joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c6e50
Capabilities:
Create service

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x280
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rsi, rcx
lea r8, [rcx + 0x61c]
mov rbp, rdx
lea rcx, [rsp + 0x70]
xor r12d, r12d
mov edx, 0x200
mov ebx, r12d
call fcn.1400f27f0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasb al, byte [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
cmp byte [rsp + rax + 0x6f], 0x5c
je 0x1400c6ebf
mov byte [rsp + rax + 0x70], 0x5c
mov byte [rsp + rax + 0x71], bl
lea r8, [rsi + 0xa1c]
lea rcx, [rsp + 0x70]
mov edx, 0x200
call fcn.14002c340
lea r8, [rsp + 0x70]
lea rdx, str._WinNT_bCreateService__szDestName___s_n
mov rcx, rsi
call fcn.1400c3fb0
mov rcx, qword [rsi + 0x210]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x70]
lea rdx, [rsi + 0xb1c]
mov qword [rsp + 0x38], rax
mov edi, 1
mov r9d, 0xf01ff
mov dword [rsp + 0x30], edi
mov r8, rdx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
jne 0x1400c6f7a
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bCreateService__CreateService_failed__error_code___d_n
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.1400c3fb0
mov edx, ebx
sub edx, 5
je 0x1400c6f70
sub edx, 0x42b
je 0x1400c6f70
cmp edx, edi
je 0x1400c6f75
mov edi, r12d
jmp 0x1400c6fa3
mov ebx, r12d
jmp 0x1400c6fa3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
mov edi, eax
jne 0x1400c6fa3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bCreateService__CloseServiceHandle_failed__errorcode___d_n
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.1400c3fb0
mov dword [rbp], ebx
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400efff0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x1400c6fd0
Capabilities:
Delete service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rdx, [rcx + 0xb1c]
mov rcx, qword [rcx + 0x210]
mov r8d, 0xf01ff
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x1400c7015
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwDeleteService__Openservice_failed__errorcode___d_n
jmp 0x1400c7056
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1400c703c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwDeleteService__DeleteService_failed__errorcode___d_n
mov rcx, rdi
mov r8d, eax
mov ebx, eax
call fcn.1400c3fb0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1400c7063
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwDeleteService__CloseServiceHandle_failed__errorcode___d_n
mov r8d, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400c3fb0
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c7080
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
lea rdx, [rcx + 0xb1c]
mov rcx, qword [rcx + 0x210]
mov r8d, 0xf01ff
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov r12, rax
jne 0x1400c70e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bStartService__OpenService_failed__error_code___d_n
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.1400c3fb0
mov dword [rbp], ebx
xor eax, eax
jmp 0x1400c7163
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
mov ebx, eax
jne 0x1400c7137
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bStartService__StartService_failed__error_code___d_n
mov rcx, rsi
mov r8d, eax
mov edi, eax
call fcn.1400c3fb0
mov r11d, edi
sub r11d, 2
je 0x1400c7135
sub r11d, 0x23f
je 0x1400c7135
sub r11d, 0x1df
jne 0x1400c7135
xor edi, edi
lea ebx, [rdi + 1]
jmp 0x1400c7137
xor ebx, ebx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1400c715e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bStartService__CloseServiceHandle_failed__errorcode___d_n
mov rcx, rsi
mov r8d, eax
mov edi, eax
call fcn.1400c3fb0
mov dword [rbp], edi
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400c7180
Capabilities:
Stop service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
lea rdx, [rcx + 0xb1c]
mov rcx, qword [rcx + 0x210]
mov r8d, 0xf01ff
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
test rax, rax
mov rsi, rax
jne 0x1400c71c8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwStopService__OpenService_failed__errorcode___d_n
jmp 0x1400c72ab
lea r8, [rsp + 0x20]
mov edx, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400c7277
mov r8d, dword [rsp + 0x24]
lea rdx, str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_INTERROGATE__status__0x_X_n
mov rcx, rdi
call fcn.1400c3fb0
cmp dword [rsp + 0x24], 1
je 0x1400c7291
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1400c7268
mov r8d, dword [rsp + 0x24]
lea rdx, str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__status__0x_X_n
mov rcx, rdi
call fcn.1400c3fb0
cmp dword [rsp + 0x24], 3
jne 0x1400c7291
mov rcx, qword [rdi + 0x208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rsi
mov qword [rdi + 0x208], 0xffffffffffffffff
call qword [sym.imp.ADVAPI32.dll_ControlService]
lea rdx, str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__failed__pending__result___d_n
jmp 0x1400c7286
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_STOP__failed__errorcode___d_n
jmp 0x1400c7284
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwStopService__ControlService_SERVICE_CONTROL_INTERROGATE__failed__errorcode___d_n
mov ebx, eax
mov r8d, eax
mov rcx, rdi
call fcn.1400c3fb0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1400c72b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_dwStopService__CloseServiceHandle_failed__errorcode___d_n
mov r8d, eax
mov rcx, rdi
mov ebx, eax
call fcn.1400c3fb0
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400c73b0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
lea rcx, [rsp + 0x30]
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rbx, [rsi + 0x21c]
lea rdx, [rsp + 0x70]
mov rcx, rbx
xor edi, edi
mov dword [rsp + 0x70], 0x200
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
movzx r11d, word [rsp + 0x3c]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
lea rdx, str._WinNT_bInstallDriver__02d:_02d:_02d__szMachineName___s_n
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r11d
call fcn.1400c3fb0
cmp byte [rbx], dil
mov r8d, 0xf003f
cmovne rdi, rbx
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test rax, rax
mov qword [rsi + 0x210], rax
jne 0x1400c7467
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bInstallDriver__OpenSCManager_failed__error_code___d_n
mov rcx, rsi
mov r8d, eax
mov ebx, eax
call fcn.1400c3fb0
mov dword [rbp], ebx
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp dword [rsi + 0x218], 0
je 0x1400c74a7
mov edx, dword [rsi + 0xda0]
mov rcx, rsi
call fcn.1400c7b10
test eax, eax
jne 0x1400c74a7
lea rdx, str._WinNT_bInstallDriver__Unable_to_extract_driver_file_n
mov rcx, rsi
call fcn.1400c3fb0
mov dword [rbp], 0x5001
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400c6e50
test eax, eax
mov ebx, eax
je 0x1400c74d5
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400c7080
test eax, eax
mov ebx, eax
jne 0x1400c74d5
mov rcx, rsi
call fcn.1400c6fd0
mov rcx, qword [rsi + 0x210]
test rcx, rcx
je 0x1400c7503
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test eax, eax
jne 0x1400c7503
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._WinNT_bInstallDriver__CloseServiceHandle_failed__errorcode___d_n
mov rcx, rsi
mov r8d, eax
call fcn.1400c3fb0
cmp dword [rsi + 0x218], 0
je 0x1400c7514
mov rcx, rsi
call fcn.1400c76b0
mov eax, dword [rsp + 0x60]
mov dword [rbp], eax
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c76b0
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x260
mov rax, qword [0x14017c820]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r12, rcx
lea rcx, [rsp + 0x40]
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [r12 + 0xa1c]
lea rsi, [r12 + 0x61c]
lea r8, str._s_s
lea rcx, [rsp + 0x50]
mov r9, rsi
mov edx, 0x200
mov qword [rsp + 0x20], rax
call fcn.14002c260
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov ebp, eax
jne 0x1400c772e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
movzx ecx, word [rsp + 0x4c]
movzx r9d, word [rsp + 0x4a]
movzx r8d, word [rsp + 0x48]
mov dword [rsp + 0x30], ebx
lea rdx, str._bDeleteFile__02d:_02d:_02d__DeleteFile_returned___d__error___d__n
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], ecx
mov rcx, r12
call fcn.1400c3fb0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [r12 + 0x41c]
repne scasb al, byte [rdi]
mov rdi, rsi
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, rdx
jbe 0x1400c77d2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov edi, eax
jne 0x1400c779d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
movzx edx, word [rsp + 0x4c]
movzx r9d, word [rsp + 0x4a]
movzx r8d, word [rsp + 0x48]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edx
lea rdx, str._bDeleteFile__02d:_02d:_02d__RemoveDirectory__s_returned___d__error___d__n
mov rcx, r12
call fcn.1400c3fb0
mov eax, edi
jmp 0x1400c77d4
mov eax, ebp
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400efff0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c8640
Capabilities:
Get file version info

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rcx, rcx
mov rdi, rdx
mov rsi, rcx
je 0x1400c871a
test rdx, rdx
je 0x1400c871a
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [rsp + 0x40], eax
je 0x1400c8709
mov ecx, eax
call fcn.1400d8d48
test rax, rax
mov rbx, rax
jne 0x1400c869a
mov eax, 0x8007000e
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r8d, dword [rsp + 0x40]
mov r9, rax
xor edx, edx
mov rcx, rsi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x1400c8701
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x58]
lea rdx, [0x140113ae4]
mov rcx, rbx
mov qword [rsp + 0x58], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400c8701
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400c8701
mov eax, dword [rcx + 8]
mov dword [rdi + 4], eax
mov eax, dword [rcx + 0xc]
mov rcx, rbx
mov dword [rdi], eax
call fcn.1400d8d50
mov rbx, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.1400d8d50
mov eax, 0x80004005
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0x80070057
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400ca300
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x30]
lea rdx, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
or ebx, 0xffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400ca388
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea rdx, str.EnableFirewall
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400ca378
cmp dword [rsp + 0x60], 4
cmove ebx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400ca388
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400ca450
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rdi, rcx
lea rdx, str.HTTP_shellopencommand
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400ca497
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [0x140134f5b]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400ca4f9
cmp dword [rsp + 0x48], 1
jne 0x1400ca4f9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, [0x140134f5b]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400ca509
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d37e0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, rdx
mov rdi, rcx
lea edx, [rbp + 2]
xor ecx, ecx
mov qword [rsp + 0x70], rbp
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400d3849
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x1400d385b
cmp eax, 0x80010119
je 0x1400d385b
mov rcx, rdi
call fcn.1400d32f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x60], rsi
lea rsi, [rdi + 0x40]
lea r9, [0x1401325e0]
lea rcx, [0x1401326b0]
lea r8d, [rdx + 1]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400d391f
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rsi]
lea rbx, [rdi + 0x38]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov qword [rdi + 0x58], rax
mov r10, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [r10 + SafeArrayPutElement]
test eax, eax
js 0x1400d391f
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400d391f
mov rax, qword [rcx]
lea r8, [rsp + 0x70]
lea rdx, [0x1401324e0]
call qword [rax]
test eax, eax
js 0x1400d391f
mov rcx, qword [rbx]
mov dword [rsp + 0x38], ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea edx, [r9 + 0xa]
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x1400d393e
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + SafeArrayGetUBound]
mov rcx, rdi
call fcn.1400d32f0
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x38], ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
lea edx, [r9 + 0xa]
xor r8d, r8d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
mov rdx, qword [rcx]
call qword [rdx + SafeArrayGetUBound]
test ebx, ebx
js 0x1400d391f
xor edx, edx
lea rbx, [rdi + 0x48]
lea r9, [0x140132680]
lea r8d, [rdx + 1]
lea rcx, [0x140132720]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400d391f
mov rcx, qword [rbx]
lea r8, [rdi + 0x50]
lea rdx, [0x1401326a0]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x1400d391f
mov eax, 1
jmp 0x1400d3929
Function at 0x1400d91fc
Capabilities:
Get graphical window text

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1400d923a
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1400d92ee
call fcn.1400e5988
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400d9259
mov ecx, 0x80004005
call fcn.140003770
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x118]
mov rdx, rsi
or rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1400f3400
test eax, eax
je 0x1400d92c1
cmp eax, 0xc
je 0x1400d92bb
cmp eax, 0x16
je 0x1400d92b5
cmp eax, 0x22
je 0x1400d92b5
cmp eax, 0x50
je 0x1400d92c1
call fcn.1400e6370
int3
call fcn.1400e6370
int3
call fcn.1400e6328
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1400d92ec
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400da308
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.1400ea75c
test rax, rax
mov rsi, rax
je 0x1400da385
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test rbx, rbx
movzx edi, ax
je 0x1400da380
cmp dword [rbx], 0x38
jb 0x1400da380
mov rax, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x1400da380
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x1400da389
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400db28c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, ecx
call fcn.1400e5908
mov rbx, rax
mov rax, qword [rax + 0x78]
test rax, rax
je 0x1400db2c3
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x1400db2c3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
call qword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
mov rbx, qword [rbx + 0xa0]
je 0x1400db2f3
test rbx, rbx
je 0x1400db2f3
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400db2f3
mov rax, qword [rbx]
or rdx, 0xffffffffffffffff
mov rcx, rbx
call qword [rax + 0x2d0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400de860
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0xa0], 0
mov rbx, rdx
mov rsi, rcx
jne 0x1400de918
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov r8, qword [rbx]
mov edx, 1
mov ecx, dword [r8 - 0xc]
sub edx, dword [r8 - 8]
movsxd rdi, eax
sub ecx, edi
or edx, ecx
jge 0x1400de8b0
mov edx, edi
mov rcx, rbx
call fcn.140002c70
test edi, edi
mov rdx, qword [rbx]
js 0x1400de90d
cmp edi, dword [rdx - 0xc]
jg 0x1400de90d
mov dword [rdx - 0x10], edi
mov rax, qword [rbx]
lea r8d, [rdi + 1]
and word [rax + rdi*2], 0
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400de8e1
xor eax, eax
jmp 0x1400de8ea
call fcn.1400f3520
test eax, eax
js 0x1400de902
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400de902
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbx]
and word [rax + rcx*2], 0
jmp 0x1400de928
mov ecx, 0x80070057
call fcn.140003770
int3
mov ecx, 0x80070057
call fcn.140003770
int3
mov rcx, qword [rcx + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x118]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e137c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x1400e13e4
call fcn.1400e58b8
mov r8d, 0xf0
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x1400e13e4
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x1400e1406
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400e0dd8
test rdi, rdi
mov esi, eax
je 0x1400e1404
test rbx, rbx
je 0x1400e1404
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret