joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c440
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140106fe0]
call fcn.1400052f0
test eax, eax
jne 0x14008c47d
lea r8, [0x1400ccf5c]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1401063b0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.140036a60
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008c542
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008c542
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008c542
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008c542
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008c600
test rdi, rdi
je 0x14008c529
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008c5a1
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a71a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008c4b0
cmp dword [0x14010700c], r12d
je 0x14008c57c
cmp qword [0x140106ff0], r12
je 0x14008c568
mov rcx, qword [0x140106fe0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140106ff0], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14010700c], r12d
mov qword [0x140106fe0], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x14010700c], r12d
je 0x14008c5e4
cmp qword [0x140106ff0], r12
je 0x14008c5d0
mov rcx, qword [0x140106fe0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140106ff0], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14010700c], r12d
mov qword [0x140106fe0], r12
lea r8, [0x1400ccf5c]
lea rdx, [0x1400cd2c8]
lea rcx, [0x1401063b0]
call fcn.140036a60
jmp 0x14008c581
cmp dword [0x14010700c], r12d
je 0x14008c63a
cmp qword [0x140106ff0], r12
je 0x14008c626
mov rcx, qword [0x140106fe0]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140106ff0], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x14010700c], r12d
mov qword [0x140106fe0], r12
lea r8, [0x1400ccf5c]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401063b0]
call fcn.140036a60
jmp 0x14008c581
Function at 0x14008cab0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14008ccf0
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14008cb46
sub ecx, 1
je 0x14008cb16
cmp ecx, 1
je 0x14008cafa
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008cb04
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140004b80
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14008cc89
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001340
cmp dword [0x140102c94], 0
jne 0x14008cc47
cmp qword [rdi + 0x10], 0
jne 0x14008cc47
cmp qword [0x140108990], rdi
jne 0x14008cb74
test rbx, rbx
jne 0x14008cbf3
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008cbee
xor esi, esi
mov qword [0x140108990], rsi
test rbx, rbx
je 0x14008cbdc
mov edx, dword [0x140102ca4]
test edx, edx
je 0x14008cbbe
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x1401063b0]
mov qword [rsp + 0x20], rsi
call fcn.140037350
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14008a8d0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008cc2e
cmp byte [rdi + 0x23], 0
jne 0x14008cbff
mov rax, qword [rdi + 0x10]
jmp 0x14008cc02
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14008cc10
mov rdx, rdi
call fcn.1400374a0
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x140108990], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x140108990], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14008cceb
test r8, r8
jne 0x14008cc99
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14008cc7f
mov rdx, rdi
call fcn.1400374a0
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14008cceb
cmp r8, 0x186a0
jae 0x14008ccdd
movzx eax, word [rdx]
test ax, ax
je 0x14008ccd3
nop dword [rax]
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14008ccc0
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14008cc84
mov rcx, rbx
call fcn.1400a71a0
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14008cc84
mov rcx, qword [rdi + 0x10]
call fcn.14008cab0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14008d870
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x14008d886
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140106328]
mov r15d, eax
je 0x14008d8b7
mov rcx, rbx
call fcn.14008ec50
test al, al
je 0x14008d8b7
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x14008d8dc
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
cmp rbx, rsi
jne 0x14008d8f4
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14008d90f
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x140102c9b], 0
jne 0x14008d92c
mov rdx, rsi
mov rcx, rbx
call fcn.14008d7d0
test rax, rax
jne 0x14008da7b
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x14008d9b5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14008d9ba
cmp dword [0x140106328], eax
je 0x14008d991
mov rcx, rsi
call fcn.14008ec50
test al, al
jne 0x14008d991
mov ecx, dword [0x140106328]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14008d9ba
cmp r14d, r15d
je 0x14008d9ba
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14008d9ba
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.14008d7d0
mov rbp, rax
test rax, rax
jne 0x14008da22
inc edi
cmp edi, 5
jl 0x14008d9c0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140011a90
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.140011a90
mov rdx, rsi
mov rcx, rbx
call fcn.14008d7d0
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x14008da43
mov ecx, dword [0x140106328]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14008da5c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x14008da74
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x14008da76
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x14008dbd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x14008dbf0
call fcn.140062e60
jmp 0x14008dc00
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x14008dc5c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001700
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008dc5c
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x14008dc5c
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001700
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14008dc31
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008de40
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400be2f0
sub rsp, rax
mov r10, qword [rbp + 0x11c10]
mov rdi, rcx
movzx ecx, word [rdx]
mov r11d, 0xffdf
lea eax, [rcx - 0x41]
test r11w, ax
jne 0x14008def4
cmp word [rdx + 2], 0
jne 0x14008def4
cmp word [r8], 0
jne 0x14008def4
cmp word [r9], 0
jne 0x14008def4
cmp word [r10], 0
jne 0x14008def4
mov qword [rsp + 0x11cf0], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x14008dec3
cmp byte [rdi + 0x12a], 0
jne 0x14008dec3
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
cmp byte [rbp + 0x11c20], 0
je 0x14008ded8
test rbx, rbx
je 0x14008ded8
mov qword [rdi + 0xf8], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x11cf0]
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
test cx, cx
jne 0x14008df24
cmp word [r8], cx
jne 0x14008df24
cmp word [r9], cx
jne 0x14008df24
cmp word [r10], cx
jne 0x14008df24
mov rcx, rdi
call fcn.14008e0a0
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
xor ecx, ecx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r9
lea rax, [0x1400ccf5c]
mov r9, r8
mov dword [rsp + 0x30], ecx
mov r8, rdx
mov byte [rbp + 0x1781], cl
mov dword [rbp + 0x1784], ecx
xorps xmm0, xmm0
mov qword [rbp + 0x1788], rcx
mov rdx, rdi
mov dword [rbp + 0x17a0], ecx
mov qword [rbp + 0x17a8], rcx
mov qword [rbp + 0x17b8], rcx
mov qword [rbp + 0x17c0], rcx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf48], rax
movdqa xmmword [rbp + 0x1790], xmm0
call fcn.14008ee70
test eax, eax
je 0x14008e046
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x14008e059
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x14008e01b
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008e046
cmp byte [rdi + 0x12a], 0
jne 0x14008e014
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14008e014
mov rcx, qword [rbp + 0xf68]
lea edx, [rax - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x14008e046
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x14008e035
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.14008f310
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14008f400
test rax, rax
jne 0x14008e06b
xor eax, eax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
lea rdx, [rsp + 0x30]
lea rcx, [0x14008e130]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbp + 0x11c20], 0
mov rax, qword [rbp + 0x1788]
je 0x14008e087
test rax, rax
je 0x14008e087
mov qword [rdi + 0xf8], rax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
Function at 0x14008f310
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x14008f3f3
mov eax, dword [rbx]
test eax, eax
je 0x14008f3f3
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x14008f34f
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x14008f36d
mov r8d, 0x7fff
lea rdx, [rbx + 0x189c]
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x14008f36d
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x14008f386
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x14008f3c4
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14008f3c4
movzx r9d, byte [rbx + 0x1850]
lea rdx, [rbx + 0x11a9c]
mov ecx, dword [rsp + 0x30]
call fcn.14005db10
test eax, eax
jne 0x14008f3c4
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x14008f3f3
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x14008fc60
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1400be2f0
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14008fd1a
xor r9d, r9d
mov byte [rsp + 0x18a0], dl
lea rcx, [0x1400ccf5c]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov byte [rsp + 0x1871], r9b
lea rcx, [0x140090560]
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
movdqa xmmword [rsp + 0x1880], xmm0
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x14008fd1a
mov rax, qword [0x1400fda58]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x14008fd1a
mov edx, 1
call fcn.140001700
mov eax, 1
add rsp, 0x11cd8
ret
Function at 0x14008fd30
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push r14
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx r14d, dl
mov rbx, rcx
jne 0x14008fd5a
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x1400fda58]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.140090300
cmp byte [rbx], 0
mov rbp, rax
je 0x14008fd91
test rax, rax
jne 0x14008fd9a
jmp 0x14008fe32
test rbp, rbp
jne 0x14008fe2d
test rdi, rdi
je 0x14008fe2d
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001700
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14008fe0f
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x14008fe0f
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001700
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14008fde0
mov rax, qword [0x1400fda58]
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x14008fe2d
mov edx, 1
call fcn.140001700
cmp byte [rbx], 0
je 0x14008fe46
xor r9d, r9d
mov r8, rbp
movzx edx, r14b
mov rcx, rbx
call fcn.14008fe70
jmp 0x14008fe52
movzx edx, r14b
mov rcx, rbx
call fcn.140090060
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140090060
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1400be2f0
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x140090224
xor edx, edx
call fcn.140090240
test eax, eax
jne 0x1400900a0
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x1400fda58]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.140090300
mov ecx, dword [0x140106318]
xor ebp, ebp
test rax, rax
mov dword [rsp + 0x30], ebp
lea rax, [0x1400ccf5c]
mov dword [rsp + 0x1884], ebp
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [0x140106318], ecx
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x14009012a
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x140090132
mov byte [rsp + 0x1881], 1
mov rax, qword [0x140106310]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x18a0], ecx
lea rcx, [0x140090420]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x1400901e8
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
lea rcx, [0x14008eb90]
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov r10, qword [rsp + 0x28]
test r10, r10
je 0x1400901b0
mov rcx, qword [rsp + 0x1888]
call fcn.14008f970
mov qword [rsp + 0x1888], r10
jmp 0x1400901b8
mov r10, qword [rsp + 0x1888]
mov rcx, r10
call fcn.14008d870
mov rcx, qword [rsp + 0x1888]
call fcn.14008f970
mov rcx, qword [0x1400fda58]
mov ecx, dword [rcx + 0x74]
cmp ecx, 0xffffffff
jle 0x140090214
mov edx, 1
call fcn.140001700
jmp 0x140090214
mov eax, dword [0x140106318]
test eax, eax
je 0x140090214
cmp eax, 1
mov dword [0x140106318], ebp
setg al
test al, al
je 0x140090214
mov rcx, rsi
call fcn.14008f970
xor edx, edx
mov rcx, rbx
call fcn.140090060
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1400acf30
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400acd04
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400acd04
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400acd04
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400acd04
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400acd04
cmp dword [rcx + 0x84], 0xe
jbe 0x1400acd04
cmp dword [rcx + 0xf8], esi
je 0x1400acd04
mov ecx, r14d
call fcn.1400ace4c
mov ecx, 2
call fcn.1400b6164
nop
cmp byte [0x140100a80], 0
jne 0x1400acdce
mov r15d, 1
mov eax, r15d
xchg dword [0x140100a74], eax
test ebx, ebx
jne 0x1400acd77
mov rdi, qword [0x1400fd018]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140100a78]
cmp rcx, rax
je 0x1400acd6e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140016cd0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140100cc0]
jmp 0x1400acd83
cmp ebx, r15d
jne 0x1400acd89
lea rcx, [0x140100cd8]
call fcn.1400b2d80
nop
test ebx, ebx
jne 0x1400acda0
lea rdx, [0x1400c4f68]
lea rcx, [0x1400c4f48]
call fcn.1400b3118
lea rdx, [0x1400c4f78]
lea rcx, [0x1400c4f70]
call fcn.1400b3118
movzx eax, byte [0x140100a80]
test esi, esi
cmove eax, r15d
mov byte [0x140100a80], al
jmp 0x1400acdce
mov ecx, 2
call fcn.1400b61b8
test esi, esi
jne 0x1400acde5
mov ecx, r14d
call fcn.1400ace00
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400acc94
Function at 0x1800014f8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
mov rbp, rsp
sub rsp, 0x50
mov eax, 0x400
lea r8, [rbp - 0x18]
lea rcx, [0x18000d0c0]
mov edx, 0xe8a8e7
xor ebx, ebx
mov dword [rbp - 0x18], 0x3d400
mov dword [rbp - 0x14], eax
mov word [rbp - 0x10], 8
mov dword [rbp - 0xc], 0xef13
mov dword [rbp - 8], 1
mov dword [rbp - 0x30], 0xf10
mov dword [rbp - 0x2c], eax
mov word [rbp - 0x28], 8
mov dword [rbp - 0x24], 0x202
mov dword [rbp - 0x20], 1
call fcn.1800013cc
mov r12, rax
test rax, rax
je 0x180001628
lea r8, [rbp - 0x30]
lea rcx, [0x180e979b0]
mov edx, 0x1748
call fcn.1800013cc
mov rsi, rax
test rax, rax
je 0x180001620
mov r13d, dword [rbp - 0x30]
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1800015c9
mov r8d, r13d
mov rdx, rsi
mov rcx, rax
call fcn.180005420
jmp 0x1800015cc
mov rdi, rbx
test rdi, rdi
je 0x180001618
mov r9d, dword [rbp - 0x18]
mov r8, r12
mov edx, 1
xor ecx, ecx
call rdi
test rax, rax
je 0x180001618
xor r9d, r9d
mov r8d, 0x378
mov rcx, rax
lea edx, [r9 + 2]
call rdi
test rax, rax
je 0x180001618
mov rcx, qword [0x180e9a1b8]
mov edx, 0x3ec
call rax
test rax, rax
mov qword [0x180e9a1c0], rax
setne bl
mov rcx, rsi
call fcn.18000199c
mov rcx, r12
call fcn.18000199c
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r13
pop r12
pop rbp
ret
Function at 0x1800020c3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000c070]
jne 0x18000187a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001876
repz ret
ror rcx, 0x10
jmp 0x18000201c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180e991e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180e992d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800020a1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180e991e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800020c3
mov rax, qword [rsp + 0x88]
mov qword [0x180e992d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180e99278], rax
mov rax, qword [0x180e992d8]
mov qword [0x180e99150], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180e99260], rax
mov dword [0x180e99140], 0xc0000409
mov dword [0x180e99144], 1
mov rax, qword [0x18000c070]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000c078]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180e991d8], eax
mov ecx, 1
call fcn.180004d84
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800082e0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180e991d8], 0
jne 0x18000214a
mov ecx, 1
call fcn.180004d84
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret