joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movzx eax, word [0x140111c18]
xor ebp, ebp
mov word [rsp + 0x22], ax
mov eax, 0x7b
mov dword [rsp + 0x48], eax
mov ebx, SafeArrayAllocDescriptor
mov word [rsp + 0x20], bx
mov r10, r8
mov dword [rsp + 0x24], 0x90028
mov rsi, rdx
mov dword [rsp + 0x28], 0x3e003c
mov r11, rcx
mov dword [rsp + 0x2c], 0x3d003a
mov dword [rsp + 0x30], 0x2d002b
mov dword [rsp + 0x34], 0x2f002a
mov dword [rsp + 0x38], 0x7e0021
mov dword [rsp + 0x3c], 0x7c0026
mov dword [rsp + 0x40], 0x5b005e
mov dword [rsp + 0x44], 0x3f002e
test r8, r8
je 0x14003f988
movzx edx, word [r8]
test dx, dx
je 0x14003f99d
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
movzx eax, bx
cmp dx, ax
je 0x14003f98b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14003f968
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14003f960
mov r8, rbp
test r8, r8
je 0x14003f99d
cmp r8, r10
lea rbx, [r8 - 2]
cmovbe rbx, r8
jmp 0x14003f9b6
mov rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], bp
jne 0x14003f9a4
lea rbx, [r10 - 2]
lea rbx, [rbx + rax*2]
cmp rbx, r10
jbe 0x14003f9d8
nop dword [rax + rax]
movzx eax, word [rbx]
cmp ax, 0x20
je 0x14003f9cf
cmp ax, 9
jne 0x14003f9d8
sub rbx, 2
cmp rbx, r10
ja 0x14003f9c0
mov rdi, rbx
sub rdi, r10
sar rdi, 1
inc rdi
cmp rdi, 0xfd
jbe 0x14003fa08
test r9b, r9b
je 0x14003fa04
mov r8, r10
lea rdx, str.This_line_does_not_contain_a_recognized_action.
mov rcx, r11
call fcn.140057630
xor eax, eax
jmp 0x14003fa1e
mov r8, rdi
mov rdx, r10
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rax, rbx
mov word [rsi + rdi*2], bp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140045510
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10040
call fcn.1400d7ad0
sub rsp, rax
mov qword [rsp + 0x20], r9
lea rcx, [rsp + 0x30]
mov r9, r8
mov rbx, rdx
lea r8, [0x1400f6ce0]
mov edx, 0x8001
call fcn.1400ba350
lea rcx, [rsp + 0x30]
movsxd rdi, eax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400455a5
test al, 0x10
je 0x1400455a5
lea ecx, [rdi + 0xfd]
movsxd rcx, ecx
lea rcx, [rcx*4 + 0x14]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbx], rax
test rax, rax
je 0x1400455a5
lea ecx, [rdi + 1]
movsxd r8, ecx
lea rdx, [rsp + 0x30]
add r8, r8
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbx + 8], rdi
mov rbx, qword [rsp + 0x10050]
add rsp, 0x10040
pop rdi
ret
lea rax, [0x1400da7a4]
mov qword [rbx], rax
mov rbx, qword [rsp + 0x10050]
add rsp, 0x10040
pop rdi
ret
Function at 0x140056390
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
lea r8, str.Script_lines_most_recently_executed__oldest_first_.__Press__F5__to_refresh.__The_seconds_elapsed_between_a_line_and_the_one_after_it_is_in_parentheses_to_the_right__if_not_0_.__The_bottommost_lines_elapsed_time_is_the_number_of_seconds_since_it_executed._r_n_r_n
mov edx, 0xfffe
call fcn.1400ba350
mov r9, qword [rsp + 0x80]
lea r10, [0x140000000]
mov r8d, dword [0x140114ae0]
mov ebp, 0x190
movsxd rdx, eax
mov r11d, 2
mov dword [rsp + 0x88], 0xffffffff
mov eax, r8d
lea rcx, [r9 + rdx*2]
mov qword [rsp + 0x98], rcx
nop dword [rax + rax]
xor r13b, r13b
mov r12, rcx
test ebp, ebp
jle 0x1400565d4
mov edx, ebp
mov esi, r11d
mov qword [rsp + 0x90], rdx
movsxd rcx, eax
nop
cmp eax, 0x190
lea rdi, [rcx - 0x190]
lea r14d, [rax - 0x190]
cmovl rdi, rcx
cmovl r14d, eax
cmp qword [r10 + rdi*8 + 0x115130], 0
je 0x1400565a9
movzx r15d, r13b
lea eax, [rsi - 1]
xor r13b, r13b
cmp eax, ebp
jge 0x1400564d4
test r15b, r15b
jne 0x1400565a9
mov r8d, dword [r10 + rdi*4 + 0x114af0]
lea eax, [r14 + 1]
xor edx, edx
lea rcx, [rdi + 1]
cmp eax, 0x190
cmovl rdx, rcx
mov ebx, dword [r10 + rdx*4 + 0x114af0]
sub ebx, r8d
cmp ebx, 0x7fffffff
jbe 0x1400564f3
mov r13b, 1
cmp esi, ebp
jne 0x1400564af
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x114af0]
jmp 0x1400564eb
lea rax, [rdi + 2]
mov rcx, 0xfffffffffffffe72
cmp rax, 0x190
cmovl rcx, r11
add rcx, rdi
mov ebx, dword [r10 + rcx*4 + 0x114af0]
sub ebx, r8d
jmp 0x1400564f3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
lea r10, [0x140000000]
sub ebx, dword [r10 + rdi*4 + 0x114af0]
mov r9, qword [rsp + 0x80]
mov rcx, qword [r10 + rdi*8 + 0x115130]
movzx eax, word [rcx + 2]
cmp dword [rsp + 0x88], eax
je 0x140056551
mov ecx, eax
mov dword [rsp + 0x88], eax
mov edx, 0xfffe
lea r8, str.______s_r_n
mov rax, r12
sub rax, r9
mov r9, qword [0x140114ac0]
sar rax, 1
sub edx, eax
mov r9, qword [r9 + rcx*8]
mov rcx, r12
call fcn.1400ba350
movsxd rcx, eax
lea r12, [r12 + rcx*2]
lea rcx, [0x140000000]
mov rcx, qword [rcx + rdi*8 + 0x115130]
mov r8d, 0xc8
mov byte [rsp + 0x28], r15b
mov r9d, 0xfffe
mov dword [rsp + 0x20], ebx
mov rax, r12
mov rdx, r12
sub rax, qword [rsp + 0x80]
sar rax, 1
sub r9d, eax
cmp r9d, r8d
cmovl r8d, r9d
mov r9b, 1
call fcn.140056630
mov rdx, qword [rsp + 0x90]
lea r10, [0x140000000]
mov r9, qword [rsp + 0x80]
mov r12, rax
mov r11d, 2
inc esi
lea eax, [r14 + 1]
sub rdx, 1
lea rcx, [rdi + 1]
mov qword [rsp + 0x90], rdx
jne 0x140056420
mov r8d, dword [0x140114ae0]
mov rcx, qword [rsp + 0x98]
mov rax, r12
mov edx, 0xfffe
sub rax, r9
sar rax, 1
sub edx, eax
cmp edx, 0x18
jg 0x140056600
cmp ebp, 0x78
jl 0x140056600
sub ebp, 0x64
mov eax, r8d
sub eax, ebp
add eax, 0x190
jmp 0x140056400
lea r8, str._r_nPress__F5__to_refresh.
mov rcx, r12
call fcn.1400ba350
movsxd rcx, eax
lea rax, [r12 + rcx*2]
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140057f50
Capabilities:
Print debug messages

Disassembly:
test edx, edx
je 0x1400580ab
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x4030
call fcn.1400d7ad0
sub rsp, rax
mov qword [rsp + 0x4050], rbx
mov rbp, r9
mov rbx, qword [rsp + 0x4070]
mov r14, r8
mov qword [rsp + 0x4058], r15
mov esi, edx
mov rdi, rcx
test rbx, rbx
jne 0x140057fb1
mov rbx, qword [rcx + 0x6d0]
test rbx, rbx
jne 0x140057fb1
mov ecx, dword [rcx + 0x288]
movzx eax, word [rdi + 0x28c]
jmp 0x140057fb9
movzx ecx, word [rbx + 2]
movzx eax, word [rbx + 4]
mov r9, qword [0x140114ac0]
lea r8, str._s___d__:___Warning:__s_n
movsxd rcx, ecx
mov r15d, 0x2000
movzx eax, ax
mov edx, r15d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], eax
mov r9, qword [r9 + rcx*8]
lea rcx, [rsp + 0x30]
call fcn.1400ba350
cmp word [rbp], 0
movsxd rcx, eax
je 0x140058015
sub r15d, ecx
lea rax, [rsp + 0x30]
lea rcx, [rax + rcx*2]
mov edx, r15d
mov r9, rbp
lea r8, str._____Specifically:__s_n
call fcn.1400ba350
mov r15, qword [rsp + 0x4058]
lea rdx, [rsp + 0x30]
cmp esi, 3
jne 0x14005803b
lea r9, [0x1400f44c4]
xor r8d, r8d
mov rcx, rdi
call fcn.140056fb0
jmp 0x140058090
lea rcx, [0x140112950]
call fcn.14000c8d0
test al, al
jne 0x140058056
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp esi, 2
jne 0x140058090
test rbx, rbx
jne 0x14005807c
mov rbx, qword [rdi + 0x6d0]
test rbx, rbx
jne 0x14005807c
mov r8, rbp
mov rdx, r14
mov rcx, rdi
call fcn.140057630
jmp 0x140058090
mov r9, rbp
mov r8d, 1
mov rdx, r14
mov rcx, rbx
call fcn.1400571b0
mov rbx, qword [rsp + 0x4050]
mov rbp, qword [rsp + 0x4060]
add rsp, 0x4030
pop r14
pop rdi
pop rsi
ret
Function at 0x14005d0f0
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
push r14
push r15
sub rsp, 0x140
movsxd rax, dword [rcx]
movzx r12d, r9b
mov ebx, r8d
mov r15, rdx
mov r14, rcx
cmp eax, 6
ja case.0x14005d12d.1
lea rcx, [0x140000000]
mov r10d, dword [rcx + rax*4 + 0x5d31c]
add r10, rcx
jmp r10
lea rax, str.Timeout
jmp 0x14005d161
lea rax, str.Match
jmp 0x14005d161
mov qword [rsp + 0x168], rsi
mov rsi, r15
test r15, r15
jne 0x14005d177
lea rax, str.EndKey
mov rsi, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x178]
add rsp, 0x140
pop r15
pop r14
pop r12
ret
test r12b, r12b
je 0x14005d18d
movups xmm0, xmmword [str.EndKey:]
lea rsi, [rdx + 0xe]
sub ebx, 7
movups xmmword [rdx], xmm0
movzx eax, word [r14 + 0x6a]
mov qword [rsp + 0x160], rbp
test ax, ax
je 0x14005d1ad
xor ebp, ebp
mov word [rsi], ax
mov word [rsi + 2], bp
jmp 0x14005d2ce
cmp byte [r14 + 0x6d], 0
je 0x14005d244
xor edx, edx
mov qword [rsp + 0x170], rdi
mov r8d, 0x100
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov byte [rsp + 0x50], 0x80
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, rax
call fcn.140021890
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx ecx, byte [r14 + 0x66]
xor ebp, ebp
mov ebx, ebp
mov rdi, rax
cmp dword [0x1401138ac], ebx
setne bl
xor edx, edx
call fcn.140022cc0
movzx ecx, byte [r14 + 0x66]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov r9, rsi
movzx edx, ax
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rdi, qword [rsp + 0x170]
movsxd rcx, eax
mov word [rsi + rcx*2], bp
jmp 0x14005d2ce
xor ebp, ebp
movzx ecx, bp
mov word [rsi], bp
cmp byte [r14 + 0x6c], cl
je 0x14005d268
movzx ecx, word [r14 + 0x68]
xor r9d, r9d
mov r8d, ebx
mov rdx, rsi
call fcn.140021ba0
movzx ecx, word [rsi]
test cx, cx
jne 0x14005d2b3
test r12b, r12b
je 0x14005d27a
mov ecx, ebp
cmp byte [r14 + 0x6c], cl
jne 0x14005d295
cmp byte [r14 + 0x6c], bpl
mov r8d, ebx
movzx ecx, byte [r14 + 0x66]
mov rdx, rsi
sete r9b
call fcn.140021c50
movzx ecx, word [rsi]
test cx, cx
jne 0x14005d2b3
movzx r9d, word [r14 + 0x68]
lea r8, str.sc_03X
mov edx, ebx
mov rcx, rsi
call fcn.1400ba350
movzx ecx, word [rsi]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14005d2ce
cmp word [rsi + 2], bp
jne 0x14005d2ce
test r12b, r12b
je 0x14005d2ce
sub cx, 0x20
mov word [rsi], cx
mov rbp, qword [rsp + 0x160]
lea rax, str.EndKey
test r12b, r12b
cmovne rax, r15
jmp 0x14005d159
lea rax, [0x1400f42b8]
jmp 0x14005d161
lea rax, str.NewInput
jmp 0x14005d161
lea rax, str.Stopped
jmp 0x14005d161
lea rax, [0x1400da7a4]
jmp 0x14005d161
Function at 0x14005ef20
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
mov rbp, rcx
call fcn.14006ec50
mov rdi, rax
test rax, rax
je 0x14005f04a
mov rdx, rbx
mov rcx, rax
call fcn.1400c0fc0
mov rsi, rax
test rax, rax
je 0x14005f04a
xor edx, edx
mov rcx, rdi
xor bpl, bpl
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
test eax, eax
je 0x14005efbf
cmp eax, dword [0x140116f80]
je 0x14005efbf
mov rcx, rdi
call fcn.1400c15c0
test al, al
jne 0x14005efbf
mov ecx, dword [0x140116f80]
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bpl
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x14005f02d
mov rcx, qword [0x140113a28]
lea rdx, [0x1400da884]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400befb0
mov rax, qword [0x1401101f0]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14005f02d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140116f80], eax
je 0x14005f019
mov rax, qword [0x1401101f0]
mov ecx, dword [rax + 0x78]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005f02d
mov rcx, qword [0x1401101f0]
mov edx, 1
mov ecx, dword [rcx + 0x78]
call fcn.140001b10
test bpl, bpl
je 0x14005f043
mov ecx, dword [0x140116f80]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
jmp 0x14005f08d
mov rax, qword [0x1401101f0]
lea rdx, [0x1400f11dc]
test byte [rax + 0x140], 1
jne 0x14005f07b
mov rcx, qword [0x140113a28]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400befb0
jmp 0x14005f08d
lea r9, [0x1400da7a4]
xor r8d, r8d
mov rcx, rbp
call fcn.140056cc0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14005fbd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x68]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov rbx, rdx
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, r11
call fcn.14006ec50
test rax, rax
je 0x14005fc16
lea rdx, str.msctls_statusbar321
mov rcx, rax
call fcn.1400c0fc0
mov rdi, rax
jmp 0x14005fc18
xor edi, edi
mov rcx, rbx
call fcn.1400056a0
mov rcx, rbx
test al, al
je 0x14005fc35
xor edx, edx
lea r8d, [rdx + 0x10]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstol]
jmp 0x14005fc3b
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov rcx, qword [0x140115db0]
lea r9, [0x1400da7a4]
mov dword [rsp + 0x68], getservbyname
mov r8d, eax
mov rdx, rdi
mov dword [rsp + 0x60], 0xffffffff
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400c0c00
Function at 0x140060d40
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rsp + 0x60]
mov rbx, qword [0x140115db0]
mov qword [rsp + 0x20], rax
call fcn.14006ec50
mov rsi, rax
mov ebp, 1
test rax, rax
je 0x140060d85
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
jmp 0x140060d87
mov edi, ebp
lea eax, [rdi - 1]
mov byte [rsp + 0x20], bpl
movsxd r8, eax
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call fcn.1400befb0
cmp eax, ebp
je 0x140060daa
xor eax, eax
jmp 0x140060ebd
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1400017c0
test rsi, rsi
je 0x140060e57
mov r8d, edi
mov qword [rsp + 0x40], r14
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp byte [rbx + 0x23], 0
movsxd r14, eax
jne 0x140060de3
mov rsi, qword [rbx + 0x10]
jmp 0x140060de6
mov rsi, rbx
lea rdi, [0x1401195c0]
cmp byte [rsi + 0x23], bpl
jne 0x140060e07
test byte [rsi + 0x21], 8
je 0x140060e01
mov rcx, rsi
call fcn.140001670
add rsi, 0x10
jmp 0x140060e0a
mov rsi, rdi
lea rax, [r14 + r14]
mov r14, qword [rsp + 0x40]
mov qword [rsi], rax
cmp byte [rbx + 0x23], 0
jne 0x140060e22
mov rsi, qword [rbx + 0x10]
jmp 0x140060e25
mov rsi, rbx
cmp byte [rsi + 0x23], bpl
jne 0x140060e3d
test byte [rsi + 0x21], 8
je 0x140060e39
mov rcx, rsi
call fcn.140001670
lea rdi, [rsi + 0x10]
cmp qword [rdi], 2
jae 0x140060e8d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1400017c0
xor esi, esi
mov word [rax], si
jmp 0x140060e8d
mov word [rax], si
cmp byte [rbx + 0x23], sil
jne 0x140060e66
mov rdi, qword [rbx + 0x10]
jmp 0x140060e69
mov rdi, rbx
cmp byte [rdi + 0x23], bpl
jne 0x140060e83
test byte [rdi + 0x21], 8
je 0x140060e7d
mov rcx, rdi
call fcn.140001670
add rdi, 0x10
jmp 0x140060e8a
lea rdi, [0x1401195c0]
mov qword [rdi], rsi
cmp byte [rbx + 0x23], 0
jne 0x140060e97
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x140060eb7
cmp qword [0x140117c50], 0
je 0x140060eb7
lea rcx, [0x140117c38]
call fcn.1400070e0
mov ebp, eax
jmp 0x140060ebb
and byte [rbx + 0x21], 0x86
mov eax, ebp
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140060f50
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
mov eax, 0x11cf0
call fcn.1400d7ad0
sub rsp, rax
xor eax, eax
mov byte [rsp + 0x1889], 1
mov rbx, rcx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x188c], eax
lea rcx, [0x1400da7a4]
mov qword [rsp + 0x18a0], rax
cmp edx, 6
mov rdx, qword [0x1401101f0]
xorps xmm0, xmm0
mov dword [rsp + 0x18a8], eax
mov qword [rsp + 0x18b0], rax
mov qword [rsp + 0x18c8], rax
cmove rax, rbx
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x11d28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x11d20]
mov qword [rsp + 0x1048], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
movdqa xmmword [rsp + 0x1890], xmm0
call fcn.1400c1890
test eax, eax
je 0x140061001
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c09a0]
call qword [sym.imp.USER32.dll_EnumWindows]
movsxd rdx, dword [rsp + 0x188c]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400015d0
mov eax, 1
add rsp, 0x11cf0
pop rbx
ret

Function at 0x140061f60
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
mov eax, 0x10030
call fcn.1400d7ad0
sub rsp, rax
mov rbx, qword [0x140115db0]
mov rbp, rdx
mov rcx, rbp
lea rdx, [rsp + 0x30]
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov byte [rsp + 0x20], 1
mov rcx, rbx
mov esi, eax
cmp eax, 0x7fff
jb 0x140062042
lea r8d, [rsi - 1]
mov r9b, 1
xor edx, edx
call fcn.1400befb0
test eax, eax
je 0x14006205f
mov qword [rsp + 0x10040], rdi
xor r8d, r8d
mov edi, 1
mov rcx, rbx
mov edx, edi
call fcn.1400017c0
mov rdx, rax
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140062000
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1400017c0
xor ecx, ecx
mov word [rax], cx
cmp byte [rbx + 0x23], 0
jne 0x14006200a
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x140062032
cmp qword [0x140117c50], 0
je 0x140062032
lea rcx, [0x140117c38]
call fcn.1400070e0
mov edi, eax
mov rdi, qword [rsp + 0x10040]
jmp 0x14006205f
and byte [rbx + 0x21], 0x86
mov eax, edi
mov rdi, qword [rsp + 0x10040]
jmp 0x14006205f
test esi, esi
lea rax, [0x1400da7a4]
lea rdx, [rsp + 0x30]
mov r8, rsi
cmove rdx, rax
xor r9d, r9d
call fcn.1400befb0
lea r11, [rsp + 0x10030]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rsi
ret
Function at 0x140065270
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x250
mov rbp, r9
mov qword [rsp + 0x20], r8
mov r9, qword [0x140117b80]
mov r15, r8
lea r8, str.__s_s
mov edx, 0x800
mov r14, rcx
call fcn.1400ba350
movsxd rbx, eax
lea edi, [rbx + 1]
cmp edi, 0x800
jg 0x1400652ff
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400652ff
movsxd rax, edi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
xor edi, edi
mov rcx, qword [rsp + 0x290]
mov word [r14 + rax*2], di
mov rax, qword [0x140117b80]
mov qword [rcx], rax
mov al, 1
jmp 0x14006549a
xor edi, edi
mov esi, edi
mov r9d, esi
lea rax, [rsp + 0x30]
or r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAutoHotkey
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006547f
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x278]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x40]
mov dword [rsp + 0x278], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14006547f
mov eax, dword [rsp + 0x278]
test eax, eax
je 0x14006547f
shr eax, 1
mov r8d, eax
dec eax
mov edx, eax
mov dword [rsp + 0x278], eax
cmp word [rsp + rax*2 + 0x40], di
jne 0x1400653c8
test eax, eax
je 0x140065486
dec edx
cmp word [rsp + rdx*2 + 0x40], di
jne 0x1400653e6
mov dword [rsp + 0x278], edx
mov eax, edx
test edx, edx
jne 0x1400653b0
jmp 0x1400653e6
mov dword [rsp + 0x278], r8d
cmp r8d, 0x104
jae 0x14006547f
mov word [rsp + r8*2 + 0x40], di
mov eax, r8d
test eax, eax
je 0x140065486
test rbp, rbp
je 0x140065421
lea rcx, [rsp + 0x40]
mov r9, rbp
sub r9, rcx
lea rdx, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx]
mov word [r9 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140065410
test eax, eax
je 0x140065498
mov r9, rbp
mov qword [rsp + 0x20], r15
lea r8, str.__s_s
mov edx, 0x800
mov rcx, r14
call fcn.1400ba350
movsxd rbx, eax
lea esi, [rbx + 1]
cmp esi, 0x800
jg 0x140065498
lea rcx, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140065498
movsxd rax, esi
mov ecx, SafeArrayAllocDescriptor
mov word [r14 + rbx*2], cx
mov word [r14 + rax*2], di
mov rax, qword [rsp + 0x290]
mov qword [rax], rbp
mov al, 1
jmp 0x14006549a
mov word [rsp + 0x40], di
mov eax, edi
test esi, esi
jne 0x1400653ee
mov esi, 0x200
jmp 0x140065303
xor al, al
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400654c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2260
call fcn.1400d7ad0
sub rsp, rax
lea rax, [rsp + 0x2290]
mov r8, rcx
lea rcx, [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
movzx esi, dl
lea rbx, [rsp + 0x1260]
lea rdi, [0x1400da7a4]
call fcn.140065270
test al, al
jne 0x140065514
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x2298], r15
xor r15d, r15d
test sil, sil
je 0x1400655d6
mov rsi, qword [rsp + 0x2290]
lea rax, str.AutoHotkey.exe
mov r9, rsi
mov qword [rsp + 0x2280], rbp
lea r8, str.__s_s
mov qword [rsp + 0x2288], r14
mov edx, 0x800
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x260]
call fcn.1400ba350
movsxd rbp, eax
lea r14d, [rbp + 1]
cmp r14d, 0x800
jg 0x1400655ae
lea rcx, [rsp + 0x262]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400655ae
movsxd rax, r14d
lea rbx, [rsp + 0x260]
mov ecx, SafeArrayAllocDescriptor
mov word [rsp + rbp*2 + 0x260], cx
mov word [rsp + rax*2 + 0x260], r15w
jmp 0x1400655be
cmp rsi, qword [0x140117b80]
jne 0x1400655c6
mov rbx, qword [0x140117b78]
lea rdi, [rsp + 0x1260]
mov rbp, qword [rsp + 0x2280]
mov r14, qword [rsp + 0x2288]
mov qword [rsp + 0x48], r15
lea rcx, [0x140116fb0]
mov byte [rsp + 0x40], r15b
xor r9d, r9d
mov byte [rsp + 0x38], r15b
mov r8, rdi
mov qword [rsp + 0x30], r15
mov rdx, rbx
mov qword [rsp + 0x28], r15
mov byte [rsp + 0x20], r15b
call fcn.140058970
mov r15, qword [rsp + 0x2298]
test eax, eax
setne al
add rsp, 0x2260
pop rdi
pop rsi
pop rbx
ret