joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1300
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14d, dword [rcx + 0x4ab4]
mov dl, 1
mov esi, r14d
mov rdi, rcx
and esi, 0xffff0000
call fcn.1400a6b88
xor r15d, r15d
test eax, eax
jne 0x1400a1347
or rbp, 0xffffffffffffffff
mov ebx, r15d
mov edx, ebp
jmp 0x1400a1474
movzx eax, byte [rdi + 0x4998]
cmp eax, 1
je 0x1400a1365
cmp eax, 2
jne 0x1400a135d
or esi, 0x20
jmp 0x1400a1365
cmp eax, 3
jne 0x1400a1365
or esi, 0x10
or rbp, 0xffffffffffffffff
test si, si
jne 0x1400a141b
lea rdx, [rdi + 0x26f80]
mov r8, rbp
lea rbx, [rdi + 0xed2]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400a1383
mov rcx, rbx
call fcn.140138a08
test eax, eax
je 0x1400a1418
lea rdx, [rdi + 0x26fc0]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400a13a3
mov rcx, rbx
call fcn.140138a08
test eax, eax
je 0x1400a1418
lea rdx, [rdi + 0x27000]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400a13c3
mov rcx, rbx
call fcn.140138a08
test eax, eax
je 0x1400a1413
lea rdx, [rdi + 0x27040]
mov r8, rbp
inc r8
cmp word [rdx + r8*2], r15w
jne 0x1400a13e3
mov rcx, rbx
call fcn.140138a08
test eax, eax
je 0x1400a1413
mov r8b, 1
xor r9d, r9d
mov dl, r8b
mov rcx, rdi
call fcn.1400b9524
test al, al
je 0x1400a141b
or esi, 1
jmp 0x1400a141b
or esi, 0x20
jmp 0x1400a141b
or esi, 0x10
mov ebx, esi
mov eax, esi
and ebx, 0xfff8ffff
mov ecx, 0x10000
and al, 0x30
cmove ebx, esi
test bl, 1
je 0x1400a143c
and ebx, 0xfff9ffff
or ebx, ecx
movzx edx, word [rdi + 0x3a18]
cmp dx, 0x64
ja 0x1400a147e
cmp word [rdi + 0x3a24], dx
jne 0x1400a145f
btr ebx, 0x12
movzx edx, bp
bts ebx, 0x11
jmp 0x1400a1474
mov eax, ebx
and eax, ecx
mov ecx, ebx
bts ecx, 0x11
test eax, eax
cmove ecx, ebx
mov ebx, ecx
btr ebx, 0x12
mov rcx, rdi
call fcn.1400ba6ac
jmp 0x1400a14cd
mov ecx, 0x30000
mov eax, ebx
and eax, ecx
cmp eax, ecx
jne 0x1400a14cd
cmp word [rdi + 0x3a1c], bp
je 0x1400a14cd
cmp dword [rdi + 0x3a20], r15d
jne 0x1400a14ab
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0x3a20], eax
jmp 0x1400a14cd
mov esi, 0x40000
test dword [rdi + 0x4ab4], esi
jne 0x1400a14cb
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rdi + 0x3a20]
cmp eax, 0x7d0
jbe 0x1400a14cd
or ebx, esi
cmp word [rdi + 0x3a18], bp
jne 0x1400a150a
cmp word [rdi + 0x3a1c], bp
je 0x1400a150a
bt ebx, 0x11
jae 0x1400a14f0
test bl, 1
je 0x1400a150a
and ebx, 0xfff9ffff
mov edx, ebp
mov rcx, rdi
call fcn.1400ba6ac
mov rcx, qword [rdi + 8]
mov dword [rdi + 0x3a20], r15d
call fcn.140023de4
cmp ebx, r14d
je 0x1400a1520
mov rcx, qword [rdi + 8]
xor edx, edx
mov dword [rdi + 0x4ab4], ebx
call fcn.140023acc
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400a153c
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x830
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x820], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x4990], edi
jle 0x1400a15b5
cmp byte [rcx + 0x4998], 1
jne 0x1400a15b5
mov rcx, qword [rcx + 0x18]
lea rdx, [rsp + 0x20]
mov r8d, 0x3ff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400a1593
mov word [rbx + 0x3218], di
jmp 0x1400a15b5
cmp word [rsp + 0x20], 0x7b
je 0x1400a15a3
cmp word [rsp + 0x20], 0x28
jne 0x1400a15b5
lea rcx, [rbx + 0x3218]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x848]
add rsp, 0x830
pop rdi
ret
Function at 0x1400a3b84
Capabilities:
Check for time delay via gettickcount

Disassembly:
test rcx, rcx
je 0x1400a3be1
push rbx
sub rsp, 0x30
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x14022d850]
sub edx, eax
cmp edx, 0x3e8
jae 0x1400a3bc5
or r9, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
xor r8d, r8d
lea rcx, str.Space_bounce_received_from_unknown_window
lea edx, [r9 + 0x41]
call fcn.1400297d8
jmp 0x1400a3bdc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
or edx, 0xffffffff
mov rcx, rbx
mov dword [0x14022d850], eax
call fcn.1400b5094
add rsp, 0x30
pop rbx
ret

Function at 0x1400a4aa4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
mov rbp, rsp
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
and dword [rbp + 0x30], 0
lea r15, vtable.CRefGuard_class_CRConData_.0
mov qword [rbp - 0x18], r15
and qword [rbp - 0x10], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 8], eax
lea rax, vtable.CRConDataGuard.0
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
mov rcx, rdi
call fcn.140097ef8
test al, al
je 0x1400965dc
lea rcx, [rbp - 0x28]
call fcn.14011a6a4
nop
lea rdx, [rdi + 0x1a80]
or r9d, 0xffffffff
xor r8d, r8d
lea rcx, [rbp - 0x28]
call fcn.14011a8d0
mov rdx, qword [rbp - 0x10]
mov ebx, dword [rdx + 0x18]
mov dword [rbp + 0x38], ebx
mov eax, dword [rdi + 0x1c00]
imul eax, dword [rdi + 0x1bfc]
mov dword [rbp - 0x30], eax
cmp ebx, eax
cmovae ebx, eax
add ebx, ebx
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rdx, qword [rdx + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x30]
mov r8d, ebx
mov rdx, qword [rbp - 0x10]
mov rdx, qword [rdx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
lea rcx, [rbp - 0x28]
call fcn.14011a71c
nop
mov qword [rbp - 0x18], r15
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14009660d
mov eax, dword [rcx + 8]
mov edx, 0x7fffffff
cmp eax, edx
je 0x14009660d
lock dec dword [rcx + 8]
mov eax, dword [rcx + 8]
test eax, eax
jg 0x14009660a
mov dword [rcx + 8], edx
mov rax, qword [rcx]
call qword [rax]
jmp 0x14009660d
mov eax, dword [rcx + 8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x4268]
jmp 0x140096500

Function at 0x1400a6d4c
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x258
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x240], rax
test rcx, rcx
je 0x1400a6dc4
mov eax, dword [rcx + 0x4288]
test eax, eax
je 0x1400a6d7c
cmp eax, dword [rcx + 0x63c]
je 0x1400a6dc4
cmp byte [rcx + 0x4afe], 0
jne 0x1400a6dc4
cmp dword [rcx + 0x63c], 0
je 0x1400a6dc4
lea rax, [rcx + 0x402a]
xor edx, edx
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
mov r8d, 0x210
call fcn.14012d4b0
lea rdx, [rsp + 0x20]
lea rcx, [0x1400a5200]
call qword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [rsp + 0x30]
jmp 0x1400a6dc6
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x258
ret
Function at 0x1400a8394
Capabilities:
Log keystrokes

Disassembly:
test rcx, rcx
je 0x1400a8447
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x28], 0
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400a842f
and dword [r8], 0
xor edx, edx
mov r15, qword [rsp + 0x60]
and dword [r15], 0
mov rcx, qword [0x14022a9e8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
and dword [r14], 0
xor edx, edx
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
cmp eax, dword [rbx + 0x48]
je 0x1400a8429
mov r8d, 1
mov edx, ebp
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [rdi], eax
test eax, eax
jne 0x1400a841d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r15], eax
jmp 0x1400a8420
mov dword [rbx + 0x48], esi
mov dword [r14], 1
jmp 0x1400a842f
mov dword [rdi], 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400ab1bc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov rdi, r9
mov ecx, 0x286
cmp r8d, ecx
jne 0x1400ab3ae
mov rdx, qword [rbx + 0x28]
lea rax, [rdx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400ab21c
mov rax, qword [rbp + 0x60]
mov r8d, ecx
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1400ad868
jmp 0x1400ab3ae
mov r15d, 1
xorps xmm0, xmm0
mov word [rbp - 0x28], r15w
movups xmmword [rbp - 0x24], xmm0
lea ecx, [r15 + 0x13]
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, r15w
mov ecx, 0x90
mov word [rbp - 0x30], ax
call qword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
mov ecx, 0x91
and si, r15w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, 0xa4
and r14w, r15w
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13d, 0x8000
mov ecx, 0xa5
movzx r15d, ax
and r15w, r13w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r12d, ax
mov ecx, 0xa2
and r12w, r13w
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r13d, ax
mov ecx, 0xa3
mov eax, 0x8000
and r13w, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov ecx, 0x10
mov word [rbp - 0x2e], ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [rbx + 0x479c]
xor r9d, r9d
movzx r8d, ax
mov r10d, 1
mov eax, 0x8000
mov word [rbp - 0x20], r10w
and r8w, ax
test edx, edx
je 0x1400ab2fe
mov ecx, dword [rbx + 0x4ab0]
and cl, 0x14
cmp cl, 4
je 0x1400ab301
mov edx, r9d
neg edx
mov word [rbp - 0x1a], di
mov ecx, 0xff
mov dword [rbp - 0x24], r10d
sbb ax, ax
and ax, 0xe5
mov word [rbp - 0x1e], ax
mov eax, dword [rbp + 0x60]
shr eax, 0x10
and ax, cx
mov ecx, 0x100
test dword [rbp + 0x60], 0x1000000
mov word [rbp - 0x1c], ax
mov eax, r9d
cmovne eax, ecx
mov dword [rbp - 0x18], eax
cmp word [rbp - 0x30], r9w
je 0x1400ab34b
bts eax, 7
mov dword [rbp - 0x18], eax
test si, si
je 0x1400ab356
or eax, 0x20
mov dword [rbp - 0x18], eax
test r14w, r14w
je 0x1400ab362
or eax, 0x40
mov dword [rbp - 0x18], eax
test r15w, r15w
je 0x1400ab36e
or eax, 2
mov dword [rbp - 0x18], eax
test r12w, r12w
je 0x1400ab37a
or eax, r10d
mov dword [rbp - 0x18], eax
test r13w, r13w
je 0x1400ab386
or eax, 8
mov dword [rbp - 0x18], eax
cmp word [rbp - 0x2e], r9w
je 0x1400ab393
or eax, 4
mov dword [rbp - 0x18], eax
test r8w, r8w
je 0x1400ab39f
or eax, 0x10
mov dword [rbp - 0x18], eax
mov r8b, r10b
lea rdx, [rbp - 0x28]
mov rcx, rbx
call fcn.1400ad4dc
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ad72c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400ad772
test r8, r8
je 0x1400ad772
xor dil, dil
call fcn.1400b9ca0
test al, al
jne 0x1400ad78d
lea rdx, str.PostConsoleEventPipe_skipped_due_to_server_not_alive
mov rcx, rbx
call fcn.1400a98a8
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
mov rax, qword [rbx + 0x8b0]
mov r12d, 1
add rax, r12
test rax, 0xfffffffffffffffe
jne 0x1400ad7ba
mov rcx, rbx
call fcn.1400ac5dc
test al, al
jne 0x1400ad7ba
lea rdx, str.PostConsoleEventPipe_skipped_due_to_OpenConsoleEventPipe_failed
jmp 0x1400ad76a
and qword [rsp + 0x20], 0
lea eax, [rsi + rsi*2]
lea ebp, [rax*8 + 8]
mov dword [r14 + 4], esi
mov dword [r14], ebp
lea r9, [rsp + 0x58]
mov rcx, qword [rbx + 0x8b0]
mov r8d, ebp
mov rdx, r14
mov dword [0x14022d838], r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400ad7f9
mov dil, r12b
jmp 0x1400ad858
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov esi, eax
call fcn.1400b9194
test al, al
jne 0x1400ad858
lea eax, [rsi - 0xe8]
cmp eax, r12d
ja 0x1400ad858
mov rcx, rbx
call fcn.1400b9ca0
test al, al
je 0x1400ad858
mov rcx, rbx
call fcn.1400ac5dc
test al, al
je 0x1400ad858
mov rcx, qword [rbx + 0x8b0]
lea r9, [rsp + 0x58]
and qword [rsp + 0x20], 0
mov r8d, ebp
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
movzx edi, dil
cmovne edi, r12d
and dword [0x14022d838], 0
mov al, dil
jmp 0x1400ad774

Function at 0x1400adcb8
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, dx
movzx ebp, r9w
mov ebx, r8d
mov rsi, rcx
test rcx, rcx
jne 0x1400adce9
xor al, al
jmp 0x1400add71
mov eax, dword [rsp + 0x90]
cmp eax, 0xffffffff
jne 0x1400adcff
mov ecx, edi
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test ebx, ebx
jne 0x1400add32
mov edx, edi
sub edx, 0xa2
je 0x1400add2d
sub edx, 1
je 0x1400add28
sub edx, 1
je 0x1400add21
cmp edx, 1
jne 0x1400add32
mov ebx, 0x100
mov edi, 0x12
jmp 0x1400add32
mov ebx, 0x100
mov edi, 0x11
mov ecx, 1
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov word [rsp + 0x20], cx
movups xmmword [rsp + 0x24], xmm0
and dword [rsp + 0x24], 0
xor r8d, r8d
mov word [rsp + 0x28], cx
mov rcx, rsi
mov word [rsp + 0x2a], di
mov word [rsp + 0x2c], ax
mov word [rsp + 0x2e], bp
mov dword [rsp + 0x30], ebx
call fcn.1400ad4dc
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400b0528
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rdi, rdx
xor esi, esi
lea rdx, [rsp + 0x40]
mov ecx, 0xc8
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1400b05bb
mov r9, rdi
lea rdx, [0x1401b0470]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x1400b05bb
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b05bb
mov word [rdi], si
mov ebx, esi
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b5274
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x1400b52ca
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400b52ca
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b52ca
mov rdx, qword [rbx + 0x28]
mov r9b, 1
mov r8d, 5
mov byte [rbx + 0x61], 0
mov rcx, rbx
call fcn.1400b5340
mov rcx, qword [rbx]
add rcx, 0x18
call fcn.1400fe114
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx]
add rcx, 0x18
mov byte [rbx + 0x61], 1
call fcn.1400fe114
mov edx, 5
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400b530d
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b530d
mov rdx, qword [rbx + 0x28]
mov r9b, 1
xor r8d, r8d
mov rcx, rbx
call fcn.1400b5340
mov rcx, qword [rbx]
add rcx, 0x18
add rsp, 0x20
pop rbx
jmp fcn.1400fe2d4

Function at 0x1400b546c
Capabilities:
Get graphical window text

Disassembly:
test rcx, rcx
je 0x1400b5544
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
xor edx, edx
xor r9d, r9d
mov r8d, 0x8002
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400b550c
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1400b5507
cmp word [rsp + 0x20], 0x22
jne 0x1400b5507
cmp word [rsp + 0x2e], 0x22
jne 0x1400b5507
mov edx, 6
xor ecx, ecx
lea rax, [0x140178678]
movzx eax, word [rcx + rax]
cmp word [rsp + rcx + 0x22], ax
jne 0x1400b5507
add rcx, 2
sub rdx, 1
jne 0x1400b54e1
mov rcx, rbx
call fcn.14011e94c
jmp 0x1400b5524
mov rdx, rbx
jmp 0x1400b5499
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xfff7
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x248]
add rsp, 0x230
pop rdi
ret

Function at 0x1400b5475
Capabilities:
Get graphical window text

Disassembly:
test rcx, rcx
je 0x1400b5544
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rdi, rcx
xor edx, edx
xor r9d, r9d
mov r8d, 0x8002
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov rbx, rax
test rax, rax
je 0x1400b550c
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x1400b5507
cmp word [rsp + 0x20], 0x22
jne 0x1400b5507
cmp word [rsp + 0x2e], 0x22
jne 0x1400b5507
mov edx, 6
xor ecx, ecx
lea rax, [0x140178678]
movzx eax, word [rcx + rax]
cmp word [rsp + rcx + 0x22], ax
jne 0x1400b5507
add rcx, 2
sub rdx, 1
jne 0x1400b54e1
mov rcx, rbx
call fcn.14011e94c
jmp 0x1400b5524
mov rdx, rbx
jmp 0x1400b5499
mov rcx, qword [rdi + 0x18]
xor r9d, r9d
mov edx, 0x112
mov r8d, 0xfff7
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14012bda0
mov rbx, qword [rsp + 0x248]
add rsp, 0x230
pop rdi
ret
Function at 0x1400b59b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8d, [rdi + 5]
mov rcx, rsi
lea rdx, str.Initializing_ConEmu__4_
mov ebx, eax
call fcn.1400b337c
mov rcx, qword [rsi]
call fcn.14010c784
lea r8, [rsi + 0x3a40]
mov dword [rsp + 0x20], eax
lea r9, str.RCon::MonitorThread_ID_i
mov rdx, rsi
lea rcx, [0x1400a9a04]
call fcn.140119fac
lea r8d, [rdi + 5]
mov qword [rsi + 0x3a38], rax
lea rdx, str.Initializing_ConEmu__5_
mov rcx, rsi
call fcn.1400b337c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x9c4
jbe 0x1400b5a6a
lfence
mov r8d, eax
lea rdx, str._DBG__Very_high_CPU_load__CreateThread_takes__u_ms
lea rcx, [rsp + 0x30]
call fcn.140003a84
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400a9948
cmp qword [rsi + 0x3a38], rdi
jne 0x1400b5a8e
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, str.Cant_create_console_thread_
xor edx, edx
call fcn.140113304
jmp 0x1400b5a91
mov dil, 1
mov al, dil
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b8195
Capabilities:
Create process on windows

Disassembly:
test rcx, rcx
je 0x1400b83ae
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x80], rax
cmp qword [rcx + 0x28], 0
je 0x1400b81e7
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
lea rcx, str.ChildGui_unfastening_is_not_working_yet
call fcn.140113304
jmp 0x1400b838b
mov edi, dword [rcx + 0x63c]
test edi, edi
je 0x1400b838b
xor r9d, r9d
xor r8d, r8d
mov dl, 1
call fcn.1400a3d8c
test al, al
je 0x1400b838b
lea rcx, [rsp + 0x78]
call fcn.140114c40
nop
xor r8d, r8d
lea rdx, [rsp + 0x78]
mov rcx, qword [0x14022a9e0]
call fcn.140015b38
mov rbx, rax
mov r8d, edi
lea rdx, str._GuiMacro__Attach__u_
lea rcx, [rbp]
call fcn.14000c80c
mov rcx, rbx
lea rax, [0x14017669c]
neg rcx
sbb rdx, rdx
and rdx, rax
mov r8, qword [0x14022a9e0]
add r8, 0xae0
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x38], 0
lea rax, [rbp]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
lea r9, str.___Detached
lea rdx, [0x140179218]
lea rcx, [rsp + 0x68]
call fcn.140114ba8
nop
mov dword [rbp - 0x70], 0x68
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp - 0x68]
call fcn.14012d4b0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400b8333
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rax, qword [0x14022a9e8]
mov qword [rsp + 0x20], rax
lea r9, str.Failed_to_start_new_ConEmu_instance
mov r8d, 0x10
mov rcx, qword [rsp + 0x68]
call fcn.140113304
jmp 0x1400b8376
mov rcx, qword [rsp + 0x50]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b8354
and qword [rsp + 0x50], 0
cmp rcx, 0xffffffffffffffff
je 0x1400b8354
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400b8376
and qword [rsp + 0x58], 0
cmp rcx, 0xffffffffffffffff
je 0x1400b8376
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x68]
call fcn.140114ca4
nop
lea rcx, [rsp + 0x78]
call fcn.140114ca4
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400b9194
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x230
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [rcx + 8]
call fcn.1400268ec
test al, al
je 0x1400b922f
mov eax, dword [rbx + 0x4288]
test eax, eax
je 0x1400b924a
cmp eax, dword [rbx + 0x63c]
jne 0x1400b924a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x428c]
cmp eax, 0x7d0
jb 0x1400b924a
mov rcx, rbx
call fcn.1400b9ca0
test al, al
je 0x1400b922f
mov r8d, dword [rbx + 0x63c]
lea rdx, str.Server_PID_u_hangs_during_termination._Force_kill_triggered_
lea rcx, [rsp + 0x20]
call fcn.14000c8e8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400a9948
mov rcx, qword [rbx + 0x640]
test rcx, rcx
je 0x1400b922f
mov edx, 0x64
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x230
pop rbx
ret
cmp qword [rbx + 0x18], 0
je 0x1400b922f
cmp byte [rbx + 0x4afe], 0
jne 0x1400b922f
xor al, al
jmp 0x1400b9231

Function at 0x1400bb030
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x14022d854], 0
mov rbx, r8
mov rdi, rcx
je 0x1400bb06d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x14022d854]
cmp eax, 0x3e8
jae 0x1400bb06d
mov rcx, qword [rdi]
lea rdx, str.CECMD_FLASHWINDOW_skipped__too_rapid_call
call fcn.1400a9948
jmp 0x1400bb080
mov rcx, qword [0x14022a9e0]
lea rdx, [rbx + 0x30]
xor r8d, r8d
call fcn.14001269c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0xc]
mov edx, 0x30
mov dword [0x14022d854], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140119328