joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004a00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140004a33
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140004a77
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x140004a72
cmp rbx, r11
jae 0x140004a77
add edi, 0xffffffff
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x140004a60
cmp rbx, r11
jb 0x140004a7b
xor eax, eax
jmp 0x140004a87
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005620
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140030f30]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x38]
mov rdi, r9
lea rdx, str.SOFTWARECypress_TouchPad_Driver
xor ebx, ebx
mov r9d, 0x201
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], r11
lea r9, [rsp + 0x30]
lea rdx, str.CyTpDll
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400056c9
lea r8, [rsp + 0x50]
mov edx, 0x104
mov rcx, rdi
call fcn.140013628
mov ebx, 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400133f0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x14000b2c8
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140008a4c
mov rsi, rax
test rax, rax
je 0x14000b344
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x14000b33f
cmp dword [rbx], 0x40
jb 0x14000b33f
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x14000b33f
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x14000b348
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140015470
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001adfc
nop
cmp dword [0x140036218], 1
je 0x14001541c
mov dword [0x140036214], 1
mov byte [0x140036210], r12b
test ebx, ebx
jne 0x140015408
mov rcx, qword [0x140038470]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400153f5
mov rcx, qword [0x140038468]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140015394
call fcn.1400173d0
cmp qword [rdi], rax
jne 0x140015394
jmp 0x14001537a
cmp rdi, rsi
jb 0x1400153f5
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.1400173d0
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140038470]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140038468]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400153d3
cmp r13, rax
je 0x1400153f3
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001537a
lea rdx, [0x140024800]
lea rcx, [0x1400247e8]
call fcn.1400151c4
lea rdx, [0x140024810]
lea rcx, [0x140024808]
call fcn.1400151c4
nop
test r12d, r12d
je 0x14001542b
mov ecx, 8
call fcn.14001acfc
test r12d, r12d
jne 0x140015456
mov dword [0x140036218], 1
lea ecx, [r12 + 8]
call fcn.14001acfc
mov ecx, r15d
call fcn.140015158
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400152e4

Function at 0x14001547c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400152e4
Function at 0x1400155b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140030f30]
jne 0x14001340a
rol rcx, 0x10
test cx, 0xffff
jne 0x140013406
repz ret
ror rcx, 0x10
jmp 0x140015510
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400362c0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1400363b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140015595
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400362c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400155b7
mov rax, qword [rsp + 0x88]
mov qword [0x1400363b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140036358], rax
mov rax, qword [0x1400363b8]
mov qword [0x140036230], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140036340], rax
mov dword [0x140036220], 0xc0000409
mov dword [0x140036224], 1
mov rax, qword [0x140030f30]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140030f38]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400362b8], eax
mov ecx, 1
call fcn.14001b1d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400277a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400362b8], 0
jne 0x14001563e
mov ecx, 1
call fcn.14001b1d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14001d07c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1400173d0
xor ebx, ebx
mov rdi, rax
cmp qword [0x140037110], rbx
jne 0x14001d182
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001d257
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001d257
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140037110], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140028918]
mov rcx, rsi
mov qword [0x140037118], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140037120], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140037130], rax
test rax, rax
je 0x14001d179
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140037128], rax
jmp 0x14001d189
mov rax, qword [0x140037128]
jmp 0x14001d190
mov rax, qword [0x140037128]
mov r11, qword [0x140037130]
cmp rax, rdi
je 0x14001d1f8
cmp r11, rdi
je 0x14001d1f8
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140037130]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001d1f8
test rax, rax
je 0x14001d1f8
call rsi
test rax, rax
je 0x14001d1f2
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001d1f2
test byte [rsp + 0x38], 1
jne 0x14001d1f8
bts ebp, 0x15
jmp 0x14001d236
mov rcx, qword [0x140037118]
cmp rcx, rdi
je 0x14001d236
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001d236
call rax
mov rbx, rax
test rax, rax
je 0x14001d236
mov rcx, qword [0x140037120]
cmp rcx, rdi
je 0x14001d236
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001d236
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140037110]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001d257
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001d259
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400015fc
Capabilities:
Find taskbar
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rdi, rax
jne 0x1400404da
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
xor ebx, ebx
test rax, rax
jne 0x1400404f3
lea rcx, str.Shell_TrayWnd
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
mov rsi, rax
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14004050e
mov edx, 9
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x140040638
xor edx, edx
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
mov rcx, rdi
mov r14d, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, 1
mov ecx, r14d
mov edx, eax
mov r8d, esi
mov r15d, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r8d, esi
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
jne 0x140040606
lea esi, [rax + 0x12]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea r8d, [rsi - 0x10]
xor r9d, r9d
mov edx, eax
mov cl, sil
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
test eax, eax
je 0x14004060b
lea ebx, [rsi - 0xe]
jmp 0x14004060b
mov ebx, 3
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, ebp
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor r8d, r8d
mov edx, r15d
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x14004063d
mov ebx, 2
mov eax, ebx
jmp 0x14000162e
Function at 0x140002014
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov esi, r9d
mov rbp, r8
test r8, r8
je 0x1400020cc
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x1400020cc
lea rax, [r11 - 0x18]
lea r9d, [rbx + 1]
xor r8d, r8d
mov qword [r11 - 0x28], rax
mov word [rdi], bx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400020cc
mov rcx, qword [rsp + 0x30]
lea eax, [rsi + rsi]
xor r9d, r9d
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400020a5
mov eax, dword [rsp + 0x60]
shr eax, 1
mov dword [rsp + 0x60], eax
cmp eax, esi
jae 0x1400020c7
mov word [rdi + rax*2], bx
mov bl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea eax, [rsi - 1]
jmp 0x14000209f
xor al, al
jmp 0x1400020b2
Function at 0x140002490
Capabilities:
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
mov edi, edx
test r8, r8
jne 0x140040bee
mov eax, dword [0x1400e4e98]
cmp eax, 0xffffffff
je 0x14000256a
movsxd rcx, eax
mov rax, qword [0x1400e4e80]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp byte [rbx + 0x6a], 0
mov rbp, qword [rbx]
je 0x1400024e4
cmp dword [rbx + 0x2b8], 0
mov byte [rbx + 0x6a], 0
jge 0x140040c08
cmp edi, 8
jg 0x140040c64
je 0x140002512
test edi, edi
je 0x140040c50
cmp edi, 1
je 0x140002512
mov edx, 6
cmp edi, 2
je 0x140002561
cmp edi, 3
je 0x140002558
jle 0x140002539
cmp edi, 5
jg 0x14000254e
cmp byte [rbx + 0x68], 0
jne 0x14000256a
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
lea eax, [rdi - 4]
test eax, 0xfffffffb
je 0x140002535
mov rdx, rbp
call fcn.1400015fc
mov byte [rbx + 0x68], 1
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp edi, edx
je 0x140040c37
jmp 0x140002539
mov byte [rbx + 0x68], 1
jmp 0x140040ccb
mov byte [rbx + 0x68], 1
jmp 0x140040c37
xor eax, eax
jmp 0x14000253e
lea rcx, [0x1400e4de0]
mov rdx, r8
call fcn.140004730
mov dword [0x1400e4e98], eax
jmp 0x1400024b0
cmp byte [rbx + 0x2c4], 0
je 0x1400024e4
mov r8d, dword [rbx + 0x2c0]
lea rcx, [0x1400e4de0]
mov rdx, rbx
call fcn.1400a4ed8
mov byte [rbx + 0x2c4], 0
jmp 0x1400024e4
cmp byte [rbx + 0x68], 0
je 0x14000256a
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
nop
jmp 0x140002539
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov byte [rbx + 0x68], 0
jmp 0x140002539
mov ecx, edi
sub ecx, 9
je 0x140040ccb
sub ecx, 0x37
je 0x140040cb7
dec ecx
je 0x140040cb3
dec ecx
je 0x140040ca0
dec ecx
jne 0x140002539
mov byte [rbx + 0x69], cl
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
nop
jmp 0x140002539
mov rcx, rbp
mov byte [rbx + 0x69], 1
call qword [sym.imp.USER32.dll_LockWindowUpdate]
nop
jmp 0x140002539
xor edx, edx
jmp 0x140040cbc
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_EnableWindow]
nop
jmp 0x140002539
cmp byte [rbx + 0x68], 0
je 0x14000256a
mov edx, edi
mov rcx, rbp
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, rbp
call fcn.1400015fc
nop
jmp 0x140002539
Function at 0x140004378
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [rdx]
mov rsi, rcx
lea rcx, [rbp + 0x20]
mov r14d, r8d
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rbp + 0x20]
lea rdx, [rbp + 0x20]
mov rcx, rbx
mov dword [rdi + 0x290], eax
mov eax, dword [rbp + 0x24]
mov dword [rdi + 0x294], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rbp + 0x24]
cmp eax, dword [rdi + 0x298]
jne 0x140004448
cmp ecx, dword [rdi + 0x29c]
jne 0x140004448
mov ecx, dword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [rsi + 0x1c]
movzx r15d, ax
shr r15d, 0xf
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
cmp r15d, dword [rdi + 0x2a0]
jne 0x140042c59
test r14d, r14d
je 0x140004418
mov dword [rdi + 0x2a0], r15d
cmp ebx, dword [rdi + 0x2a4]
jne 0x140042ce0
test r14d, r14d
je 0x14000442f
mov dword [rdi + 0x2a4], ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov dword [rdi + 0x298], eax
mov dword [rdi + 0x29c], ecx
cmp r14d, 1
jl 0x1400043df
jmp 0x140042c3c
mov dword [rsp + 0x20], ecx
mov r9d, eax
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff5
call fcn.14009df54
nop
jmp 0x1400043df
cmp r14d, 1
jl 0x14000440c
cmp byte [rdi + 0x2e0], 0
je 0x14000440c
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov dword [rsp + 0x20], eax
test r15d, r15d
je 0x140042c8d
mov edx, 0xfffffff9
jmp 0x140042ccf
mov edx, 0xfffffff8
call fcn.14009df54
cmp byte [rdi + 0x2a8], 0
je 0x140042cd4
mov rcx, qword [rdi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
bt eax, 0x18
mov eax, dword [rbp + 0x24]
mov rcx, rsi
mov dword [rsp + 0x20], eax
mov edx, 0xfffffffa
jb 0x140042ccf
mov edx, 0xfffffff4
call fcn.14009df54
mov byte [rdi + 0x2a8], 0
jmp 0x14000440c
cmp r14d, 1
jl 0x140004424
mov eax, dword [rbp + 0x24]
mov r9d, dword [rbp + 0x20]
mov r8, rdi
mov rcx, rsi
mov edx, 0xfffffff7
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140042d09
mov edx, 0xfffffff6
call fcn.14009df54
nop
jmp 0x140004424
Function at 0x14000534c
Capabilities:
Hide graphical window

Disassembly:
mov r11, rsp
sub rsp, 0x68
and qword [r11 - 0x10], 0
mov rax, qword [0x1400e44b8]
lea rdx, str.AutoIt_v3
mov qword [r11 - 0x18], rax
and qword [r11 - 0x20], 0
and qword [r11 - 0x28], 0
mov eax, 0x80000000
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], eax
mov r9d, 0xcf0000
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExW]
and qword [rsp + 0x58], 0
mov rcx, qword [0x1400e44b8]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea rdx, str.edit
mov r9d, 0x50b008c4
xor r8d, r8d
xor ecx, ecx
mov qword [0x1400e4510], rax
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, qword [0x1400e4510]
xor edx, edx
mov qword [0x1400e4508], rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1400e4510]
xor edx, edx
add rsp, 0x68
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x140005550
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1ff70]
mov eax, 0x20070
call fcn.140037140
sub rsp, rax
lea rcx, [rsp + 0x50]
mov rsi, rdx
call fcn.140009030
lea rdx, [rsp + 0x70]
xor bl, bl
mov ecx, 0x7fff
mov byte [rbp + 0x1ffa0], bl
xor dil, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x1ffb0]
mov rdx, rsi
call fcn.140005014
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400430ca
mov eax, dword [0x1400e4570]
test eax, eax
je 0x1400056e2
mov r15d, 1
lea rcx, [0x1400e6320]
cmp eax, r15d
je 0x1400430ec
lea rax, [rbp + 0x1ffa0]
lea r8, [0x1400e4570]
lea rdx, [0x1400e4598]
mov qword [rsp + 0x20], rax
call fcn.140007554
test al, al
je 0x1400056eb
mov al, byte [0x1400e6320]
mov rcx, qword [0x1400e4598]
mov dil, byte [0x1400e6321]
lea r9, [rbp + 0x1ffb8]
lea r8, [rbp + 0xff70]
mov edx, 0x7fff
mov byte [0x1400e4574], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rbp + 0x1ffb8]
lea rcx, [0x1400e4550]
call fcn.140009798
mov bl, byte [rbp + 0x1ffa0]
mov r8d, dword [0x1400e4570]
lea rdx, [0x1400e4598]
call fcn.1400120bc
test eax, eax
jne 0x140043110
cmp dil, r15b
je 0x140043133
call fcn.140005420
call fcn.14000534c
cmp byte [0x1400e4574], 0
jne 0x14000568f
lea rcx, [0x1400e4f50]
call fcn.140001b60
lea rcx, [0x1400e45c0]
mov edx, r15d
call fcn.1400121a0
cmp byte [0x1400e4574], 0
jne 0x1400056b3
lea rcx, [0x1400e4f50]
call fcn.140001cb0
lea rcx, [0x1400e6320]
call fcn.1400075ec
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x50]
call fcn.140006c8c
add rsp, 0x20070
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
or dword [0x1400e44c0], 0xffffffff
jmp 0x1400056bf
mov dword [0x1400e44c0], r15d
jmp 0x1400056bf
lea r8, [0x1400cf204]
lea rdx, str.This_is_a_third_party_compiled_AutoIt_script.
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x1400056ca
mov r8, qword [0x1400e4578]
or r9d, 0xffffffff
mov edx, r15d
call fcn.1400074a8
mov al, byte [0x1400e44c8]
mov byte [0x1400e6322], al
jmp 0x14000564c
lea rcx, [0x1400e6320]
call fcn.1400075ec
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400e44c0], r15d
jmp 0x1400056ca
call fcn.140073bf4
test al, al
jne 0x140005670
cmp byte [rbp + 0x1ffb0], al
jne 0x140005670
lea rcx, [rsp + 0x50]
call fcn.140023bc8
lea rdx, [0x1400cb800]
lea rcx, [rsp + 0x30]
call fcn.140009a5c
lea rcx, [rsp + 0x30]
test bl, bl
je 0x14004319b
lea rdx, [0x1400cf238]
call fcn.1400098c0
lea rdx, [0x1400e4598]
lea rcx, [rsp + 0x30]
call fcn.140009600
lea rdx, [0x1400cf238]
lea rcx, [rsp + 0x30]
jmp 0x14004319e
mov rdx, rsi
call fcn.1400098c0
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [rsp + 0x50]
mov rcx, rax
lea rax, [rsp + 0x70]
lea rdx, str.runas
mov r9, rbx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.140006c8c
nop
jmp 0x1400056b3
Function at 0x140005fec
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
and qword [rsp + 0x30], 0
cmp byte [rcx + 0x20], 0
mov r10, r9
mov r11, r8
mov rbx, rdx
jne 0x1400433a8
mov r9, qword [rsp + 0x50]
mov r8, r10
mov rdx, r11
mov rcx, rbx
call fcn.140029524
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx + 0x18]
imul r10d, r11d
lea r9, [rsp + 0x30]
mov rax, qword [rcx]
mov r8d, r10d
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rax, qword [rsp + 0x30]
jmp 0x14000601e
Function at 0x140007040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x10], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400070e8
xor edi, edi
test rsi, rsi
je 0x140007093
nop
mov eax, dword [rbx + 0x10]
cmp dword [rbx + 0x14], eax
je 0x1400070af
movsxd rdx, dword [rbx + 0x14]
mov rcx, qword [rbx + 8]
inc rdi
movzx edx, byte [rdx + rcx]
mov byte [rdi + rbp - 1], dl
inc dword [rbx + 0x14]
cmp rdi, rsi
jb 0x140007070
add qword [rbx + 0x18], rdi
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, 0x10000
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140007093
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140007093
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x14], 0
jmp 0x140007078
mov qword [rcx + 0x10], 0
call fcn.140007100
mov qword [rbx + 0x18], rax
jmp 0x140007067
Function at 0x140020510
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [rdx + 8]
mov r10, qword [rdx]
xor r8d, r8d
add eax, eax
mov r9d, 0x1505
movsxd rdx, eax
test eax, eax
jle 0x14002053c
movzx ecx, byte [r8 + r10]
imul r9d, r9d, 0x21
inc r8
add r9d, ecx
cmp r8, rdx
jl 0x140020528
mov eax, r9d
ret