joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e92d0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp byte [rdx + 0x23], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1400e92ea
mov rbx, qword [rdx + 0x10]
cmp byte [rcx + 0x23], 0
jne 0x1400e92f4
mov rdi, qword [rcx + 0x10]
movzx eax, byte [rbx + 0x21]
test al, 0x10
je 0x1400e9379
test al, 8
jne 0x1400e9374
mov rax, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
movzx ecx, word [rax]
shr r8, 1
movzx edx, word [rax + r8*2 - 2]
cmp ecx, 0x20
je 0x1400e9332
cmp ecx, 9
je 0x1400e9332
cmp edx, 0x20
je 0x1400e9332
cmp edx, 9
je 0x1400e9332
cmp ecx, 0x30
je 0x1400e9332
cmp ecx, 0x2b
jne 0x1400e9374
xor r9d, r9d
mov rdx, rax
mov rcx, rdi
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
test eax, eax
jne 0x1400e9356
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140001370
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
jmp 0x1400e9359
test al, 0x20
je 0x1400e93cb
mov rcx, rdi
test al, 8
jne 0x1400e93b7
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
xor r9d, r9d
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
test eax, eax
je 0x1400e9349
movsd xmm0, qword [rbx]
mov r8b, 0x20
mov rcx, rdi
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x1400e935f
movsd xmm0, qword [rbx]
mov r8b, 0x28
movsd qword [rsp + 0x40], xmm0
mov rdx, qword [rsp + 0x40]
jmp 0x1400e935f
test al, 1
je 0x1400e93e4
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400e98e0
test al, 2
je 0x1400e9409
mov rbx, qword [rbx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.1400e9f40
cmp byte [rbx + 0x23], 0
jne 0x1400e9415
mov rax, qword [rbx + 0x10]
jmp 0x1400e9418
mov rax, rbx
test byte [rax + 0x21], 4
je 0x1400e9426
mov rcx, rbx
call fcn.14003e180
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov rcx, rdi
shr r8, 1
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400e9450
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rdx + 0x10]
mov rbx, rdx
mov rdi, rcx
dec r8d
je 0x1400e9531
dec r8d
je 0x1400e951d
sub r8d, 2
je 0x1400e950b
dec r8d
je 0x1400e94ab
dec r8d
jne 0x1400e94ec
mov rbx, qword [rdx]
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + VariantCopy]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400e9f40
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x1400e94ec
mov rax, qword [rbx]
cmp word [rax], 0x30
jne 0x1400e9531
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rdx, rax
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
test eax, eax
jne 0x1400e94e0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 8]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rdi
jmp 0x1400e9534
mov rdx, qword [rbx]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400e9bc0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400e92d0
movsd xmm0, qword [rdx]
mov r8b, 0x28
movsd qword [rsp + 0x48], xmm0
mov rdx, qword [rsp + 0x48]
jmp 0x1400e9537
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rdx, qword [rdx]
call fcn.140001370
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1400e98e0
Capabilities:
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x23], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400e9900
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 0
je 0x1400e98f6
cmp byte [rdx + 0x23], 0
jne 0x1400e990a
mov rdi, qword [rdx + 0x10]
mov rcx, rdi
call fcn.140001410
cmp byte [rbx + 0x23], 1
jne 0x1400e9977
cmp rbx, rdi
je 0x1400e9967
mov rax, qword [rdi + 0x10]
mov r9b, 1
xor edx, edx
mov r8, rax
and eax, 1
mov rcx, rbx
shr r8, 1
mov byte [rsp + 0x20], 0
add r8, rax
call fcn.1400e9bc0
test eax, eax
jne 0x1400e994e
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, qword [rbx + 8]
add r8, 2
call fcn.140109100
or byte [rbx + 0x21], 1
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400e9990
Function at 0x1400e9990
Capabilities:
Write clipboard data

Disassembly:
push rbx
push rsi
sub rsp, 0x28
mov rsi, rcx
lea rcx, [0x140171f30]
mov rbx, rdx
call fcn.140005e50
test eax, eax
jne 0x1400e99cd
lea r8, [0x1401295d4]
lea rdx, str.Cant_open_clipboard_for_writing.
lea rcx, [0x1401712e0]
add rsp, 0x28
pop rsi
pop rbx
jmp fcn.1400a5580
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], r14
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea rbp, [rsi + rbx]
lea rbx, [rsi + 4]
xor r14d, r14d
cmp rbx, rbp
ja 0x1400e9a92
mov r13d, dword [rsi]
test r13d, r13d
je 0x1400e9a92
mov rax, rbx
add rbx, 8
cmp rbx, rbp
ja 0x1400e9a92
mov edi, dword [rax]
mov rsi, rbx
add rbx, rdi
cmp rbx, rbp
ja 0x1400e9a92
mov rdx, r14
test rdi, rdi
mov ecx, 0x42
sete dl
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x1400e9b5b
test rdi, rdi
je 0x1400e9a79
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400e9af1
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.140109100
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, rbx
mov rdx, r12
mov ecx, r13d
call qword [sym.imp.USER32.dll_SetClipboardData]
lea rbx, [rsi + 4]
cmp rbx, rbp
jbe 0x1400e9a00
cmp dword [0x140171f5c], r14d
je 0x1400e9acc
cmp qword [0x140171f40], r14
je 0x1400e9ab8
mov rcx, qword [0x140171f30]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140171f40], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140171f5c], r14d
mov qword [0x140171f30], r14
mov eax, 1
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x140171f5c], r14d
je 0x1400e9b34
cmp qword [0x140171f40], r14
je 0x1400e9b20
mov rcx, qword [0x140171f30]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140171f40], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140171f5c], r14d
mov qword [0x140171f30], r14
lea rcx, [0x140129a08]
call fcn.1400dd2e0
lea r8, [0x1401295d4]
lea rcx, [0x1401712e0]
mov rdx, rax
call fcn.1400a5580
jmp 0x1400e9ad1
cmp dword [0x140171f5c], r14d
je 0x1400e9b95
cmp qword [0x140171f40], r14
je 0x1400e9b81
mov rcx, qword [0x140171f30]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov qword [0x140171f40], r14
call qword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x140171f5c], r14d
mov qword [0x140171f30], r14
lea r8, [0x1401295d4]
lea rdx, str.Out_of_memory.
lea rcx, [0x1401712e0]
call fcn.1400a5580
jmp 0x1400e9ad1
Function at 0x1400eadf0
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
test rcx, rcx
jne 0x1400eae06
xor eax, eax
add rsp, 0x50
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], r13
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x1401712b8]
mov r13d, eax
je 0x1400eae37
mov rcx, rbx
call fcn.1400ecaa0
test al, al
je 0x1400eae37
xor eax, eax
mov r13, qword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rbp
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400eae60
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400eae78
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x50
pop rbx
ret
cmp byte [0x14016f9c8], 0
jne 0x1400eae95
mov rdx, rbp
mov rcx, rbx
call fcn.1400ead50
test rax, rax
jne 0x1400eafe0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
xor r15b, r15b
xor r14b, r14b
test rbp, rbp
je 0x1400eaf1e
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r12d, eax
test eax, eax
je 0x1400eaf23
cmp dword [0x1401712b8], eax
je 0x1400eaefa
mov rcx, rbp
call fcn.1400ecaa0
test al, al
jne 0x1400eaefa
mov ecx, dword [0x1401712b8]
mov r8d, 1
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r14b
test r13d, r13d
je 0x1400eaf23
cmp r12d, r13d
je 0x1400eaf23
mov r8d, 1
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r15b
jmp 0x1400eaf23
mov r12d, dword [rsp + 0x60]
xor edi, edi
mov rdx, rbp
mov rcx, rbx
call fcn.1400ead50
mov rsi, rax
test rax, rax
jne 0x1400eaf87
inc edi
cmp edi, 5
jl 0x1400eaf25
xor r8d, r8d
lea ecx, [rax + 2]
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140016430
xor r8d, r8d
lea ecx, [rsi + 2]
xor r9d, r9d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], r8b
call fcn.140016430
mov rdx, rbp
mov rcx, rbx
call fcn.1400ead50
mov rsi, rax
mov rdi, qword [rsp + 0x78]
test r14b, r14b
mov r14, qword [rsp + 0x38]
je 0x1400eafa8
mov ecx, dword [0x1401712b8]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r15b, r15b
mov r15, qword [rsp + 0x30]
je 0x1400eafc1
xor r8d, r8d
mov edx, r13d
mov ecx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r12, qword [rsp + 0x48]
test rsi, rsi
je 0x1400eafd9
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rsi
jmp 0x1400eafdb
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov r13, qword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
Function at 0x1400eb140
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
test r8b, r8b
je 0x1400eb15b
call fcn.1400794f0
jmp 0x1400eb16b
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
test edi, edi
js 0x1400eb1de
je 0x1400eb1de
mov qword [rsp + 0x30], rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001760
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400eb1cb
add edi, esi
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x1400eb1cb
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001760
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400eb1a0
mov rax, rbx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400eb3f0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x11be0]
mov eax, 0x11ce0
call fcn.1401110b0
sub rsp, rax
movzx eax, word [rdx]
mov rdi, rcx
mov rcx, qword [rbp + 0x11c10]
cmp ax, 0x41
je 0x1400eb429
cmp ax, 0x61
jne 0x1400eb493
cmp word [rdx + 2], 0
jne 0x1400eb493
cmp word [r8], 0
jne 0x1400eb493
cmp word [r9], 0
jne 0x1400eb493
cmp word [rcx], 0
jne 0x1400eb493
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
test rax, rax
je 0x1400eb476
cmp byte [rdi + 0x12a], 0
jne 0x1400eb476
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400eb474
mov rcx, rbx
call fcn.1400ecb60
test al, al
je 0x1400eb476
xor ebx, ebx
cmp byte [rbp + 0x11c20], 0
je 0x1400eb48b
test rbx, rbx
je 0x1400eb48b
mov qword [rdi + 0xf8], rbx
mov rax, rbx
jmp 0x1400eb601
test ax, ax
jne 0x1400eb4b6
cmp word [r8], ax
jne 0x1400eb4b6
cmp word [r9], ax
jne 0x1400eb4b6
cmp word [rcx], ax
jne 0x1400eb4b6
mov rcx, rdi
call fcn.1400eb620
jmp 0x1400eb601
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea rax, [0x1401295d4]
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdx
lea rcx, [rsp + 0x30]
mov rdx, rdi
mov dword [rsp + 0x30], ebx
mov qword [rbp + 0xf48], rax
mov byte [rbp + 0x1781], bl
mov dword [rbp + 0x1784], ebx
mov qword [rbp + 0x1788], rbx
mov qword [rbp + 0x1790], rbx
mov qword [rbp + 0x1798], rbx
mov dword [rbp + 0x17a0], ebx
mov qword [rbp + 0x17a8], rbx
mov qword [rbp + 0x17b8], rbx
mov qword [rbp + 0x17c0], rbx
call fcn.1400ecd90
test eax, eax
je 0x1400eb5d0
test byte [rsp + 0x30], 2
movzx eax, byte [rbp + 0x11c18]
mov byte [rbp + 0x1781], al
mov rax, qword [rbp + 0x11c28]
mov qword [rbp + 0x1798], rax
mov eax, dword [rbp + 0x11c30]
mov dword [rbp + 0x17a0], eax
je 0x1400eb5d4
mov rax, qword [rbp + 0xf68]
cmp rax, 0xffff
je 0x1400eb5a5
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400eb5d0
mov rdx, qword [rbp + 0xf68]
mov rcx, rdi
call fcn.1400ecc00
test al, al
jne 0x1400eb59e
mov rcx, qword [rbp + 0xf68]
lea edx, [rbx - 0x10]
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x1400eb5d0
mov rax, qword [rbp + 0xf68]
cmp qword [rbp + 0x17c0], rax
je 0x1400eb5bf
lea rcx, [rsp + 0x30]
mov qword [rbp + 0x17c0], rax
call fcn.1400ed290
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.1400ed380
test rax, rax
jne 0x1400eb5e6
xor eax, eax
jmp 0x1400eb601
lea rdx, [rsp + 0x30]
lea rcx, [0x1400eb6d0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x1788]
cmp byte [rbp + 0x11c20], bl
je 0x1400eb601
test rax, rax
je 0x1400eb601
mov qword [rdi + 0xf8], rax
lea r11, [rsp + 0x11ce0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400ed290
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x1890]
test rcx, rcx
je 0x1400ed36d
mov eax, dword [rbx]
test eax, eax
je 0x1400ed36d
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rsp + 0x40], rdi
test al, 1
jne 0x1400ed2cf
mov rax, qword [rbx + 0x1018]
cmp word [rax], si
je 0x1400ed2ed
lea rdx, [rbx + 0x189c]
mov r8d, 0x7fff
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x1400ed2ed
mov word [rbx + 0x189c], si
test byte [rbx], 4
je 0x1400ed306
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1898]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test byte [rbx], 0x20
je 0x1400ed344
mov rcx, qword [rbx + 0x1890]
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1400ed344
movzx r8d, byte [rbx + 0x1850]
mov ecx, dword [rsp + 0x30]
lea rdx, [rbx + 0x11a9c]
call fcn.140071c00
test eax, eax
jne 0x1400ed344
mov word [rbx + 0x11a9c], si
test byte [rbx], 8
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
je 0x1400ed36d
mov rcx, qword [rbx + 0x1890]
lea rdx, [rbx + 0x1189a]
mov r8d, 0x101
call qword [sym.imp.USER32.dll_GetClassNameW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400edbe0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11cd8
call fcn.1401110b0
sub rsp, rax
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400edc9f
xor r9d, r9d
lea rcx, [0x1401295d4]
mov word [rsp + 0x18a0], dx
mov qword [rsp + 0x1038], rcx
lea rdx, [rsp + 0x20]
lea rcx, [0x1400ee4f0]
mov dword [rsp + 0x20], r9d
mov byte [rsp + 0x1871], r9b
mov dword [rsp + 0x1874], r9d
mov qword [rsp + 0x1878], r9
mov qword [rsp + 0x1880], r9
mov qword [rsp + 0x1888], r9
mov dword [rsp + 0x1890], r9d
mov qword [rsp + 0x18a8], r9
mov qword [rsp + 0x18b0], r9
mov qword [rsp + 0x1898], rax
mov dword [rsp + 0x18a4], r8d
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rsp + 0x1878], 0
je 0x1400edc9f
mov rax, qword [0x140169c00]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400edc9f
mov edx, 1
call fcn.140001760
mov eax, 1
add rsp, 0x11cd8
ret
Function at 0x1400edcb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
movzx r12d, dl
mov rbx, rcx
jne 0x1400edcda
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140169c00]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call fcn.1400ee250
cmp byte [rbx], 0
mov rbp, rax
je 0x1400edd11
test rax, rax
jne 0x1400edd1a
jmp 0x1400eddb2
test rax, rax
jne 0x1400eddad
test rdi, rdi
je 0x1400eddad
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, 1
mov ecx, 0x8000012f
mov esi, eax
call fcn.140001760
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400edd8f
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [rsi + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x1400edd8f
mov edx, 1
mov ecx, 0x8000012f
call fcn.140001760
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1400edd60
mov rax, qword [0x140169c00]
mov rsi, qword [rsp + 0x38]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400eddad
mov edx, 1
call fcn.140001760
cmp byte [rbx], 0
je 0x1400eddc6
xor r9d, r9d
mov r8, rbp
movzx edx, r12b
mov rcx, rbx
call fcn.1400eddf0
jmp 0x1400eddd2
movzx edx, r12b
mov rcx, rbx
call fcn.1400edfc0
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1400edfc0
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x11ce0
call fcn.1401110b0
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx edi, dl
mov rbx, rcx
je 0x1400ee185
xor edx, edx
call fcn.1400ee1a0
test eax, eax
jne 0x1400ee000
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
mov qword [rsp + 0x11cf0], rbp
mov qword [rsp + 0x11cf8], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x140169c00]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400ee250
mov ecx, dword [0x140171294]
xor ebp, ebp
test rax, rax
lea rax, [0x1401295d4]
cmovne ecx, ebp
mov qword [rsp + 0x1048], rax
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x1884], ebp
mov qword [rsp + 0x1888], rbp
mov qword [rsp + 0x1890], rbp
mov dword [0x140171294], ecx
mov qword [rsp + 0x18b8], rbp
mov qword [rsp + 0x18c0], rbp
test dil, dil
je 0x1400ee08a
mov byte [rsp + 0x1881], bpl
test ecx, ecx
je 0x1400ee092
mov byte [rsp + 0x1881], 1
mov rax, qword [0x1401712a0]
mov dword [rsp + 0x18a0], ecx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x1898], rax
mov rax, qword [rbx + 0x10]
lea rcx, [0x1400ee370]
mov qword [rsp + 0x18a8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1888]
test rax, rax
je 0x1400ee149
lea rdx, [rsp + 0x20]
lea rcx, [0x1400ec9e0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbp
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x28]
test rbx, rbx
je 0x1400ee110
mov rcx, qword [rsp + 0x1888]
call fcn.1400ed8f0
mov qword [rsp + 0x1888], rbx
jmp 0x1400ee118
mov rbx, qword [rsp + 0x1888]
mov rcx, rbx
call fcn.1400eadf0
mov rcx, qword [rsp + 0x1888]
call fcn.1400ed8f0
mov r11, qword [0x140169c00]
mov ecx, dword [r11 + 0x74]
cmp ecx, 0xffffffff
jle 0x1400ee175
mov edx, 1
call fcn.140001760
jmp 0x1400ee175
mov eax, dword [0x140171294]
test eax, eax
je 0x1400ee175
cmp eax, 1
mov dword [0x140171294], ebp
setg al
test al, al
je 0x1400ee175
mov rcx, rsi
call fcn.1400ed8f0
xor edx, edx
mov rcx, rbx
call fcn.1400edfc0
mov rsi, qword [rsp + 0x11cf8]
mov rbp, qword [rsp + 0x11cf0]
mov eax, 1
mov rbx, qword [rsp + 0x11d00]
add rsp, 0x11ce0
pop rdi
ret
Function at 0x1400f0680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov dword [rcx + 0x6afc8], 2
mov esi, ebp
mov edi, ebp
cmp dword [rcx + 0x6afd8], ebp
je 0x1400f08ac
cmp dword [rbx + 0x6afd8], 3
jb 0x1400f0711
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, 0x7fff
and r8d, 0x7fff
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov esi, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], esi
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
test esi, esi
je 0x1400f074f
mov eax, dword [rbx + 0x6afcc]
sub eax, esi
cmp eax, 0x7efa
ja 0x1400f074f
mov eax, dword [rbx + 0x6afd8]
cmp dword [rbx + 0x6afe8], eax
jbe 0x1400f0738
mov dword [rbx + 0x6afe8], eax
mov edx, esi
mov rcx, rbx
call fcn.1400f0330
mov ecx, dword [rbx + 0x6afd8]
cmp eax, ecx
mov edi, eax
cmova edi, ecx
mov rcx, rbx
cmp edi, 3
jb 0x1400f082a
mov edx, dword [rbx + 0x6afcc]
lea r8d, [rdi - 3]
sub edx, dword [rbx + 0x6afd0]
call fcn.1400ef960
sub dword [rbx + 0x6afd8], edi
mov r11d, eax
cmp edi, dword [rbx + 0x6afe0]
ja 0x1400f07f1
cmp dword [rbx + 0x6afd8], 3
jb 0x1400f07f1
dec edi
nop dword [rax]
inc dword [rbx + 0x6afcc]
mov r8d, dword [rbx + 0x6afcc]
lea eax, [r8 + 2]
and r8d, 0x7fff
movzx edx, byte [rax + rbx + 0x1afb8]
mov eax, dword [rbx + 0x6afc4]
shl eax, 5
xor edx, eax
and edx, 0x7fff
dec edi
mov eax, edx
mov dword [rbx + 0x6afc4], eax
mov esi, dword [rbx + rdx*4 + 0x4afb8]
mov dword [rbx + r8*4 + 0x2afb8], esi
mov ecx, dword [rbx + 0x6afc4]
mov eax, dword [rbx + 0x6afcc]
mov dword [rbx + rcx*4 + 0x4afb8], eax
jne 0x1400f0790
jmp 0x1400f0849
add dword [rbx + 0x6afcc], edi
mov ecx, dword [rbx + 0x6afcc]
mov edi, ebp
movzx edx, byte [rcx + rbx + 0x1afb8]
lea eax, [rcx + 1]
mov dword [rbx + 0x6afc4], edx
movzx eax, byte [rax + rbx + 0x1afb8]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [rbx + 0x6afc4], eax
jmp 0x1400f084f
mov eax, dword [rbx + 0x6afcc]
xor edx, edx
movzx r8d, byte [rax + rbx + 0x1afb8]
call fcn.1400ef960
dec dword [rbx + 0x6afd8]
mov r11d, eax
inc dword [rbx + 0x6afcc]
test r11d, r11d
je 0x1400f088c
mov ecx, dword [rbx + 0x6afbc]
lea rdx, [rcx + rbx + 0x1afb8]
test ecx, ecx
jns 0x1400f0869
mov rdx, rbp
mov r8d, dword [rbx + 0x6afcc]
xor r9d, r9d
sub r8d, ecx
mov rcx, rbx
call fcn.1400ef700
mov r11d, dword [rbx + 0x6afcc]
mov dword [rbx + 0x6afbc], r11d
cmp dword [rbx + 0x6afd8], 0x106
jae 0x1400f08a0
mov rcx, rbx
call fcn.1400f0510
cmp dword [rbx + 0x6afd8], ebp
jne 0x1400f06b3
mov ecx, dword [rbx + 0x6afbc]
test ecx, ecx
js 0x1400f08be
lea rbp, [rcx + rbx + 0x1afb8]
mov r8d, dword [rbx + 0x6afcc]
mov r9d, 1
mov rdx, rbp
sub r8d, ecx
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1400ef700