joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056830
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x150
mov dil, byte [rdx]
mov r12b, byte [rdx + 7]
movzx esi, word [rdx + 8]
xor r13d, r13d
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 0x28], r13
je 0x140056933
cmp dil, 0x14
je 0x140056933
cmp dil, 0x90
je 0x140056933
cmp dil, 0x91
je 0x140056933
mov rcx, rdx
call fcn.14003c4e0
test al, al
je 0x140056918
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1400568ba
movzx eax, dil
lea rcx, [rsp + 0x50]
or byte [rsp + rax + 0x50], 0x80
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, r12b
mov rcx, rbp
shl eax, 0x10
movsxd rsi, eax
or rsi, 1
call fcn.14004d9f0
cmp al, 1
jne 0x1400568d9
bts rsi, 0x18
cmp byte [rbx + 0x1b], r13b
jne 0x1400568eb
cmp byte [rbx + 0x21], r13b
jne 0x1400568eb
cmp dil, 0x12
jne 0x14005690a
cmp byte [rbx + 0x1a], r13b
jne 0x14005690a
cmp byte [rbx + 0x20], r13b
jne 0x14005690a
bts rsi, 0x1d
movzx r8d, dil
mov edx, 0x104
mov r9, rsi
jmp 0x140056927
movzx r8d, dil
mov r9, rsi
mov edx, pe_nt_image_headers64
jmp 0x140056927
movzx r8d, si
mov edx, 0x102
mov r9d, 1
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14005699c
mov rcx, rdx
call fcn.14003c4e0
test al, al
je 0x140056966
mov rcx, rbp
call fcn.14004d9f0
mov r8b, r12b
mov dl, dil
mov rcx, rbx
cmp al, 1
jne 0x14005695c
mov r9d, 1
jmp 0x14005695f
xor r9d, r9d
call fcn.14003c350
jmp 0x14005699c
mov r8d, SafeArrayCreateEx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 1
lea ecx, [r8 - 0x27]
mov word [rsp + 0x28], r13w
mov word [rsp + 0x2a], si
mov qword [rsp + 0x2c], 4
mov qword [rsp + 0x38], r13
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, rbx
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rdi
jmp fcn.14003c3c0

Function at 0x1400569c0
Capabilities:
Check for time delay via queryperformancecounter
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140056830
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400566b0

Function at 0x1400569f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov byte [rcx + 7], 0
mov word [rcx], 0xff
mov dword [rcx + 2], 0
mov byte [rcx + 6], 0
movzx edi, dx
mov rbx, rcx
mov byte [rcx + 0xa], 0
mov word [rcx + 8], dx
call fcn.14003c4d0
test al, al
jne 0x140056a29
xor al, al
jmp 0x140056a6b
movzx ecx, di
call qword [sym.imp.USER32.dll_VkKeyScanW]
cmp ax, 0xffff
je 0x140056a25
movzx edi, ax
movzx ecx, al
xor edx, edx
sar di, 8
mov byte [rbx], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 7], al
mov al, 1
test al, dil
je 0x140056a59
mov byte [rbx + 1], al
test dil, 2
je 0x140056a62
mov byte [rbx + 3], al
test dil, 4
je 0x140056a6b
mov byte [rbx + 4], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140056a80
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov dil, dl
mov rbx, rcx
mov word [rcx + 8], si
mov byte [rcx + 7], sil
mov dword [rcx + 1], esi
mov word [rcx + 5], si
mov byte [rcx + 0xa], sil
mov byte [rcx], dl
call fcn.14003c4e0
test al, al
je 0x140056ac6
movzx ecx, dil
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 7], al
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14005d6a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.140001ce0
mov rax, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
lea rdx, [0x14009b350]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
inc dword [rax]
mov qword [rsp + 0x68], r11
mov qword [rbp - 0x80], rax
call fcn.14000fa60
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14005d851
mov sil, byte [rbp + 0x228]
mov rdi, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x200]
call fcn.14004b650
cmp eax, 1
je 0x14005d84a
cmp eax, 0xb
jne 0x14005d75b
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005d736
lea rdx, [0x14009811c]
lea rcx, [rbp - 0x44]
call fcn.140015770
test eax, eax
je 0x14005d831
lea rdx, [0x14009b358]
lea rcx, [rbp - 0x44]
call fcn.140015770
test eax, eax
je 0x14005d831
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400108f0
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x48]
call fcn.14000fa60
test byte [rbp - 0x70], 0x10
je 0x14005d80b
test sil, sil
je 0x14005d7b6
inc qword [rdi]
cmp byte [rbp + 0x230], 0
je 0x14005d831
lea rdx, [0x1400959cc]
lea rcx, [rsp + 0x48]
call fcn.14000fa60
mov al, byte [rbp + 0x230]
mov r9, qword [rbp + 0x218]
mov r8, qword [rbp + 0x210]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x200]
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.14005d6a0
mov bl, al
test al, al
je 0x14005d84c
jmp 0x14005d831
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp - 0x54]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rbp + 0x210]
add qword [rax], rcx
test sil, sil
je 0x14005d831
mov rax, qword [rbp + 0x218]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005d736
jmp 0x14005d84c
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.140002530
lea rcx, [rsp + 0x48]
call fcn.140002530
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005d9b0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x378]
sub rsp, 0x450
xor edi, edi
mov r15, r8
mov r14, rdx
lea ebx, [rdi + 1]
mov rsi, rcx
mov r13d, edi
mov r12b, bl
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8d, 4
mov rdx, rbx
call fcn.140017784
lea rcx, [rsp + 0x20]
mov edx, 4
mov r8d, 0x18ee
call fcn.140055230
lea rdx, str.FILE
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x24], dil
call fcn.1400177c0
test eax, eax
jne 0x14005db77
mov r9, qword [rsi]
lea edx, [rax + 4]
lea rcx, [rbp + 0x398]
mov r8, rbx
add r13d, ebx
call fcn.140017784
mov edi, dword [rbp + 0x398]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov edx, 1
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140017784
lea r8d, [rdi + 0xb33f]
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.140055230
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140014e5c
mov r9, qword [rsi]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rbp + 0x398]
call fcn.140017784
mov edi, dword [rbp + 0x398]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov edx, 1
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140017784
lea r8d, [rdi + 0xf479]
lea rcx, [rsp + 0x30]
mov edx, ebx
call fcn.140055230
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor edi, edi
mov rcx, r15
mov word [rsp + r11*2 + 0x30], di
call fcn.140014e5c
lea rcx, [rbp + 0x140]
mov rdx, r14
call fcn.140015770
test eax, eax
je 0x14005dba9
lea rdx, [0x140098690]
mov rcx, r14
call fcn.140015770
test eax, eax
jne 0x14005db34
test r13d, r13d
je 0x14005dba9
mov rcx, qword [rsi]
mov ebx, 1
mov r8d, ebx
mov edx, ebx
call fcn.140017be0
mov r9, qword [rsi]
lea edx, [rbx + 3]
lea rcx, [rsp + 0x28]
mov r8d, ebx
call fcn.140017784
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, ebx
mov dword [rsp + 0x28], edx
add edx, 0x18
call fcn.140017be0
jmp 0x14005db7a
mov r12b, dil
cmp r12b, bl
je 0x14005d9ea
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor eax, eax
jmp 0x14005db88
Function at 0x14005dbb0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6d0
xor edi, edi
mov rbx, rdx
mov edx, dword [rcx + 8]
mov r14, rcx
mov rcx, qword [rcx]
mov r15, r8
lea r13d, [rdi + 1]
xor r8d, r8d
mov r12, r9
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x24], r13d
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], di
mov word [rbp + 0x172], di
mov qword [rbp + 0x3a0], rdi
call fcn.140017be0
lea r8, [rbp + 0x3c0]
mov rdx, rbx
mov rcx, r14
call fcn.14005d9b0
test eax, eax
je 0x14005dc4e
lea eax, [rdi + 6]
jmp 0x14005ddae
mov r9, qword [r14]
lea rcx, [rbp + 0x600]
mov r8, r13
mov rdx, r13
call fcn.140017784
mov r9, qword [r14]
mov edi, 4
lea rcx, [rsp + 0x20]
mov edx, edi
mov r8, r13
call fcn.140017784
mov esi, dword [rsp + 0x20]
mov r9, qword [r14]
lea rcx, [rsp + 0x20]
mov ebx, 0x87bc
mov r8, r13
mov edx, edi
xor esi, ebx
call fcn.140017784
mov r11d, dword [rsp + 0x20]
mov r9, qword [r14]
xor r11d, ebx
lea rcx, [rsp + 0x20]
mov r8, r13
mov edx, edi
mov dword [r12], r11d
call fcn.140017784
mov edi, dword [rsp + 0x20]
mov rcx, qword [r14]
mov r8d, r13d
mov edx, reloc.WSOCK32.dll_recv
xor edi, 0xa685
call fcn.140017be0
mov ecx, dword [r12]
call fcn.140015c58
movsxd rbx, esi
mov rcx, rbx
mov r12, rax
call fcn.140015c58
mov r9, qword [r14]
mov r8d, 1
mov rcx, rax
mov rdx, rbx
mov r13, rax
call fcn.140017784
mov r8d, dword [r14 + 0xc]
mov edx, esi
add r8d, 0x2477
mov rcx, r13
call fcn.140055230
lea rcx, [rsp + 0x24]
mov r8d, esi
mov rdx, r13
call fcn.140039870
cmp edi, dword [rsp + 0x24]
je 0x14005dd3f
mov rcx, r12
call fcn.140015e78
mov rcx, r13
call fcn.140015e78
mov eax, 0xa
jmp 0x14005ddae
cmp byte [rbp + 0x600], 1
jne 0x14005dd9e
xor eax, eax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], ax
mov word [rbp + 0x172], ax
mov qword [rbp + 0x3a0], rax
call fcn.140055430
mov rcx, r13
call fcn.140015e78
jmp 0x14005dda9
mov rcx, r12
call fcn.140015e78
mov r12, r13
mov qword [r15], r12
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14005ebc0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rbx, rdx
lea rdx, [rbp + 0x180]
mov dil, r8b
call fcn.140013350
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140013350
lea rcx, [rbp + 0x180]
call fcn.14003b2f0
xor ebx, ebx
test al, al
jne 0x14005ec12
xor al, al
jmp 0x14005ed9a
lea rcx, [rsp + 0x70]
call fcn.14003b2f0
test al, al
je 0x14005ecd9
test dil, dil
je 0x14005ec0b
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, [rbp + 0x180]
test eax, eax
jne 0x14005ec77
lea rdx, [rsp + 0x70]
call fcn.140015770
test eax, eax
je 0x14005ec70
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x14005ed9a
mov al, 1
jmp 0x14005ed9a
lea rax, [rbp + 0x390]
lea r9, [rbp + 0x5a0]
lea r8, [rbp + 0x7b0]
lea rdx, [rbp + 0x9e8]
mov qword [rsp + 0x20], rax
call fcn.1400161cc
lea rdx, [0x1400959cc]
lea rcx, [rsp + 0x70]
call fcn.140014e30
lea rdx, [rbp + 0x5a0]
lea rcx, [rsp + 0x70]
call fcn.140014e30
cmp word [rbp + 0x390], bx
je 0x14005ecd9
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x70]
call fcn.140014e30
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
call fcn.14003b240
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x180]
test al, al
je 0x14005ed1f
mov r8b, 1
call fcn.140055f90
test al, al
je 0x14005ec0b
lea rcx, [rbp + 0x180]
mov dl, 1
call fcn.140055ee0
test al, al
jmp 0x14005ec68
call fcn.140015770
test eax, eax
je 0x14005ec0b
lea rcx, [rbp + 0x180]
call fcn.140014a74
lea rcx, [rsp + 0x70]
mov word [rbp + rax*2 + 0x182], bx
call fcn.140014a74
lea rcx, [rsp + 0x30]
mov word [rsp + rax*2 + 0x72], bx
lea rax, [rbp + 0x180]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], rax
mov eax, 0x614
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0xac0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14005f270
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edi, r8d
call fcn.14004dac0
lea rcx, [rsp + 0x20]
call fcn.140056a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsp + 0x40], 0
mov word [rsp + 0x44], 0
call fcn.14005efe0
lea rdx, [rbx + 0x18]
mov rcx, rbx
call fcn.14004d630
test edi, edi
je 0x14005f2d6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400569c0
dec edi
jne 0x14005f2c5
lea rdx, [rbx + 0x18]
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.14004d3f0

Function at 0x14005f390
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rax, r8
mov r12, rdx
mov r8b, 1
mov rdx, rax
mov rbx, rcx
mov qword [rcx + 0x28], rax
call fcn.14003c200
xor r13d, r13d
cmp byte [rbx + 8], 1
mov bpl, r13b
mov dword [rsp + 0x50], r13d
mov word [rsp + 0x54], r13w
jne 0x14005f3f9
xor r8d, r8d
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.14003c400
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov bpl, al
call fcn.14004d860
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.14003c4a0
mov edi, r13d
movsxd rdx, edi
mov rcx, r12
call fcn.14003dd50
movzx esi, word [rax]
test si, si
je 0x14005f435
mov rcx, rbx
inc edi
call fcn.14004d2c0
mov r8d, 1
movzx edx, si
mov rcx, rbx
call fcn.14005f300
mov dword [rbx + 0x18], r13d
mov word [rbx + 0x1c], r13w
jmp 0x14005f3fc
cmp byte [rbx + 8], 1
jne 0x14005f455
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14004d630
mov r8b, bpl
mov dl, reloc.WSOCK32.dll_sendto
mov rcx, rbx
call fcn.14003c400
mov rdx, qword [rbx + 0x28]
xor r8d, r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14003c200
Function at 0x140061eb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [rdx]
mov r12, rcx
lea rcx, [rbp + 0x20]
mov esi, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov r11d, dword [rbp + 0x20]
mov eax, dword [rbp + 0x24]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov dword [rdi + 0x294], r11d
mov dword [rdi + 0x298], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x24]
cmp eax, dword [rdi + 0x29c]
jne 0x140061f19
cmp ecx, dword [rdi + 0x2a0]
je 0x140061f41
mov dword [rdi + 0x29c], eax
mov dword [rdi + 0x2a0], ecx
cmp esi, 1
jl 0x140061f41
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, r12
mov edx, 0xfffffff5
call fcn.14005c910
mov ecx, dword [r12 + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [r12 + 0x1c]
movzx r13d, ax
shr r13d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r13d, dword [rdi + 0x2a4]
je 0x140061fe7
cmp esi, 1
jl 0x140061fe7
cmp byte [rdi + 0x2e0], 0
je 0x140061fe7
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, r12
mov dword [rsp + 0x20], eax
test r13d, r13d
je 0x140061f99
mov edx, 0xfffffff9
jmp 0x140061fdb
mov edx, 0xfffffff8
call fcn.14005c910
cmp byte [rdi + 0x2ac], 0
je 0x140061fe0
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rbp + 0x24]
mov rcx, r12
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140061fdb
mov edx, 0xfffffff4
call fcn.14005c910
mov byte [rdi + 0x2ac], 0
test esi, esi
je 0x140061ff2
mov dword [rdi + 0x2a4], r13d
cmp ebx, dword [rdi + 0x2a8]
je 0x140062023
cmp esi, 1
jl 0x140062023
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, r12
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x14006201e
mov edx, 0xfffffff6
call fcn.14005c910
test esi, esi
je 0x14006202d
mov dword [rdi + 0x2a8], ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rbp
ret
Function at 0x140063b80
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb0
mov r12, rcx
lea rcx, [rbp - 0x61]
mov edi, r9d
mov rbx, r8
mov r15b, dl
call fcn.14000e080
xor eax, eax
lea rcx, [rbp - 0x41]
xor edx, edx
lea r13d, [rax + 1]
lea r8d, [rax + 0x70]
mov r14d, eax
mov dword [rbp + 0x77], r13d
mov esi, eax
call fcn.140015500
cmp edi, 2
jb 0x140063c07
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.14005e670
xor ecx, ecx
cmp word [rax], cx
je 0x140063c07
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 8]
call fcn.14005e670
mov rcx, rax
call fcn.1400133a0
mov r14, rax
cmp edi, 3
jb 0x140063c24
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.14005e670
mov rcx, rax
call fcn.1400133a0
mov rsi, rax
cmp edi, 4
jb 0x140063c69
mov rcx, qword [rbx + 8]
mov rcx, qword [rcx + 0x18]
call fcn.14005e670
xor ecx, ecx
cmp word [rax], cx
je 0x140063c69
mov rax, qword [rbx + 8]
mov r13, qword [rax + 0x18]
mov rcx, r13
call fcn.140054fd0
test al, al
jne 0x140063c65
mov rcx, r13
call fcn.14000fb50
lea rcx, [rbp - 0x61]
mov rdx, rax
call fcn.1400108f0
mov r13d, dword [rbp + 0x77]
cmp edi, 5
jb 0x140063c7f
mov rax, qword [rbx + 8]
mov rcx, qword [rax + 0x20]
call fcn.14000eb40
movzx r13d, ax
mov edi, WSACleanup
lea rcx, [rbp - 0x41]
xor edx, edx
mov r8d, edi
call fcn.140015500
mov rax, qword [rbp - 0x61]
mov dword [rbp - 0x41], edi
mov qword [rbp - 0x31], rax
mov rax, qword [rbx + 8]
mov dword [rbp - 0x3d], 0x40
xor edi, edi
mov qword [rbp - 0x39], rdi
mov rcx, qword [rax]
call fcn.14005e670
lea rcx, [rbp - 0x41]
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x19], rsi
mov dword [rbp - 0x11], r13d
mov qword [rbp - 0x29], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ebx, eax
test r14, r14
je 0x140063cdf
mov rcx, r14
call fcn.140014a90
test rsi, rsi
je 0x140063cec
mov rcx, rsi
call fcn.140014a90
test ebx, ebx
jne 0x140063d1b
mov rax, qword [r12]
lea esi, [rbx + 1]
xor r8d, r8d
movsxd rcx, dword [rax + 4]
mov edx, esi
add rcx, r12
call fcn.14000dfd0
mov rbx, qword [rbp + 0x7f]
mov rcx, rbx
call fcn.1400077c0
mov dword [rbx + 8], esi
mov dword [rbx], edi
jmp 0x140063d53
test r15b, r15b
je 0x140063d2e
mov rax, qword [rbp + 0x27]
mov qword [r12 + 0x7a8], rax
jmp 0x140063d53
mov rbx, qword [rbp + 0x7f]
mov rcx, rbx
call fcn.1400077c0
mov rcx, qword [rbp + 0x27]
mov esi, 1
mov dword [rbx + 8], esi
mov dword [rbx], esi
test rcx, rcx
je 0x140063d53
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x61]
call fcn.140002530
lea r11, [rsp + 0xb0]
xor eax, eax
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140063ef0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x1f78]
mov eax, 0x2060
call fcn.1400244c0
sub rsp, rax
mov r12, rcx
lea rcx, [rsp + 0x20]
call fcn.14000e080
lea rcx, [rsp + 0x40]
call fcn.14000e080
mov rcx, r12
call fcn.14005e670
xor r13d, r13d
movzx edx, word [rax]
mov rsi, rax
mov dil, r13b
mov ebx, r13d
test dx, dx
je 0x140064079
lea r14d, [r13 + 0x25]
inc rbx
cmp dx, r14w
jne 0x14006402b
cmp word [rsi + rbx*2], r14w
jne 0x140063f83
lea rcx, [rsp + 0x20]
mov edx, r14d
mov dil, 1
call fcn.140003f10
inc rbx
jmp 0x140064035
lea rdx, [0x140095070]
lea rcx, [rsp + 0x40]
call fcn.14000e8f0
jmp 0x140063fad
test r11w, r11w
je 0x140063fb8
lea rcx, [rsp + 0x40]
movzx edx, r11w
call fcn.140003f10
inc rbx
movzx r11d, word [rsi + rbx*2]
cmp r11w, r14w
jne 0x140063f96
cmp word [rsi + rbx*2], r13w
je 0x140064044
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
inc rbx
mov word [rsp + 0x60], r13w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
test eax, eax
je 0x140063ffa
lea rdx, [rsp + 0x60]
call fcn.14000fa60
mov dil, 1
jmp 0x140064035
lea rdx, [0x14009cb34]
mov dil, 1
call fcn.14000fa60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400047d0
lea rdx, [0x14009cb34]
lea rcx, [rsp + 0x20]
call fcn.14000fa60
jmp 0x140064035
lea rcx, [rsp + 0x20]
call fcn.140003f10
movzx edx, word [rsi + rbx*2]
test dx, dx
jne 0x140063f57
jmp 0x140064067
lea rdx, [0x14009cb34]
lea rcx, [rsp + 0x20]
mov dil, 1
call fcn.14000fa60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400047d0
test dil, dil
je 0x140064079
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140010fc0
lea rcx, [rsp + 0x40]
call fcn.140002530
lea rcx, [rsp + 0x20]
call fcn.140002530
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret