008dd98
test rbx, rbx
je 0x14008dd98
mov qword [rdi + 0xf8], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x11cf0]
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
test cx, cx
jne 0x14008dde4
cmp word [r8], cx
jne 0x14008dde4
cmp word [r9], cx
jne 0x14008dde4
cmp word [r10], cx
jne 0x14008dde4
mov rcx, rdi
call fcn.14008df60
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
xor ecx, ecx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r9
lea rax, [0x1400ccf5c]
mov r9, r8
mov dword [rsp + 0x30], ecx
mov r8, rdx
mov byte [rbp + 0x1781], cl
mov dword [rbp + 0x1784], ecx
xorps xmm0, xmm0
mov qword [rbp + 0x1788], rcx
mov rdx, rdi
mov dword [rbp + 0x17a0], ecx
mov qword [rbp + 0x17a8], rcx
mov qword [rbp + 0x17b8], rcx
mov qword [rbp + 0x17c0], rcx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf48], rax
movdqa xmmword [rbp + 0x1790], xmm0
call fcn.14008ed30
test eax, eax
je 0x14008df06
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x14008df19
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x14008dedb
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008df06
cmp byte [rdi + 0x12a], 0
jne 0x14008ded4
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14008ded4
mov rcx, qword [rbp + 0xf68]
lea edx, [rax - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x14008df06
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x14008def5
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.14008f1d0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008f2c0
test rax, rax
jne 0x14008df2b
xor eax, eax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
lea rdx, [rsp + 0x30]
lea rcx, [0x14008dff0]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbp + 0x11c20], 0
mov rax, qword [rbp + 0x1788]
je 0x14008df47
test rax, rax
je 0x14008df47
mov qword [rdi + 0xf8], rax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret