joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072eb0
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp dword [0x14022b3f4], 0
mov rbp, rcx
jle 0x140072ef1
lock inc dword [0x14022b3f4]
jmp 0x140072fe3
mov edi, 0x64
mov rcx, qword [0x14022a9e8]
test rcx, rcx
je 0x140072f15
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140072f15
mov rcx, qword [0x14022a9e8]
jmp 0x140072f17
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140072fca
mov eax, edi
dec edi
test eax, eax
jle 0x140072fca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.__Code_u
lea rcx, [rsp + 0x50]
mov ebx, eax
call fcn.1400011a0
and qword [rsp + 0x40], 0
lea r9, [rsp + 0x50]
and qword [rsp + 0x38], 0
lea r8, [0x140175aa0]
and qword [rsp + 0x30], 0
lea rcx, str.OpenClipboard_failed__
and qword [rsp + 0x28], 0
mov rdx, rbp
and qword [rsp + 0x20], 0
call fcn.1401146e0
mov r8b, 1
mov rcx, rax
mov dl, r8b
mov rsi, rax
call fcn.1400296e4
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, ebx
mov rcx, rsi
lea r8d, [r9 + 0x15]
call fcn.140113304
mov ebx, eax
test rsi, rsi
je 0x140072fbd
mov rcx, rsi
call fcn.140113e18
cmp ebx, 4
je 0x140072ef6
xor al, al
jmp 0x140072fe5
lock inc dword [0x14022b3f4]
mov r8b, 1
lea rcx, str.OpenClipboard_succeeded
mov dl, r8b
call fcn.1400296e4
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140073010
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rdi, rdx
mov ebx, ecx
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rsi, rax
test rax, rax
jne 0x14007306a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
lea rdx, str.SetClipboardData_x_04X__x_08X__failed__code_u
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, ebx
call fcn.14000c838
jmp 0x140073081
mov r9d, edi
lea rdx, str.SetClipboardData_x_04X__x_08X__succeeded
mov r8d, ebx
lea rcx, [rsp + 0x30]
call fcn.14000c838
mov r8b, 1
lea rcx, [rsp + 0x30]
mov dl, r8b
call fcn.1400296e4
mov rax, rsi
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400737f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x350], rax
xor ebx, ebx
lea rax, [rsp + 0x40]
mov r9d, 0xf003f
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov dword [rsp + 0x30], ebx
lea rdx, str.Console
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007391e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.FullScreen
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x34]
lea rdx, [0x140178678]
test eax, eax
mov r9d, 0xf003f
lea rax, [rsp + 0x48]
cmovne ecx, ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007390b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.FullScreen
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x30]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x30], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140073913
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
test eax, eax
jne 0x140073930
test r8d, r8d
je 0x14007396a
cmp dword [0x14022aa24], 6
jb 0x14007396a
test eax, eax
lea rdx, str.Warning__nDangerous_values_detected_in_yours_registry_n_nPlease_check__HKEY_CURRENT_USERConsole__and__HKEY_CURRENT_USERConsoleConEmu__keys_n_n_FullScreen__recommended_value_is_dword:00000000_n_nCurrent_value_is_dword:_08X
lea rcx, [rsp + 0x50]
cmovne r8d, eax
call fcn.14000c7e0
or r9, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x50]
lea edx, [r9 + 0x41]
call fcn.1400297d8
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x470]
add rsp, 0x460
pop rbp
ret
Function at 0x14007ab84
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [0x14022a9e0]
test rcx, rcx
je 0x14007ac21
call fcn.140013280
cmp eax, 9
jne 0x14007ac21
cmp byte [rdi + 0xf10], 3
jne 0x14007ac21
cmp dword [0x14022b520], 0
jne 0x14007abcb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x14022b520], eax
jmp 0x14007ac21
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
sub ebx, dword [0x14022b520]
call fcn.140138a6c
mov r8d, eax
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3c
sub r8d, ecx
add r8d, 0x493e0
cmp ebx, r8d
jbe 0x14007ac21
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [0x14022b520], eax
call fcn.1400734a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007f3c0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x418]
sub rsp, 0x510
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x400], rax
cmp byte [rcx + 0x1147c], 0
je 0x14007f63b
mov rcx, qword [0x14022a9e0]
call fcn.140013efc
test al, al
jne 0x14007f63b
mov edi, 0x244
lea rcx, [rbp + 0x1b0]
mov r8d, edi
xor edx, edx
xor ebx, ebx
call fcn.14012d4b0
mov r8d, edi
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14012d4b0
movups xmm0, xmmword [str.clink_]
lea rax, str.clink_x86.dll
xor edi, edi
mov qword [rsp + 0x28], rax
mov esi, 0x122
lea rax, str.clink_dll_x86.dll
mov qword [rsp + 0x30], rax
lea rax, str.clink_x64.dll
mov qword [rsp + 0x38], rax
lea rax, str.clink_dll_x64.dll
mov qword [rsp + 0x40], rax
movdqu xmmword [rsp + 0x50], xmm0
test rbx, rbx
jne 0x14007f550
mov rdx, qword [0x14022a9e0]
lea rcx, [rbp + 0x1b0]
add rdx, 0xef4
call fcn.1400732b8
lea r8, [rsp + 0x50]
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call fcn.140001e48
mov r8, qword [rsp + rdi + 0x28]
lea rcx, [rbp + 0x1b0]
mov rdx, rsi
call fcn.140001e48
xor edx, edx
lea rcx, [rbp + 0x1b0]
call fcn.140115770
test al, al
je 0x14007f532
call fcn.140116890
test al, al
je 0x14007f52d
mov rdx, qword [0x14022a9e0]
lea rcx, [rsp + 0x60]
add rdx, 0xef4
call fcn.1400732b8
lea r8, [rsp + 0x50]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140001e48
mov r8, qword [rsp + rdi + 0x38]
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.140001e48
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140115770
test al, al
je 0x14007f532
lea rbx, [rsp + 0x60]
add rdi, 8
cmp rdi, 0x10
jb 0x14007f47b
test rbx, rbx
jne 0x14007f550
and dword [0x14022b524], ebx
jmp 0x14007f63b
mov eax, dword [0x14022b524]
test eax, eax
jne 0x14007f633
and dword [rsp + 0x20], eax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x14007f585
mov eax, 1
mov dword [0x14022b524], eax
jmp 0x14007f63d
mov rcx, rsi
mov edx, 1
call fcn.140113de8
mov rdi, rax
test rax, rax
je 0x14007f62d
and qword [rsp + 0x28], 0
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14007f625
lea rdx, [0x1401792e8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r9, [rsp + 0x24]
mov dword [rsp + 0x24], 8
lea r8, [rsp + 0x28]
mov rcx, rdi
lea rdx, [rsp + 0x48]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14007f625
mov rax, qword [rsp + 0x28]
mov dword [0x14022b524], 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [0x14022b528], xmm0
movups xmm0, xmmword [rax + 0x20]
mov eax, dword [rax + 0x30]
movups xmmword [0x14022b538], xmm1
mov dword [0x14022b558], eax
movups xmmword [0x14022b548], xmm0
mov rcx, rdi
call fcn.140113e18
mov eax, dword [0x14022b524]
lea ecx, [rax - 1]
cmp ecx, 1
jbe 0x14007f63d
xor eax, eax
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14007febc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
mov ebx, 0x40
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007ff47
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.EnableBalloonTips
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007ff3c
mov eax, dword [rsp + 0x48]
neg eax
sbb ecx, ecx
and ebx, ecx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140080cbc
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, rcx
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
xor r8d, r8d
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140080ebe
xor edx, edx
lea r8d, [rbx + 0x40]
lea rcx, [rsp + 0x70]
call fcn.14012d4b0
cmp byte [0x14022aa1a], bl
je 0x140080e29
mov edi, ebx
lea r14d, [rbx + 0x20]
mov esi, 0x1fc
xor edx, edx
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rbp - 0x50]
mov dword [rsp + 0x44], r14d
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140080e29
mov eax, dword [rsp + 0x44]
inc edi
cmp rax, 0x1f
jae 0x140080daf
add rax, rax
cmp rax, 0x40
jae 0x140080ef2
jmp 0x140080db4
mov eax, 0x3e
mov word [rsp + rax + 0x70], bx
mov eax, dword [rsp + 0x40]
shr rax, 1
cmp rax, 0xfe
jae 0x140080dd9
add rax, rax
cmp rax, 0x1fe
jae 0x140080ef2
jmp 0x140080ddc
mov rax, rsi
mov r8d, 0xa
mov word [rbp + rax - 0x50], bx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.1401358d0
test eax, eax
je 0x140080e22
cmp word [rbp - 0x50], bx
je 0x140080e22
cmp word [rbp - 0x50], 0x2a
lea rax, [rbp - 0x50]
lea rcx, [rbp - 0x4e]
mov rdx, r15
cmovne rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140080eb1
mov edx, edi
jmp 0x140080d4c
mov esi, ebx
lea r14, [rsp + 0x70]
mov eax, 0x30
inc esi
mov word [r14], ax
mov eax, esi
add rax, rax
cmp rax, 0x40
jae 0x140080eec
mov word [rsp + rax + 0x70], bx
lea rdi, [rbp - 0x50]
movzx eax, bx
lea r9, [rsp + 0x48]
mov ecx, 0xff
mov dword [rsp + 0x58], 0x1fe
rep stosw word [rdi], ax
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x70]
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140080eb3
mov rdx, r15
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140080eb1
add r14, 2
cmp esi, 0x14
jb 0x140080e30
jmp 0x140080eb3
mov bl, 1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14012c3e0
int3
call fcn.14012c3e0
int3
Function at 0x140086db8
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, rcx
test rdx, rdx
je 0x140086e3e
cmp word [rdx], si
je 0x140086e3e
lea rdi, [rcx + 0x11948]
mov ecx, 0xf0
mov r8, rdi
sub rdx, rdi
movzx eax, word [rdx + r8]
test ax, ax
je 0x140086e00
mov word [r8], ax
add r8, 2
sub rcx, 1
jne 0x140086de8
test rcx, rcx
lea rax, [r8 - 2]
lea rdx, str.SoftwareConEmu_
cmovne rax, r8
lea rcx, [rbx + 0x11740]
mov word [rax], si
mov word [rbx + 0x11b26], si
call fcn.1400047d8
mov r8, rdi
lea rcx, [rbx + 0x11740]
mov edx, 0x104
call fcn.140001e48
jmp 0x140086e5b
add rcx, 0x11740
lea rdx, str.SoftwareConEmu.Vanilla
call fcn.1400047d8
lea rdi, [rbx + 0x11948]
mov word [rdi], si
mov rdx, rdi
lea rcx, str.ConEmuConfig
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
Function at 0x14008f594
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r13d, r13d
mov rdi, r9
mov rbx, r8
mov rbp, rdx
mov r15, rcx
mov r12b, r13b
mov esi, r13d
test r8, r8
je 0x14008f5d2
mov word [r8], r13w
test r15, r15
je 0x14008f730
cmp word [rcx], r13w
je 0x14008f730
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r13d
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x14008f6fb
lfence
mov ecx, r14d
mov edx, 1
call fcn.140113de8
mov r13, rax
test rax, rax
je 0x14008f6d0
lfence
and qword [rsp + 0x28], rsi
mov r9, rax
and dword [rsp + 0x20], esi
mov r8d, r14d
xor edx, edx
mov rcx, r15
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14008f6a4
lfence
lea rdx, [0x1401792e8]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea r9, [rsp + 0x20]
mov rcx, r13
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x14008f68e
mov r8d, dword [rsp + 0x20]
mov eax, 0x34
mov rdx, qword [rsp + 0x28]
cmp r8, rax
mov rcx, rbp
cmova r8d, eax
call fcn.14012d940
mov r12b, 1
jmp 0x14008f6c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14008f6c3
lea r8, str.LoadAppVersion.VerQueryValue_____failed__n
jmp 0x14008f6b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14008f6c3
lea r8, str.LoadAppVersion.GetFileVersionInfo___failed__n
mov rdx, rdi
mov rcx, rbx
call fcn.14000a8a0
mov rcx, r13
call fcn.140113e18
xor r13d, r13d
jmp 0x14008f6f4
xor r13d, r13d
test rbx, rbx
je 0x14008f77b
lfence
mov r9d, r14d
lea r8, str.LoadAppVersion_failed__Cant_allocate__n_bytes__n
mov rdx, rdi
mov rcx, rbx
call fcn.1401145a0
test rbx, rbx
je 0x14008f776
jmp 0x14008f71a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test rbx, rbx
je 0x14008f77b
lea r8, str.LoadAppVersion.GetFileVersionInfoSize___failed__n
mov rdx, rdi
mov rcx, rbx
call fcn.14000a8a0
cmp word [rbx], r13w
je 0x14008f776
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140001e48
jmp 0x14008f747
test rbx, rbx
je 0x14008f77b
lea r8, str.Invalid_asModulePath_was_specified
mov rdx, rdi
mov rcx, rbx
call fcn.14000a8a0
cmp word [rbx], r13w
je 0x14008f776
test esi, esi
je 0x14008f776
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov r9d, esi
sub rdi, rcx
lea r8, str._nErrCode0x_08X
mov rdx, rdi
lea rcx, [rbx + rcx*2]
call fcn.1401145a0
test r12b, r12b
jne 0x14008f78f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], eax
mov al, r12b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400917ac
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [rcx]
test rax, rax
je 0x140091808
mov r8, qword [rax + 0x28]
test r8, r8
je 0x140091808
mov rcx, qword [0x14022a9e8]
lea rdx, str.open
mov dword [rsp + 0x28], 1
xor r9d, r9d
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x140091808
lfence
and qword [rsp + 0x20], 0
lea rcx, str.ShellExecute_failed
xor r9d, r9d
xor r8d, r8d
mov edx, eax
call fcn.140113304
add rsp, 0x38
ret
Function at 0x140096500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
and dword [rbp + 0x30], 0
lea r15, vtable.CRefGuard_class_CRConData_.0
mov qword [rbp - 0x18], r15
and qword [rbp - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 8], eax
lea rax, vtable.CRConDataGuard.0
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
mov rcx, rdi
call fcn.140097ef8
test al, al
je 0x1400965dc
lea rcx, [rbp - 0x28]
call fcn.14011a6a4
nop
lea rdx, [rdi + 0x1a80]
or r9d, 0xffffffff
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.14011a8d0
mov rdx, qword [rbp - 0x10]
mov ebx, dword [rdx + 0x18]
mov dword [rbp + 0x38], ebx
mov eax, dword [rdi + 0x1c00]
imul eax, dword [rdi + 0x1bfc]
mov dword [rbp - 0x30], eax
cmp ebx, eax
cmovae ebx, eax
add ebx, ebx
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rdx, qword [rdx + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rbp - 0x28]
call fcn.14011a71c
nop
mov qword [rbp - 0x18], r15
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14009660d
mov eax, dword [rcx + 8]
mov edx, 0x7fffffff
cmp eax, edx
je 0x14009660d
lock dec dword [rcx + 8]
mov eax, dword [rcx + 8]
test eax, eax
jg 0x14009660a
mov dword [rcx + 8], edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x14009660d
mov eax, dword [rcx + 8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x4268]
jmp 0x140096500
Function at 0x14009df78
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [rcx + 0x1bba]
xor bpl, bpl
xor dil, dil
mov sil, r9b
mov r14d, r8d
mov r15d, edx
mov rbx, rcx
cmp eax, edx
jne 0x14009dfb5
cmp dword [rcx + 0x1bbe], r8d
je 0x14009dfc8
mov bpl, 1
test eax, eax
jns 0x14009dfc8
cmp dword [rcx + 0x1bbe], 0
jge 0x14009dfc8
mov dil, bpl
test sil, sil
je 0x14009dfe0
mov byte [rcx + 0x1bc8], 1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x1bc4], eax
mov dword [rbx + 0x1bba], r15d
mov dword [rbx + 0x1bbe], r14d
test sil, sil
je 0x14009e085
cmp dword [rbx], 1
jne 0x14009e085
mov rcx, qword [rbx + 0x58]
xor edx, edx
call fcn.1400a7834
mov r14d, eax
test eax, eax
je 0x14009e085
mov edx, 0x3c
lea ecx, [rdx + 0x15]
call fcn.140119328
mov rcx, qword [rbx + 0x1bba]
xor r9d, r9d
movzx edx, byte [rsp + 0x80]
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov qword [rsp + 0x60], rax
mov qword [rax + 0x30], rcx
mov rcx, qword [rsp + 0x60]
mov dword [rcx + 0x38], edx
mov ecx, r14d
mov r8, qword [0x14022a9e8]
mov rdx, qword [rsp + 0x60]
call fcn.1401196dc
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.140119184
lea rcx, [rsp + 0x60]
call fcn.140119184
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x1bc4], eax
test dil, dil
je 0x14009e093
mov rcx, qword [rbx + 0x58]
call fcn.1400b879c
test sil, sil
je 0x14009e09f
mov byte [rbx + 0x1bc8], 0
mov rbx, qword [rsp + 0x68]
mov al, bpl
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14009e9f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lock inc dword [rcx + 0x1b80]
mov rcx, qword [rcx + 0x58]
call fcn.1400abc3c
mov rax, qword [rbx + 0x58]
mov dl, 1
mov byte [rbx + 0x1c34], 1
mov rcx, qword [rax]
add rcx, 0x18
add rsp, 0x20
pop rbx
jmp fcn.1400ff03c

Function at 0x1400a0948
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x14
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400a0964
bts dword [rbx], 7
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400a0976
or dword [rbx], 0x20
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x1400a0988
or dword [rbx], 0x40
add rsp, 0x20
pop rbx
ret
Function at 0x1400a0d1c
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
mov ebp, edx
mov rbx, rcx
test rcx, rcx
jne 0x1400a0d48
xor eax, eax
jmp 0x1400a0ee3
mov r14d, dword [rcx + 0x479c]
test r14d, r14d
je 0x1400a0ebd
mov eax, dword [rcx + 0x4ab0]
and al, 0x14
cmp al, 4
jne 0x1400a0ebd
test ebp, ebp
jns 0x1400a0d8d
lfence
lea rsi, [rcx + 0x49ac]
mov r8d, ebp
mov rcx, rsi
lea rdx, str.Bad_anWndIndex_i_was_requested
call fcn.1400011f8
jmp 0x1400a0ed6
cmp dword [rcx + 0x49a0], ebp
jne 0x1400a0db6
lfence
lea rsi, [rcx + 0x49ac]
mov r8d, ebp
mov rcx, rsi
lea rdx, str.Far_window__i_is_already_active
call fcn.1400011f8
jmp 0x1400a0ed3
mov dl, 1
call fcn.1400b9924
test rax, rax
je 0x1400a0de6
lea rdx, str.PicView_was_found_r_nPID_u__anWndIndex_i
lfence
lea rsi, [rbx + 0x49ac]
mov r8d, r14d
mov rcx, rsi
mov r9d, ebp
call fcn.1400011f8
jmp 0x1400a0ed6
mov rcx, qword [rbx + 0x18]
lea rsi, [rbx + 0x16d4]
mov rdx, rsi
mov r8d, 0x3ff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400a0e07
mov word [rsi], di
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400a7600
lfence
test ax, ax
js 0x1400a0e25
lea rdx, str.Progress_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400a0dcc
mov rcx, qword [rbx + 0x4250]
call fcn.14009ed9c
test al, al
jne 0x1400a0e3e
lea rdx, str.Buffer_not_initialized_r_nPID_u__anWndIndex_i
jmp 0x1400a0dc9
mov rax, qword [rbx + 0x4268]
cmp qword [rbx + 0x4250], rax
je 0x1400a0e5a
lea rdx, str.Alternative_buffer_is_active_r_nPID_u__anWndIndex_i
jmp 0x1400a0dc9
cmp byte [rbx + 0x4998], 1
jne 0x1400a0e85
lfence
mov rcx, qword [rbx + 0x4250]
call fcn.14009ebe0
movzx eax, al
test eax, eax
je 0x1400a0e85
lea rdx, str.Menu_or_macro_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400a0dc9
cmp qword [rbx + 0x4268], rdi
je 0x1400a0eb8
lfence
mov rcx, qword [rbx + 0x4268]
call fcn.140097ff8
mov rcx, rax
call fcn.140128a34
test eax, 0xff00
je 0x1400a0eb8
lea rdx, str.Dialog_was_detected_r_nPID_u__anWndIndex_i
jmp 0x1400a0dc9
mov eax, r14d
jmp 0x1400a0ee3
lea rsi, [rcx + 0x49ac]
mov rcx, rsi
lea rdx, str.Far_was_not_found_in_console
call fcn.14003f71c
or edi, 0xffffffff
mov rdx, rsi
mov rcx, rbx
call fcn.1400a9948
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret