joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f5b70
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
call fcn.14012fa20
test eax, eax
jne 0x1400f5b94
cmp qword [rbx + 0x438], 0
je 0x1400f5b9f
mov rcx, rbx
call fcn.14012f1b0
mov eax, 1
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, qword [rbx + 0x78]
mov rdx, rax
call fcn.1400d7ec0
test eax, eax
je 0x1400f5bc6
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, 1
add rsp, 0x40
pop rbx
ret
cmp dword [rbx + 0x3b4], 0
je 0x1400f5bfe
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400f5be9
call qword [sym.imp.USER32.dll_EmptyClipboard]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [rbx + 0x3b4], 0
mov eax, 1
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.14015db90
test eax, eax
jne 0x1400f5b94
cmp dword [rbx + 0x3ac], eax
je 0x1400f5d1e
mov rcx, qword [rbx + 0x78]
mov qword [rsp + 0x50], rbp
mov ebp, dword [rbx + 0x3a8]
mov qword [rsp + 0x58], rsi
call fcn.1400d8950
mov rcx, qword [rbx + 0x78]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
cmp dword [rbx + 0x3ac], eax
je 0x1400f5cbe
mov rdx, qword [rbx + 0x68]
mov rcx, qword [rbx + 0x78]
lea rsi, [rbx + 0x398]
mov dword [rbx + 0x3ac], eax
call qword [sym.imp.USER32.dll_SetMenu]
mov rcx, qword [rbx + 0x78]
call fcn.1400d7670
mov rcx, qword [rbx + 0x78]
mov edx, 0xfffffff0
or eax, 0xc40000
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongW]
test rsi, rsi
mov eax, 0x20
je 0x1400f5cbe
mov ecx, dword [rsi + 0xc]
mov r9d, dword [rsi + 4]
mov r8d, dword [rsi]
mov eax, dword [rsi + 8]
sub ecx, r9d
mov dword [rsp + 0x30], reloc.WS2_32.dll_gethostbyname
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbx + 0x78]
sub eax, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1400f5ce7
mov rcx, qword [rbx + 0x78]
or eax, 0x17
xor r9d, r9d
mov dword [rsp + 0x30], eax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rsi, qword [rsp + 0x58]
test ebp, ebp
mov rbp, qword [rsp + 0x50]
je 0x1400f5d04
mov rcx, qword [rbx + 0x78]
mov edx, 3
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x78]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x1400f6330
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test ecx, ecx
js 0x1400f635c
cmp ecx, 1
jle 0x1400f6355
cmp ecx, 3
jne 0x1400f635c
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
sets cl
mov eax, ecx
add rsp, 0x28
ret
mov eax, edx
add rsp, 0x28
ret
Function at 0x1400ff280
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp byte [0x14020b0f0], 0
mov esi, edx
mov rbx, rcx
jne 0x1400ff392
cmp dword [0x14020b0f4], 5
jae 0x1400ff392
lea rcx, [rsp + 0x20]
call fcn.1400012c0
mov r8d, esi
xor edx, edx
mov rcx, rbx
call fcn.1400f6da0
lea rcx, [rsp + 0x20]
lea edx, [rax + 1]
mov dword [rsp + 0x20], eax
call fcn.14017b180
mov rdx, qword [rsp + 0x28]
mov r8d, esi
mov rcx, rbx
call fcn.1400f6da0
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140001000
mov ecx, 2
add eax, 1
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x1400ff386
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov rcx, rax
call fcn.140001150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400ff37d
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rcx, [rsp + 0x20]
call fcn.140175010
jmp 0x1400ff40b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, [rsp + 0x20]
call fcn.140175010
jmp 0x1400ff40b
mov r8d, edx
xor edx, edx
call fcn.1400f6da0
mov ecx, 2
add eax, 1
movsxd rdx, eax
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rdi, rax
je 0x1400ff40b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8d, esi
mov rcx, rbx
mov rdx, rax
call fcn.1400f6da0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400ff402
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x1400ff40b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbx + 0x220]
call fcn.1400e6c50
mov rcx, rbx
call fcn.1400fed70
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400ff840
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ui_close_n
call fcn.1400b35e0
mov rcx, rbx
call fcn.1400fafe0
mov rcx, qword [rbx + 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call fcn.1400f70e0
cmp byte [0x14020ad06], 0
je 0x1400ff884
mov rcx, rbx
call fcn.14015c1d0
jmp 0x1400ff8fa
cmp dword [rbx + 0x5a8], 0
jne 0x1400ff8fa
cmp qword [0x14020b378], rbx
mov rax, qword [rbx + 0x1b0]
mov dword [rbx + 0x5a8], 1
jne 0x1400ff8b0
mov qword [0x14020b378], rax
jmp 0x1400ff8be
mov rcx, qword [rbx + 0x1b8]
mov qword [rcx + 0x1b0], rax
cmp qword [0x14020b380], rbx
mov rax, qword [rbx + 0x1b8]
jne 0x1400ff8d7
mov qword [0x14020b380], rax
jmp 0x1400ff8e5
mov rcx, qword [rbx + 0x1b0]
mov qword [rcx + 0x1b8], rax
mov rax, qword [0x14020b350]
mov qword [0x14020b350], rbx
mov qword [rbx + 0x1b0], rax
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x1400ff917
cmp qword [0x14020b378], 0
jne 0x1400ff917
add rsp, 0x20
pop rbx
jmp fcn.1400f1d90
call fcn.1400e55c0
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.14000d310

Function at 0x140100bf0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x140100d5c
call fcn.14015d190
test eax, eax
je 0x140100d4d
mov rcx, qword [rbx + 0x220]
mov qword [rsp + 0x30], rdi
call fcn.1400e6c50
mov rcx, rbx
call fcn.1400fed70
mov r8d, dword [rbx + 0x3b8]
lea rdx, str.CUT_isviewing__d_n
or ecx, 0xffffffff
call fcn.1400b3610
xor edi, edi
cmp dword [rbx + 0x3b8], edi
je 0x140100c63
mov rdx, qword [rbx + 0x3c0]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_ChangeClipboardChain]
mov dword [rbx + 0x3b8], edi
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140100cdb
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f4fb0
test rax, rax
je 0x140100cd5
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, 2
call fcn.1400f4f40
test rax, rax
mov rdi, rax
je 0x140100cd0
mov ax, word [0x14020b328]
test ax, ax
jne 0x140100cc4
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020b328], ax
movzx ecx, ax
mov rdx, rdi
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edi, 1
call qword [sym.imp.USER32.dll_CloseClipboard]
lea rdx, str.iscut__d_n
mov r8d, edi
or ecx, 0xffffffff
call fcn.1400b3610
test edi, edi
je 0x140100d42
lea rdx, str.ghost_selection_n
or ecx, 0xffffffff
call fcn.1400b3610
mov rcx, rbx
call fcn.1401323d0
mov r8d, dword [rbx + 0x3b8]
lea rdx, str.viewing__d_n
or ecx, 0xffffffff
call fcn.1400b3610
cmp dword [rbx + 0x3b8], 0
jne 0x140100d42
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_SetClipboardViewer]
mov dword [rbx + 0x3b8], 1
mov qword [rbx + 0x3c0], rax
mov dword [rbx + 0x3b4], edi
mov rdi, qword [rsp + 0x30]
lea rdx, str.is_cut_done_n
or ecx, 0xffffffff
call fcn.1400b3610
add rsp, 0x20
pop rbx
ret
Function at 0x140100d70
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [reloc.WS2_32.dll_accept], 0
mov rbx, rcx
je 0x140100e9e
call fcn.14015d190
test eax, eax
je 0x140100e9e
mov rcx, qword [rbx + 0x220]
call fcn.1400e6c50
mov rcx, rbx
call fcn.1400fed70
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140100e9e
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rcx, rbx
call fcn.1400f4fb0
test rax, rax
je 0x140100dda
mov rdx, rax
mov ecx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, rbx
call fcn.1400f52f0
test rax, rax
mov rbx, rax
je 0x140100e16
mov ax, word [0x14020b320]
test ax, ax
jne 0x140100e0a
lea rcx, str.Shell_IDList_Array
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020b320], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
mov edx, 4
lea ecx, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
test rax, rax
mov rbx, rax
je 0x140100e98
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140100e8f
mov rcx, rbx
mov dword [rax], 5
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test eax, eax
jne 0x140100e8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140100e8f
mov ax, word [0x14020b328]
test ax, ax
jne 0x140100e77
lea rcx, str.Preferred_DropEffect
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov word [0x14020b328], ax
movzx ecx, ax
mov rdx, rbx
call qword [sym.imp.USER32.dll_SetClipboardData]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_CloseClipboard]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
call qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rbx
ret

Function at 0x140100f10
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rdx, [rsp + 0x30]
lea rcx, [0x1400f4e20]
mov qword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140100f48
call fcn.1400ff840
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14010ccd0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010cd43
movzx eax, word [rsp + 0x30]
sub eax, 0x30
je 0x14010cd2d
cmp eax, 2
jne 0x14010cd43
movzx eax, word [rbx + 6]
movzx r8d, word [rbx]
jmp 0x14010cd4b
movzx eax, word [rbx]
movzx r9d, word [rbx + 6]
movzx r8d, word [rbx + 2]
lea rdx, str._02d__d__d
jmp 0x14010cd57
movzx eax, word [rbx]
movzx r8d, word [rbx + 6]
movzx r9d, word [rbx + 2]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140176950
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401a6ae0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
Function at 0x14010cd90
Capabilities:
Get geographical location

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x278
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rsi, r8
mov rdi, rdx
lea r8, [rsp + 0x30]
mov edx, r9d
call fcn.1400dab70
mov edx, dword [rsp + 0x2c0]
mov rcx, qword [rbx + 0x10]
lea r8, [rsp + 0x40]
mov ebp, eax
call fcn.1400dab70
test ebp, ebp
mov ebx, eax
jne 0x14010cded
test eax, eax
je 0x14010cfee
mov rcx, qword [rdi + 8]
cmp byte [rcx], 0
je 0x14010ce00
mov dl, 0x20
mov rcx, rdi
call fcn.140175200
test rsi, rsi
je 0x14010ce10
mov rdx, rsi
mov rcx, rdi
call fcn.1401752b0
test ebp, ebp
je 0x14010cfbe
test ebx, ebx
je 0x14010cf41
movzx eax, word [rsp + 0x46]
cmp word [rsp + 0x36], ax
jne 0x14010ce56
movzx eax, word [rsp + 0x42]
cmp word [rsp + 0x32], ax
jne 0x14010ce56
movzx eax, word [rsp + 0x40]
cmp word [rsp + 0x30], ax
jne 0x14010ce56
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14010ccd0
jmp 0x14010cfee
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010ceab
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010ce91
cmp eax, 2
jne 0x14010ceab
movzx eax, word [rsp + 0x36]
movzx r8d, word [rsp + 0x30]
jmp 0x14010ceb6
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010cec3
movzx eax, word [rsp + 0x30]
movzx r8d, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140176950
lea rdx, [0x1401b5b80]
mov rcx, rdi
call fcn.1401752b0
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010cfca
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010cf24
cmp eax, 2
jne 0x14010cfca
movzx eax, word [rsp + 0x46]
movzx r8d, word [rsp + 0x40]
jmp 0x14010cfd5
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x46]
movzx r8d, word [rsp + 0x42]
lea rdx, str._02d__d__d
jmp 0x14010cfe2
lea rdx, [0x1401d01c0]
mov rcx, rdi
call fcn.1401752b0
lea r8, [rsp + 0x50]
mov r9d, 0x104
mov edx, 0x21
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010cfab
movzx eax, word [rsp + 0x50]
sub eax, 0x30
je 0x14010cf91
cmp eax, 2
jne 0x14010cfab
movzx eax, word [rsp + 0x36]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x30]
jmp 0x14010cfdb
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x36]
movzx r8d, word [rsp + 0x32]
lea rdx, str._02d__d__d
jmp 0x14010cfe2
movzx eax, word [rsp + 0x30]
movzx r9d, word [rsp + 0x32]
movzx r8d, word [rsp + 0x36]
jmp 0x14010cfdb
lea rdx, [0x1401d01bc]
jmp 0x14010ced6
movzx r8d, word [rsp + 0x46]
movzx eax, word [rsp + 0x40]
movzx r9d, word [rsp + 0x42]
lea rdx, str._d__02d__d
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.140176950
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401a6ae0
add rsp, 0x278
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010e8b0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x140209b48]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
mov rbx, rdx
mov rsi, rcx
mov qword [rdx], rax
mov qword [rdx + 8], rax
lea r8, [rsp + 0x20]
lea edx, [rax + 0x21]
mov r9d, 0x104
mov ecx, 0x400
lea edi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x14010e90b
movzx edi, word [rsp + 0x20]
sub edi, 0x30
mov rdx, qword [rsi]
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x14010ea28
cmp al, 0x39
ja 0x14010ea28
xor r11d, r11d
test al, al
mov r10, r11
je 0x14010e954
nop
nop
cmp al, 0x30
jb 0x14010e954
cmp al, 0x39
ja 0x14010e954
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r10 + r10*4]
lea r10, [rcx + rax*2]
movzx eax, byte [rdx]
test al, al
jne 0x14010e930
lea r8, str._.:t
mov qword [rsi], rdx
mov al, 0x2f
mov rcx, r8
sub rcx, rdx
cmp byte [rdx], al
jne 0x14010ea28
movzx eax, byte [rcx + rdx + 1]
add rdx, 1
test al, al
jne 0x14010e966
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x14010ea28
cmp al, 0x39
ja 0x14010ea28
test al, al
je 0x14010e9b8
cmp al, 0x30
jb 0x14010e9b8
cmp al, 0x39
ja 0x14010e9b8
movzx eax, al
add rdx, 1
sub eax, 0x30
movsxd rcx, eax
lea rax, [r11 + r11*4]
lea r11, [rcx + rax*2]
mov al, byte [rdx]
test al, al
jne 0x14010e995
mov qword [rsi], rdx
mov al, 0x2f
sub r8, rdx
cmp byte [rdx], al
jne 0x14010ea28
movzx eax, byte [r8 + rdx + 1]
add rdx, 1
test al, al
jne 0x14010e9c0
mov qword [rsi], rdx
movzx eax, byte [rdx]
cmp al, 0x30
jb 0x14010ea28
cmp al, 0x39
ja 0x14010ea28
mov rcx, rsi
call fcn.14010e870
test edi, edi
je 0x14010ea14
cmp edi, 2
mov word [rbx + 2], r11w
je 0x14010ea05
mov word [rbx], ax
mov word [rbx + 6], r10w
mov eax, 1
jmp 0x14010ea2a
mov word [rbx + 6], ax
mov word [rbx], r10w
mov eax, 1
jmp 0x14010ea2a
mov word [rbx], ax
mov word [rbx + 2], r10w
mov word [rbx + 6], r11w
mov eax, 1
jmp 0x14010ea2a
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401a6ae0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14011ac60
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov rdi, rcx
cmp eax, 0x100
je 0x14011ac7e
cmp eax, 0x104
jne 0x14011aca8
mov rbx, qword [0x14020b388]
test rbx, rbx
je 0x14011aca8
nop
nop
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x18]
call fcn.1400d7ec0
test eax, eax
jne 0x14011acb5
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14011ac90
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x18]
mov edx, 0x400
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp qword [rdi], rax
jne 0x14011aca8
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call fcn.1400e0270
mov esi, dword [rdi + 0x10]
mov ebp, eax
lea eax, [rsi - 8]
cmp eax, 0xdd
ja case.0x14011ad03.10
movsxd rcx, eax
lea rax, [0x140000000]
movzx ecx, byte [rax + rcx + 0x11ad58]
mov edx, dword [rax + rcx*4 + 0x11ad48]
add rdx, rax
jmp rdx
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test ebp, ebp
jne case.0x14011ad03.10
xor esi, esi
jmp case.0x14011ad03.10
mov rcx, qword [rdi]
call sub.IMM32.dll_ImmGetVirtualKey
mov esi, eax
mov rcx, qword [rdi]
mov r8d, esi
mov edx, ebp
call fcn.1400e0d90
mov dword [rbx + 0x34], ebp
mov dword [rbx + 0x38], esi
mov eax, 1
jmp 0x14011ad07
Function at 0x14012b000
Capabilities:
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov rdi, rcx
cmp eax, 0x100
je 0x14012b01e
cmp eax, 0x104
jne 0x14012b048
mov rbx, qword [0x14020b3a8]
test rbx, rbx
je 0x14012b048
nop
nop
mov rdx, qword [rdi]
mov rcx, qword [rbx + 0x18]
call fcn.1400d7ec0
test eax, eax
jne 0x14012b055
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14012b030
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x18]
mov edx, 0x3f0
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp qword [rdi], rax
jne 0x14012b048
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call fcn.1400e0270
mov esi, dword [rdi + 0x10]
mov ebp, eax
lea eax, [rsi - 8]
cmp eax, 0xdd
ja case.0x14012b0a3.10
movsxd rcx, eax
lea rax, [0x140000000]
movzx ecx, byte [rax + rcx + 0x12b0f8]
mov edx, dword [rax + rcx*4 + 0x12b0e8]
add rdx, rax
jmp rdx
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test ebp, ebp
jne case.0x14012b0a3.10
xor esi, esi
jmp case.0x14012b0a3.10
mov rcx, qword [rdi]
call sub.IMM32.dll_ImmGetVirtualKey
mov esi, eax
mov rcx, qword [rdi]
mov r8d, esi
mov edx, ebp
call fcn.1400e0d90
mov dword [rbx + 0x34], ebp
mov dword [rbx + 0x38], esi
mov eax, 1
jmp 0x14012b0a7

Function at 0x140139dc0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rcx, qword [rcx + 0x3d0]
mov edi, edx
mov edx, 1
mov ebx, r8d
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
mov r8d, ebx
mov edx, edi
mov rcx, rsi
mov byte [rsi + 0x3f8], 0
call fcn.140136d50
cmp eax, 0xffffffff
je 0x140139e47
mov ecx, send
call fcn.1400d9130
mov rcx, rsi
test eax, eax
je 0x140139e2f
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140106a70
movsx eax, byte [0x14020acf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140101380
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14013a1d0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
movsx esi, dx
mov rbx, rcx
shr rax, 0x10
mov edx, esi
movsx edi, ax
mov r8d, edi
call fcn.1401374b0
test eax, eax
jne 0x14013a2d9
movsx ecx, byte [0x14020acd3]
sub ecx, 1
je 0x14013a2d9
cmp ecx, 1
je 0x14013a269
cmp dword [rbx + 0x464], 0xffffffff
jne 0x14013a260
mov dword [rbx + 0x464], eax
mov rax, qword [0x14020b228]
test rax, rax
je 0x14013a24e
lea rcx, [rsp + 0x48]
mov edx, 0x80
call rax
test byte [rsp + 0x48], 0x20
jne 0x14013a24e
mov dword [rbx + 0x464], 1
mov edx, dword [rbx + 0x464]
lea rcx, str.cached_oneclickactivate__d_n
call fcn.1400b35e0
cmp dword [rbx + 0x464], 0
jne 0x14013a2d9
mov rcx, qword [rbx + 0x3d0]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
xor r9d, r9d
mov r8d, edi
mov edx, esi
mov rcx, rbx
mov byte [rbx + 0x3f8], 0
call fcn.140136d50
cmp eax, 0xffffffff
je 0x14013a2d9
mov ecx, send
call fcn.1400d9130
mov rcx, rbx
test eax, eax
je 0x14013a2c1
mov edx, 0xa031
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.140106a70
movsx eax, byte [0x14020acf5]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.140101380
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14013aa60
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
movsxd rbx, edx
mov rdi, rcx
call fcn.14015d570
test eax, eax
je 0x14013aa96
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
lea edx, [r9 + 5]
call fcn.1400f79a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
imul ebx, ebx, 0xfffffffb
mov eax, 0x88888889
add dword [rdi + 0x420], ebx
mov ecx, dword [rdi + 0x420]
imul ecx
lea ebx, [rcx + rdx]
sar ebx, 6
mov eax, ebx
shr eax, 0x1f
add ebx, eax
je 0x14013abe8
mov eax, ebx
xor edx, edx
lea r8, [rsp + 0x80]
xor r9d, r9d
imul eax, eax, 0x78
sub ecx, eax
mov dword [rdi + 0x420], ecx
lea ecx, [rdx + 0x68]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r11d, dword [rsp + 0x80]
mov rcx, qword [rdi + 0x3d0]
cmp r11d, 1
mov eax, 3
cmovb r11d, eax
mov dword [rsp + 0x80], r11d
call fcn.1400d7670
bt eax, 0x14
jae 0x14013abe8
mov rcx, qword [rdi + 0x3d0]
xor eax, eax
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x20], 0x1c
mov dword [rsp + 0x24], 2
call qword [sym.imp.USER32.dll_GetScrollInfo]
mov esi, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
cmp esi, eax
cmova esi, eax
cmp byte [rdi + 0x228], 0
mov dword [rsp + 0x80], esi
je 0x14013ab75
neg ebx
mov rcx, qword [rdi + 0x3d0]
imul esi, ebx
call fcn.1400d7670
bt eax, 0x14
jae 0x14013abcd
mov rcx, qword [rdi + 0x3d0]
xor eax, eax
lea r8, [rsp + 0x40]
mov qword [rsp + 0x40], rax
xor edx, edx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x40], 0x1c
mov dword [rsp + 0x44], 4
call qword [sym.imp.USER32.dll_GetScrollInfo]
test eax, eax
je 0x14013abcd
mov eax, dword [rsp + 0x54]
jmp 0x14013abcf
xor eax, eax
mov r9d, 1
lea edx, [rax + rsi]
mov rcx, rdi
mov r8d, r9d
call fcn.14013a2f0
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret