joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bec18
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rsi, rcx
lea rcx, [rbp - 0x30]
call fcn.140116c08
nop
or r8d, 0xffffffff
mov rdx, qword [rsi + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14011b6fc
xor ebx, ebx
mov qword [rbp + 0x10], rbx
mov rax, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x28]
cmp rax, rcx
je 0x1400bec9e
mov rbx, rcx
sub rbx, rax
sar rbx, 3
mov rbx, qword [rax + rbx*8 - 8]
mov qword [rbp + 0x10], rbx
lea rax, [rcx - 8]
mov qword [rsi + 0x28], rax
lea rcx, [rsi + 0x38]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400bec93
mov qword [rdx], rbx
add qword [rcx + 8], 8
jmp 0x1400bec53
lea r8, [rbp + 0x10]
call fcn.140007624
jmp 0x1400bec53
lea rcx, [rbp - 0x30]
call fcn.14011b830
jmp 0x1400bed90
mov rax, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x40]
cmp rax, rcx
jne 0x1400becbd
xor al, al
jmp 0x1400becda
mov rbx, rcx
sub rbx, rax
sar rbx, 3
mov rbx, qword [rax + rbx*8 - 8]
mov qword [rbp + 0x10], rbx
lea rax, [rcx - 8]
mov qword [rsi + 0x40], rax
mov al, 1
test al, al
je 0x1400bed9a
mov rdx, rbx
mov rcx, qword [0x14022a9e0]
call fcn.1400268f4
test al, al
je 0x1400bed90
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14010868c
nop
cmp qword [rbp - 0x18], 0
je 0x1400bed87
cmp dword [rsi + 0x5c], 0
je 0x1400bed47
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rsi + 0x5c]
mov rcx, qword [0x14022ab50]
cmp eax, dword [rcx + 0xf34]
jae 0x1400bed47
lfence
mov rcx, qword [0x14022ab50]
mov ecx, dword [rcx + 0xf34]
sub ecx, eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rbp + 0x10]
mov byte [rsi + 0x58], 1
mov rcx, qword [0x14022a9e0]
call fcn.140012aac
mov dil, al
mov rcx, qword [rbp - 0x18]
call fcn.14010f780
mov rcx, rax
call fcn.1400ac08c
mov dl, dil
mov rcx, qword [0x14022a9e0]
call fcn.140003b04
mov byte [rsi + 0x58], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsi + 0x5c], eax
lea rcx, [rbp - 0x20]
call fcn.14010878c
cmp byte [rsi + 0x18], 0
je 0x1400becac
lea rcx, [rbp - 0x30]
call fcn.14011b698
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400c2940
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r9d, 0x104
lea r8, [rbp + 0x1d0]
mov edx, 0x6a1
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor r14d, r14d
test eax, eax
jne 0x1400c299c
mov word [rbp + 0x1d0], r14w
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, reloc.SHELL32.dll_ILGetSize
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov rax, qword [0x14022b560]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov r12d, 1
lea rax, str.All_images__.bmp_.jpg_.png_
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
lea rax, str.Choose_background_image
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x4c], r12d
mov dword [rsp + 0x58], 0x104
mov dword [rbp - 0x80], 0x88180c
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400c2b53
mov rcx, qword [0x14022ab58]
lea rdx, [rbp - 0x40]
mov r8b, r12b
call fcn.140083e04
test al, al
je 0x1400c2b53
mov rdx, qword [0x14022a9e0]
add rdx, 0xcea
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdx + rax*2], r14w
jne 0x1400c2a55
lea r8, [rbp - 0x40]
mov rcx, rbx
inc rcx
cmp word [r8 + rcx*2], r14w
jne 0x1400c2a66
cmp rcx, rax
jbe 0x1400c2b11
lea rdi, [rax + rax]
mov r15d, 0x5c
cmp word [rbp + rdi - 0x40], r15w
jne 0x1400c2b11
cmp rdi, 0x208
jae 0x1400c2b7e
lea rcx, [rbp - 0x40]
mov word [rbp + rdi - 0x40], r14w
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
movzx ecx, r14b
mov word [rbp + rdi - 0x40], r15w
cmove ecx, r12d
test cl, cl
je 0x1400c2b11
mov rcx, qword [0x14022ab50]
lea rdx, str._ConEmuDir_
add rcx, 0xcdc
call fcn.1400047d8
mov rax, qword [0x14022a9e0]
inc rbx
cmp word [rax + rbx*2 + 0xcea], r14w
jne 0x1400c2ae1
mov rcx, qword [0x14022ab50]
lea r8, [rbp - 0x40]
lea r8, [r8 + rbx*2]
add rcx, 0xcdc
mov edx, 0x104
call fcn.140001e48
jmp 0x1400c2b28
mov rcx, qword [0x14022ab50]
lea rdx, [rbp - 0x40]
add rcx, 0xcdc
call fcn.1400047d8
mov r8, qword [0x14022ab50]
mov edx, 0x6a1
add r8, 0xcdc
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [0x14022a9e0]
mov dl, r12b
call fcn.1400230a4
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.14012c3e0
int3

Function at 0x1400c2eb0
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], 1
lea r8, str.https:__mridgers.github.io_clink_
and qword [rsp + 0x20], 0
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
add rsp, 0x38
ret
Function at 0x1400c43c0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x3f8]
sub rsp, 0x4f0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r9d, 0x104
lea r8, [rbp + 0x1d0]
mov edx, 0x868
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor esi, esi
test eax, eax
jne 0x1400c4417
mov word [rbp + 0x1d0], si
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, reloc.SHELL32.dll_ILGetSize
lea rcx, [rsp + 0x20]
mov r8d, ebx
xor edx, edx
call fcn.14012d4b0
mov rax, qword [0x14022b560]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rax, str.Processors__cmd.exe_tcc.exe_
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x50], rax
lea rax, str.Choose_command_processor
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x58], 0x104
mov dword [rbp - 0x80], 0x88180c
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x1400c4509
mov rcx, qword [0x14022ab50]
lea rdx, [rbp - 0x40]
add rcx, 0x2e
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r8, [rbp - 0x40]
mov edx, 0x868
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
test ebx, ebx
je 0x1400c4509
mov rcx, qword [0x14022ab50]
lea rdx, [rbp - 0x40]
add rcx, 0x2e
call fcn.1400047d8
mov rax, qword [0x14022ab50]
mov r8d, 0x867
mov r9d, r8d
mov rcx, rdi
lea edx, [r8 - 3]
mov dword [rax + 0x1a], 3
call fcn.1400442d0
mov rcx, qword [0x14022a9e0]
call fcn.1400175c8
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400c4c50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rdi, rcx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x10]
call fcn.14012d4b0
lea rdx, [rbp + 0x200]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, qword [0x14022ab50]
mov rbx, qword [rax + 0x11038]
lea rcx, [rsp + 0x20]
call fcn.1401170c0
nop
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401188b8
mov rbx, rax
test rax, rax
je 0x1400c4cef
lea rcx, [rsp + 0x20]
call fcn.140054ee8
mov rdx, rax
mov r8d, 0x105
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [rsp + 0x50], reloc.SHELL32.dll_ILGetSize
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x58]
call fcn.14012d4b0
mov rax, qword [0x14022b560]
mov qword [rsp + 0x58], rax
lea rax, str.Executables__.exe_
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x7c], 1
lea rax, [rbp - 0x10]
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], 0x105
lea rax, [rbp + 0x200]
mov qword [rbp - 0x60], rax
lea rax, str.Choose_file_editor
mov qword [rbp - 0x58], rax
lea rax, [0x1401b3570]
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x50], 0x88080c
lea rcx, [rsp + 0x50]
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x1400c4dc9
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.1401187fc
mov rbx, rax
test rax, rax
je 0x1400c4dc9
mov r8, rax
mov edx, 0x8cf
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rdx, qword [0x14022ab50]
mov rcx, qword [rdx + 0x11038]
test rcx, rcx
je 0x1400c4dc2
call fcn.140113e18
mov rax, qword [0x14022ab50]
and qword [rax + 0x11038], 0
mov rdx, qword [0x14022ab50]
mov qword [rdx + 0x11038], rbx
lea rcx, [rsp + 0x20]
call fcn.1401170e4
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400c507c
Capabilities:
Log keystrokes via application hook

Disassembly:
sub rsp, 0x28
movzx ecx, r8b
test r8b, r8b
je 0x1400c50c4
sub ecx, 1
je 0x1400c50a6
cmp ecx, 1
jne 0x1400c50e0
mov rax, qword [0x14022ab50]
mov byte [rax + 0x11042], 0
add rsp, 0x28
ret
mov rax, qword [0x14022ab50]
mov byte [rax + 0x11042], 1
mov rcx, qword [0x14022a9e0]
add rsp, 0x28
jmp fcn.14001ebc4
mov rax, qword [0x14022ab50]
xor edx, edx
mov byte [rax + 0x11042], 2
mov rcx, qword [0x14022a9e0]
call fcn.140022fc0
add rsp, 0x28
ret
Function at 0x1400c610c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x40]
mov r8d, 0x208
call fcn.14012d4b0
mov rcx, qword [0x14022ab50]
lea rdx, [rbp + 0x1d0]
mov r8d, 0x105
mov rcx, qword [rcx + 0x11700]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
mov dword [rsp + 0x20], reloc.SHELL32.dll_ILGetSize
mov r8d, 0x90
lea rcx, [rsp + 0x28]
call fcn.14012d4b0
mov rax, qword [0x14022b560]
lea rdx, str.ConEmuSetup.exe
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x40]
lea rax, str.Packages
mov dword [rsp + 0x4c], 1
mov qword [rsp + 0x38], rax
call fcn.1400047d8
lea rax, [rbp - 0x40]
mov dword [rsp + 0x58], 0x104
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
lea rax, [rbp + 0x1d0]
mov dword [rbp - 0x80], 0x88080c
mov qword [rsp + 0x70], rax
lea rax, str.Choose_download_path
mov qword [rsp + 0x78], rax
lea rax, [0x1401759d0]
mov qword [rbp - 0x78], rax
call qword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
xor edi, edi
test eax, eax
je 0x1400c6228
lea edx, [rdi + 0x5c]
lea rcx, [rbp - 0x40]
call fcn.14012dd3c
test rax, rax
je 0x1400c6228
lea r8, [rbp - 0x40]
mov word [rax], di
mov edx, 0x80f
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400caa7c
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rcx
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x1400caabc
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400caabc
and qword [rsi + 0x58], 0
mov rax, qword [rsi + 0x58]
test rax, rax
jne 0x1400cac63
mov r8b, 1
lea rcx, str.Creating_child_dialog_IDD_SPG_APPDISTINCT2
mov dl, r8b
call fcn.1400296e4
lea rdi, [rsi + 0x48]
mov rcx, rdi
call fcn.14000456c
mov rdx, qword [rsi + 8]
lea r8, [fcn.1400cc3ac]
mov ebx, 0xa2
xor r9d, r9d
mov ecx, ebx
call fcn.14004cdf4
mov qword [rdi], rax
test rax, rax
je 0x1400cac88
mov rcx, qword [rax + 8]
mov qword [rsi + 0x58], rcx
test rcx, rcx
je 0x1400cac8d
mov r8d, ebx
mov edx, 0xfffffff4
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
lea rbx, [rsi + 0x50]
cmp qword [rbx], 0
jne 0x1400cab58
cmp qword [rsi + 0x30], 0
je 0x1400cab58
mov rcx, rbx
call fcn.140044a8c
mov r9, qword [rdi]
mov r8, qword [rsi + 8]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rbx]
call fcn.140044724
mov rcx, qword [rsi + 8]
mov edx, 0x931
call qword [sym.imp.USER32.dll_GetDlgItem]
xorps xmm0, xmm0
lea rdx, [rbp - 0x48]
mov rcx, rax
mov rdi, rax
movups xmmword [rbp - 0x48], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsi + 8]
lea r8, [rbp - 0x48]
mov r9d, 2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [rsi + 0x58]
mov edx, 0x935
and qword [rbp - 0x50], 0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, qword [rsi + 0x58]
lea r8, [rbp - 0x50]
mov rcx, rax
mov r9d, 1
mov rbx, rax
call qword [sym.imp.USER32.dll_MapWindowPoints]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x1401f4974]
xor eax, eax
mov rcx, qword [rsi + 0x58]
xorps xmm0, xmm0
mov dword [rbp - 0x10], eax
mov eax, dword [rbp - 0x44]
sub eax, dword [rbp - 0x3c]
add eax, dword [rbp - 0x4c]
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x28], 0x1c
mov dword [rbp - 0x24], 0x17
movups xmmword [rbp - 0x38], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 0x38]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x2c]
lea r8, [rbp - 0x28]
sub eax, dword [rbp - 0x34]
xor r9d, r9d
mov rcx, qword [rsi + 0x58]
mov dword [rbp - 0x18], eax
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_SetScrollInfo]
mov rcx, qword [rsi + 0x58]
lea rdx, [rbp - 0x48]
xor r8d, r8d
call fcn.14002974c
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsi + 0x58]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsi + 0x58]
test rax, rax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
and qword [rsi + 0x58], 0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_EnableWindow]
xor al, al
jmp 0x1400cac66
Function at 0x1400cdbfc
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movzx r14d, dx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400cdce9
mov edx, 0x612
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp eax, 1
jl 0x1400cdce9
lfence
lea ebx, [rax + 1]
movsxd rcx, ebx
add rcx, rcx
call fcn.140113e8c
mov r8d, ebx
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [rdi], 0x3c
je 0x1400cdc93
mov rcx, qword [0x14022ab50]
mov eax, 0x84b
mov rdx, rdi
cmp r14w, ax
jne 0x1400cdc8e
call fcn.14007af6c
jmp 0x1400cdc93
call fcn.14007ac2c
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetFocus]
mov rcx, qword [rsi + 8]
mov edx, r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, 0xfffffff0
mov rcx, rax
mov edx, ebp
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, ebp
mov rcx, rbx
and rax, 0xfffffffffffffffe
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rax, qword [rsi]
xor r8d, r8d
mov rdx, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x10]
lfence
mov rcx, rdi
call fcn.140113e18
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400ce524
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ecx, 0x1fffe
mov dil, r8b
mov rsi, rdx
call fcn.140113e8c
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x1400ce6b3
lea rax, [rsp + 0x68]
mov dword [rsp + 0x68], 0x1fffa
mov qword [rsp + 0x28], rax
lea rdx, [0x14017f6b8]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ce6a1
mov eax, dword [rsp + 0x68]
shr rax, 1
mov word [rbx + rax*2], r14w
test dil, dil
je 0x1400ce657
cmp word [rbx], r14w
je 0x1400ce657
lea rdx, str.ConEmuCmd_Autorun.cmd
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x1400ce657
mov rdi, rax
mov r15d, 0x26
cmp rax, rbx
jbe 0x1400ce5eb
lea rax, [rdi - 2]
cmp word [rax], r15w
je 0x1400ce5eb
mov rdi, rax
cmp rax, rbx
ja 0x1400ce5d9
mov edx, r15d
mov rcx, rsi
call fcn.14012cc40
or rbp, 0xffffffffffffffff
test rax, rax
jne 0x1400ce616
mov rax, rbp
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400ce602
lea rax, [rsi + rax*2]
jmp 0x1400ce61c
add rax, 2
cmp word [rax], r15w
je 0x1400ce612
cmp rdi, rbx
ja 0x1400ce66f
cmp word [rax], r14w
jne 0x1400ce62d
mov word [rbx], r14w
jmp 0x1400ce657
cmp rdi, rbx
jne 0x1400ce63a
mov rcx, rax
call fcn.140118f08
inc rbp
cmp word [rax + rbp*2], r14w
jne 0x1400ce63a
lea r8, [rbp*2 + 2]
mov rdx, rax
mov rcx, rdi
call fcn.14012d940
mov rcx, rbx
call fcn.140118f08
test rax, rax
je 0x1400ce693
cmp word [rax], r14w
je 0x1400ce693
movzx eax, word [rbx]
jmp 0x1400ce69a
cmp word [rax], r14w
jne 0x1400ce63a
lea rax, [rdi - 2]
cmp word [rax], r15w
je 0x1400ce685
cmp word [rax], 0x20
jne 0x1400ce68d
mov rdi, rax
cmp rax, rbx
ja 0x1400ce675
mov word [rdi], r14w
jmp 0x1400ce657
mov word [rbx], r14w
mov eax, r14d
test ax, ax
jne 0x1400ce6b0
jmp 0x1400ce6a5
mov word [rbx], r14w
mov rcx, rbx
call fcn.140113e18
mov rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400ce7fc
Capabilities:
Persist via command processor registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2a8]
sub rsp, 0x380
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15b, dl
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov edx, 0x96b
mov dil, r8b
call fcn.1400443d0
xor r13d, r13d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov qword [rsp + 0x40], r13
test al, al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x38], rax
setne r12b
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400cea47
or r14, 0xffffffffffffffff
mov esi, r13d
test r15b, r15b
je 0x1400ce9b2
mov rdx, qword [rsp + 0x50]
mov r8b, 1
mov rcx, rbx
call fcn.1400ce524
mov r8, qword [0x14022a9e0]
lea rdx, str.__sCmd_Autorun.cmd
add r8, 0xef4
lea rcx, [rsp + 0x60]
mov rbx, rax
mov rdi, rax
call fcn.1400ce48c
xor edx, edx
lea rcx, [rsp + 0x62]
call fcn.140115770
lea rcx, [rsp + 0x60]
test al, al
je 0x1400ce993
lea rax, str.____GHWNDNEW_
test r12b, r12b
lea r8, [0x140179218]
mov edx, 0x184
cmovne r8, rax
call fcn.140001e48
test rbx, rbx
jne 0x1400ce927
lea rdi, [rsp + 0x60]
jmp 0x1400ce9dd
mov rax, r14
inc rax
cmp word [rbx + rax*2], r13w
jne 0x1400ce92a
lea rdx, [rsp + 0x60]
mov rcx, r14
inc rcx
cmp word [rdx + rcx*2], r13w
jne 0x1400ce93c
lea r15, [rcx + 5]
add r15, rax
lea rcx, [r15 + r15]
call fcn.140113e8c
mov rsi, rax
test rax, rax
je 0x1400ce9dd
lea r8, [rsp + 0x60]
mov rdx, r15
mov rcx, rax
call fcn.14000a8a0
lea r8, [0x1401b5188]
mov rdx, r15
mov rcx, rsi
call fcn.140001e48
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call fcn.140001e48
mov rdi, rsi
jmp 0x1400ce9dd
mov r9, qword [0x14022b560]
lea r8, str.File_not_found
mov edx, 0x10
mov byte [rsp + 0x20], 1
call fcn.1400297d8
jmp 0x1400ce9cf
test dil, dil
je 0x1400ce9bc
mov rbx, r13
jmp 0x1400ce9cf
mov rdx, qword [rsp + 0x50]
mov r8b, 1
mov rcx, rbx
call fcn.1400ce524
mov rbx, rax
test rbx, rbx
lea rdi, [0x1401759d0]
cmovne rdi, rbx
inc r14
cmp word [rdi + r14*2], r13w
jne 0x1400ce9dd
mov rcx, qword [rsp + 0x50]
lea eax, [r14*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x14017f6b8]
mov r9d, 1
mov qword [rsp + 0x20], rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x1400cea3a
cmp rsi, rbx
je 0x1400cea3a
lea rax, [rsp + 0x60]
cmp rsi, rax
je 0x1400cea3a
mov rcx, rsi
call fcn.140113e18
test rbx, rbx
je 0x1400cea47
mov rcx, rbx
call fcn.140113e18
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400d4298
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
mov rdi, rcx
lea rcx, [rsp + 0x20]
call fcn.1401086e4
nop
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140102fa8
xor esi, esi
test eax, eax
cmovns rsi, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov r8, rax
mov edx, 0x5e4
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
mov dl, 1
mov rcx, qword [0x14022a9e0]
call fcn.140023acc
mov rcx, qword [0x14022a9e0]
call fcn.140024120
test rsi, rsi
je 0x1400d4353
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], eax
mov rcx, rsi
call fcn.14010f780
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.1400a67d4
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, rdi
call fcn.1400d40d0
mov rdx, rbx
mov rcx, rdi
call fcn.1400d415c
nop
lea rcx, [rsp + 0x20]
call fcn.14010878c
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400d6244
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.SoftwareClassesDirectoryBackground_shell
mov r8, rcx
mov rdi, 0xffffffff80000001
mov rcx, rdi
call fcn.14012448c
mov r8, rbx
lea rdx, str.SoftwareClassesDirectory_shell
mov rcx, rdi
call fcn.14012448c
mov r8, rbx
lea rdx, str.SoftwareClassesDrive_shell
mov rcx, rdi
call fcn.14012448c
mov r8, rbx
lea rdx, str.SoftwareClasses_shell
mov rcx, rdi
call fcn.14012448c
mov r8, rbx
lea rdx, str.SoftwareClassesLibraryFolderBackground_shell
mov rcx, rdi
call fcn.14012448c
mov r8, rbx
lea rdx, str.SoftwareClassesLibraryFolder_shell
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14012448c