joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400894e0
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edi, edi
mov rdx, qword [rcx + 0x30]
mov rbx, rcx
test rdx, rdx
je 0x14008951c
sub rdx, qword [rcx + 0x38]
lea r8d, [rdi + 1]
mov eax, dword [rcx + 0xc]
mov r9, qword [rcx]
sub rdx, rax
call qword [r9 + 0x28]
mov qword [rbx + 0x30], rdi
mov dword [rbx + 0xc], edi
mov r8d, dword [rbx + 0xc]
test r8d, r8d
je 0x14008953b
cmp qword [rbx + 0x30], rdi
jne 0x14008953b
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [rbx + 0x38]
call qword [rax + 0x20]
mov dword [rbx + 0xc], edi
mov rax, qword [rbx]
mov rcx, rbx
mov word [rbx + 0x2c], di
call qword [rax + 0x30]
mov r9, qword [rbx]
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov rdi, rax
call qword [r9 + 0x28]
test al, al
je 0x14008959c
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14008959c
mov rax, qword [rbx]
cmp rsi, rdi
mov rcx, rbx
cmovl rdi, rsi
xor r8d, r8d
mov rdx, rdi
call qword [rax + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + gethostname]
mov rbx, qword [rsp + 0x30]
or rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14008a160
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x40]
lea r9, [rsp + 0x40]
xor eax, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x14008cc10
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008ccf6
cmp word [rcx], 0
je 0x14008ccf6
mov r8d, 4
lea rdx, [0x1400ee4b8]
call fcn.1400b3f68
mov r8, rbx
test eax, eax
jne 0x14008cc53
lea r8, [rbx + 8]
test r8, r8
je 0x14008cc90
movzx edx, word [r8]
test dx, dx
je 0x14008cc90
lea rcx, [0x1400eb748]
mov eax, 0x3f
nop dword [rax]
cmp dx, ax
je 0x14008ccbb
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008cc70
movzx edx, word [r8 + 2]
add r8, 2
test dx, dx
jne 0x14008cc61
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
test rdi, rdi
je 0x14008cca2
mov dword [rdi], eax
xor eax, eax
cmp ecx, 0xffffffff
setne al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14008ccf6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x14008cce3
mov eax, dword [rsp + 0x20]
mov dword [rdi], eax
mov al, 1
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x14008d4c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x10020
call fcn.1400c1030
sub rsp, rax
mov rdi, rdx
mov r8d, 0x7fff
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x14008d514
lea r8d, [rax + 1]
mov rcx, rdi
add r8, r8
lea rdx, [rsp + 0x20]
call fcn.1400a9ee0
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
xor eax, eax
mov word [rdi], ax
mov eax, ebx
mov rbx, qword [rsp + 0x10030]
add rsp, 0x10020
pop rdi
ret
Function at 0x14008dd70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x50
xor ebx, ebx
mov esi, r9d
mov r15d, r8d
mov ebp, edx
mov r13, rcx
mov r12d, ebx
test rcx, rcx
je 0x14008ddac
xor edx, edx
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
jmp 0x14008ddb3
mov rdi, qword [0x140105e30]
test rdi, rdi
je 0x14008df6b
mov qword [rsp + 0x80], r14
lea r14, [0x140108264]
test ebp, ebp
jns 0x14008ddda
movzx eax, bp
neg ax
movzx edx, ax
jmp 0x14008de10
test ebp, ebp
mov dword [rsp + 0x44], ebx
mov eax, 1
mov qword [rsp + 0x48], r14
cmovne eax, ebp
lea r9, [rsp + 0x40]
lea r8, [0x14008dd50]
mov dword [rsp + 0x40], eax
mov edx, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov rdx, qword [rsp + 0x48]
cmp rdx, r14
je 0x14008df34
mov r8d, SafeArrayGetElemsize
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x14008df34
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008df34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008df34
cmp r15d, 0xffffffff
cmovne esi, r15d
test esi, esi
jne 0x14008de72
lea ecx, [rsi + 0xb]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
movzx eax, word [r14 + 4]
lea rcx, [r14 + 6]
cmp eax, 1
jbe 0x14008dec5
lea r8, [rcx + 0xe]
dec eax
mov r9, r8
mov r10d, eax
nop dword [rax]
movzx eax, byte [r8]
movzx edx, byte [rcx]
cmp al, dl
jbe 0x14008dea7
movzx eax, dl
mov edx, ebx
cmp eax, esi
setl dl
jmp 0x14008deb1
movzx eax, al
mov edx, ebx
cmp eax, esi
setge dl
test edx, edx
cmovne rcx, r9
add r9, 0xe
add r8, 0xe
sub r10, 1
jne 0x14008de90
movzx edx, word [rcx + 0xc]
mov r8d, 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
je 0x14008df34
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008df34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
je 0x14008df34
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x30], ebx
mov r9d, 0x30000
mov edx, eax
mov dword [rsp + 0x28], ebx
mov r8d, 1
mov dword [rsp + 0x20], ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov r12, rax
mov rcx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x80]
test rcx, rcx
je 0x14008df53
test r12, r12
je 0x14008df53
mov qword [rcx], rdi
jmp 0x14008df61
test r13, r13
je 0x14008df61
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12, r12
je 0x14008df6b
mov rax, r12
jmp 0x14008df88
test ebp, ebp
jle 0x14008df74
lea ebx, [rbp - 1]
jmp 0x14008df7a
cmp ebp, 0xffffffff
cmovl ebx, ebp
mov r8d, ebx
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ExtractIconW]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14008eb30
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x14008eb4a
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x14008eb54
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x14008ebd6
test al, 8
jne 0x14008ebd1
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
shr r8, 1
movzx eax, word [rdx]
movzx ecx, word [rdx + r8*2 - 2]
cmp eax, 0x20
je 0x14008eb92
cmp eax, 9
je 0x14008eb92
cmp ecx, 0x20
je 0x14008eb92
cmp ecx, 9
je 0x14008eb92
cmp eax, 0x30
je 0x14008eb92
cmp eax, 0x2b
jne 0x14008ebd1
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov rcx, rdi
call fcn.14008f420
test eax, eax
jne 0x14008ebb3
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1400012b0
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x14008ebb6
test al, 0x20
je 0x14008ec28
mov rcx, rdi
test al, 8
jne 0x14008ec14
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008f420
test eax, eax
je 0x14008eba6
movsd xmm0, qword [rbx]
mov r8b, 0x20
movsd qword [rsp + 0x40], xmm0
mov rcx, rdi
mov rdx, qword [rsp + 0x40]
jmp 0x14008ebbc
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x14008ebbc
test al, 1
je 0x14008ec41
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008f150
test al, 2
je 0x14008ec66
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.14008f7a0
cmp byte [rbx + 0x23], 0
jne 0x14008ec72
mov rax, qword [rbx + 0x10]
jmp 0x14008ec75
mov rax, rbx
test byte [rax + 0x21], 4
je 0x14008ec83
mov rdx, rbx
call fcn.140039f30
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov rdx, qword [rbx + 8]
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.14008f420
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14008ecb0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
sub r8d, 1
je 0x14008ed95
sub r8d, 1
je 0x14008ed81
sub r8d, 2
je 0x14008ed6f
sub r8d, 1
je 0x14008ed0f
cmp r8d, 1
jne 0x14008ed50
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008f7a0
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x14008ed50
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x14008ed95
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
mov rdx, rax
call fcn.14008f420
test eax, eax
jne 0x14008ed44
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x14008ed98
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008f420
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008eb30
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x14008ed9b
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.1400012b0
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x14008f150
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14008f170
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x14008f166
cmp byte [rdx + 0x23], 0
jne 0x14008f17a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001350
cmp byte [rbx + 0x23], 1
jne 0x14008f1e7
cmp rbx, rdi
je 0x14008f1d7
mov rax, qword [rdi + 0x10]
mov r9b, 1
mov r8, rax
mov byte [rsp + 0x20], 0
shr r8, 1
and eax, 1
add r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14008f420
test eax, eax
jne 0x14008f1be
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
add r8, 2
mov rcx, qword [rbx + 8]
call fcn.1400a9ee0
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.14008f200
Function at 0x14008f200
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
lea rcx, [0x140108f60]
call fcn.140005730
test eax, eax
jne 0x14008f23d
lea r8, [0x1400cfffc]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x140108310]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.1400393c0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea r14, [rsi + rbx]
xor r12d, r12d
lea rbx, [rsi + 4]
cmp rbx, r14
ja 0x14008f302
mov r15d, dword [rsi]
test r15d, r15d
je 0x14008f302
mov rax, rbx
add rbx, 8
cmp rbx, r14
ja 0x14008f302
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, r14
ja 0x14008f302
mov rdx, r12
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
test rax, rax
je 0x14008f3c0
test rdi, rdi
je 0x14008f2e9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x14008f361
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.1400a9ee0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, rbp
mov ecx, r15d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, r14
jbe 0x14008f270
cmp dword [0x140108f8c], r12d
je 0x14008f33c
cmp qword [0x140108f70], r12
je 0x14008f328
mov rcx, qword [0x140108f60]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f70], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f8c], r12d
mov qword [0x140108f60], r12
mov eax, 1
mov r14, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140108f8c], r12d
je 0x14008f3a4
cmp qword [0x140108f70], r12
je 0x14008f390
mov rcx, qword [0x140108f60]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f70], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f8c], r12d
mov qword [0x140108f60], r12
lea r8, [0x1400cfffc]
lea rdx, [0x1400d02c8]
lea rcx, [0x140108310]
call fcn.1400393c0
jmp 0x14008f341
cmp dword [0x140108f8c], r12d
je 0x14008f3fa
cmp qword [0x140108f70], r12
je 0x14008f3e6
mov rcx, qword [0x140108f60]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140108f70], r12
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140108f8c], r12d
mov qword [0x140108f60], r12
lea r8, [0x1400cfffc]
lea rdx, str.Out_of_memory.
lea rcx, [0x140108310]
call fcn.1400393c0
jmp 0x14008f341
Function at 0x14008f870
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbx, rdx
movzx ecx, byte [rcx + 0x23]
test ecx, ecx
je 0x14008fab0
mov qword [rsp + 0x50], rsi
sub ecx, 1
je 0x14008f90d
sub ecx, 1
je 0x14008f8d6
cmp ecx, 1
je 0x14008f8ba
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f8c4
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140108f60]
call fcn.140004ff0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x14008fa50
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001350
cmp dword [0x140106b88], 0
jne 0x14008fa0e
cmp qword [rdi + 0x10], 0
jne 0x14008fa0e
cmp qword [0x14010a8f0], rdi
jne 0x14008f93b
test rbx, rbx
jne 0x14008f9ba
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14008f9b5
xor esi, esi
mov qword [0x14010a8f0], rsi
test rbx, rbx
je 0x14008f9a3
mov edx, dword [0x140106b98]
test edx, edx
je 0x14008f985
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x140108310]
mov qword [rsp + 0x20], rsi
call fcn.140039de0
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.14008d4c0
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x14008f9f5
cmp byte [rdi + 0x23], 0
jne 0x14008f9c6
mov rax, qword [rdi + 0x10]
jmp 0x14008f9c9
mov rax, rdi
test byte [rax + 0x21], 4
je 0x14008f9d7
mov rdx, rdi
call fcn.140039f30
xor esi, esi
mov word [rbx], si
xor eax, eax
mov qword [0x14010a8f0], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
xor eax, eax
mov qword [0x14010a8f0], rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x14008faab
test r8, r8
jne 0x14008fa60
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x14008fa46
mov rdx, rdi
call fcn.140039f30
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x14008faab
cmp r8, 0x186a0
jae 0x14008fa9d
movzx eax, word [rdx]
test ax, ax
je 0x14008fa93
nop word [rax + rax]
mov word [rbx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rbx, 2
test ax, ax
jne 0x14008fa80
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x14008fa4b
mov rcx, rbx
call fcn.1400a9ee0
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x14008fa4b
mov rcx, qword [rdi + 0x10]
call fcn.14008f870
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400905b0
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x1400905c6
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x30], r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401082f0]
mov r15d, eax
je 0x1400905f7
mov rcx, rbx
call fcn.140091990
test al, al
je 0x1400905f7
xor eax, eax
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
test rax, rax
jne 0x14009061c
xor edx, edx
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x140090637
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rsi
jne 0x14009064f
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
cmp byte [0x140106b8f], 0
jne 0x14009066c
mov rdx, rsi
mov rcx, rbx
call fcn.140090510
test rax, rax
jne 0x1400907bb
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
xor r12b, r12b
mov qword [rsp + 0x40], r13
xor r13b, r13b
mov qword [rsp + 0x38], r14
test rsi, rsi
je 0x1400906f5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400906fa
cmp dword [0x1401082f0], eax
je 0x1400906d1
mov rcx, rsi
call fcn.140091990
test al, al
jne 0x1400906d1
mov ecx, dword [0x1401082f0]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x1400906fa
cmp r14d, r15d
je 0x1400906fa
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x1400906fa
mov r14d, dword [rsp + 0x60]
xor edi, edi
nop dword [rax]
mov rdx, rsi
mov rcx, rbx
call fcn.140090510
mov rbp, rax
test rax, rax
jne 0x140090762
inc edi
cmp edi, 5
jl 0x140090700
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rax + 2]
call fcn.140012d30
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [rbp + 2]
call fcn.140012d30
mov rdx, rsi
mov rcx, rbx
call fcn.140090510
mov rbp, rax
mov rdi, qword [rsp + 0x78]
test r12b, r12b
mov r12, qword [rsp + 0x48]
je 0x140090783
mov ecx, dword [0x1401082f0]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x40]
je 0x14009079c
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x38]
test rbp, rbp
je 0x1400907b4
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rbp
jmp 0x1400907b6
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret
Function at 0x140090910
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbx, rcx
test r8b, r8b
je 0x140090930
call fcn.140065460
jmp 0x140090940
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor edi, edi
test esi, esi
cmovns edi, esi
test edi, edi
je 0x14009099c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001720
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14009099c
add edi, esi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x14009099c
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001720
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140090971
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140090b80
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1400c1030
sub rsp, rax
mov r10, qword [rbp + 0x11c10]
mov rdi, rcx
movzx ecx, word [rdx]
mov r11d, 0xffdf
lea eax, [rcx - 0x41]
test r11w, ax
jne 0x140090c34
cmp word [rdx + 2], 0
jne 0x140090c34
cmp word [r8], 0
jne 0x140090c34
cmp word [r9], 0
jne 0x140090c34
cmp word [r10], 0
jne 0x140090c34
mov qword [rsp + 0x11cf0], rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x140090c03
cmp byte [rdi + 0x12a], 0
jne 0x140090c03
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
cmp byte [rbp + 0x11c20], 0
je 0x140090c18
test rbx, rbx
je 0x140090c18
mov qword [rdi + 0xf8], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x11cf0]
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
test cx, cx
jne 0x140090c64
cmp word [r8], cx
jne 0x140090c64
cmp word [r9], cx
jne 0x140090c64
cmp word [r10], cx
jne 0x140090c64
mov rcx, rdi
call fcn.140090de0
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
xor ecx, ecx
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r9
lea rax, [0x1400cfffc]
mov r9, r8
mov dword [rsp + 0x30], ecx
mov r8, rdx
mov byte [rbp + 0x1781], cl
mov dword [rbp + 0x1784], ecx
xorps xmm0, xmm0
mov qword [rbp + 0x1788], rcx
mov rdx, rdi
mov dword [rbp + 0x17a0], ecx
mov qword [rbp + 0x17a8], rcx
mov qword [rbp + 0x17b8], rcx
mov qword [rbp + 0x17c0], rcx
lea rcx, [rsp + 0x30]
mov qword [rbp + 0xf48], rax
movdqa xmmword [rbp + 0x1790], xmm0
call fcn.140091bb0
test eax, eax
je 0x140090d86
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x140090d99
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x140090d5b
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140090d86
cmp byte [rdi + 0x12a], 0
jne 0x140090d54
mov rcx, qword [rbp + 0xf68]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x140090d54
mov rcx, qword [rbp + 0xf68]
lea edx, [rax - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140090d86
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x140090d75
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.140092050
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140092140
test rax, rax
jne 0x140090dab
xor eax, eax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret
lea rdx, [rsp + 0x30]
lea rcx, [0x140090e70]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rbp + 0x11c20], 0
mov rax, qword [rbp + 0x1788]
je 0x140090dc7
test rax, rax
je 0x140090dc7
mov qword [rdi + 0xf8], rax
mov rdi, qword [rsp + 0x11cf8]
add rsp, 0x11ce0
pop rbp
ret